Hunt.io Walkthrough Finds a Phishing Site Hosting XWorm RAT
Summary
A hunting walkthrough examines an open directory containing a cryptocurrency phishing site and XWorm RAT, showing how its files attempt to steal credentials and recovery phrases and how scripts download and execute additional files.
Key points
- A researcher found an open directory at 65.1.224[.]214 hosting a cryptocurrency-themed phishing site and files identified as XWorm RAT.
- The phishing pages imitated a digital currency service and sought users’ login credentials and recovery phrases.
- Downloader.bat downloads a PowerShell script, which retrieves BAT and VBS files and runs the VBS file if it is not already present.
- The VBS file silently runs 2.bat when available; 2.bat drops 2.bat.exe in the %TEMP% folder.
- The post demonstrates using an open-directory hunting platform to locate and inspect suspicious files, but says a full analysis of the files is outside its scope.
Article Details
- Topic
- Using open directories to discover phishing pages, malicious files, and malware-hosting infrastructure
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 65[.]1[.]224[.]214 | IP address of an open directory server identified as hosting malicious software and a phishing site. |