Open Directories Reveal XWorm Disguised as Legitimate Software
Summary
Hunt researchers found XWorm samples in exposed directories disguised as familiar software. Examples included a batch script that appeared to disable Windows Defender and a campaign using fake gift-card shortcuts to deliver malware that exfiltrated data to Telegram.
Key points
- Researchers identified more than 300 XWorm samples available through open directories in Hunt’s AttackCapture tool.
- Samples used names mimicking legitimate software and Windows components, including chrome.exe, svchost.exe, and SecurityHealthService.exe.
- A batch file alongside chrome.exe appeared designed to disable Windows Defender before running the payload.
- One server shared an SSH key with more than 100 other servers; the article cautions that this alone does not establish they are malicious.
- A fake gift-card campaign used shortcuts that downloaded a batch script concealing XWorm; the malware then exfiltrated data to a Telegram account.
- The article recommends monitoring exposed directories, checking file reputation, using application allowlisting, and tuning endpoint defenses.
Article Details
- Attack Vectors
- XWorm was distributed through exposed open directories, with files disguised as legitimate software such as SecurityHealthService.exe, chrome.exe, and svchost.exe.
- A fake gift-card promotion used shortcuts that downloaded a batch script concealing XWorm.
- The chrome.bat script appeared designed to disable Windows Defender, likely in preparation for executing chrome.exe.
- Defensive Notes
- Monitor external open directories for malicious files targeting the organization or its supply chain.
- Use file reputation services and application allowlisting to prevent unverified or suspicious executables from running.
- Deploy and tune EDR to detect malicious scripts disabling security features and executables using misleading filenames.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]230[.]121[.]82 | Open-directory server reported to host an XWorm-disguised file named SecurityHealthService.exe. |
| IPV4 | 158[.]247[.]200[.]45 | Open-directory server reported to host XWorm-disguised files, including chrome.exe. |
| IPV4 | 216[.]173[.]64[.]63 | Open-directory server associated with a fake gift-card scam delivering a batch script concealing XWorm. |
MITRE ATT&CK
People
Malware
Products
Google Chrome(Hunt).The directory also contains chrome.exe and chrome.bat, which are likely intended to mimic the Google Chrome browser. Further analysis of chrome.exe in VirusTotal shows that the file has also been uploaded asVirusTotalwhich are likely intended to mimic the Google Chrome browser. Further analysis of chrome.exe in VirusTotal shows that the file has also been uploaded as svchost.exe, another well-known Windows process oftenWindows Defenderwithout downloading. For example, chrome.bat, shown in Figure 6, appears designed to disable Windows Defender-likely in preparation for executing chrome.exe. Notably, the script contains comments in the Korean
Tools
Countries
South KoreaHosted in South Korea and part of The Constant Company, LLC network,Thailand103.230.121[.]82, hosted in Thailand on the Bangmod Enterprise Co., Ltd.United States216.173.64[.]63, is hosted by Evoxt Enterprise in the United States. This IP recently drew the attention of researcher Karol Paciorek, who reported its involvement in a scam promoting fake gift cards. Upon closer