Huntress Traces Targeted Phishing Attack to XWorm Malware
Summary
Huntress traced a likely phishing infection from a tax-themed archive and Windows shortcut to an XWorm loader. The attack used a decoy W-2 PDF while downloading and launching malware, which established persistence with a scheduled task.
Key points
- A tax-themed archive in a user’s Downloads folder contained a Windows shortcut that launched PowerShell and mshta.exe to retrieve a remote HTA file.
- The HTA led to a BITS job that downloaded a batch file, which opened a decoy W-2 PDF while extracting and launching a remote access Trojan.
- Huntress analysts identified the executable as a Go-written loader carrying XWorm; the file had substantial trailing zero padding.
- The XWorm sample created a scheduled task named “mail” to establish persistence. Huntress reported no observed credential access, lateral movement, exfiltration, or impact.
- Huntress notified the customer and advised removing the downloaded archives and extracted files.
- The incident illustrates how targeted tax-themed lures can blend into expected business activity, and the article recommends pairing security awareness training with EDR or MDR.
Article Details
- Attack Vectors
- Likely targeted phishing delivered a ZIP archive disguised as routine tax-related business material.
- A Windows shortcut in the archive launched an obfuscated PowerShell command that invoked mshta.exe to retrieve an HTA file.
- The HTA led to a BITS Client job that downloaded and executed a batch file. The batch downloaded and opened a W2 PDF decoy while extracting and launching a remote access Trojan from an archive.
- The Go-written loader carried an XWorm executable locally rather than downloading it from the Internet; the loader was padded with zeros to hinder analysis.
- Defensive Notes
- Huntress advised the customer to remove all archives and extracted files to remediate the infection.
- The article recommends pairing security awareness training with an EDR or MDR technical backstop.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | transfer[.]sh | File-transfer service domain used in the observed payload-download commands. |
| URL | hxxps[:]//transfer[.]sh/get/RzbMK13oyI/p.hta | URL embedded in the shortcut command to retrieve the HTA payload. |
MITRE ATT&CK
T1027.001 · Binary PaddingThe shortcut command was obfuscated, and the loader was padded with zeros to hinder analysis.T1053.005 · Scheduled TaskThe malware created a scheduled task named “mail” to establish persistence.T1059.001 · PowerShellThe shortcut invoked PowerShell to retrieve the HTA and later the batch-file commands used PowerShell to download files.T1059.003 · Windows Command ShellThe downloaded batch file executed commands to retrieve files, extract an archive, and launch its contents.T1197 · BITS JobsThe HTA led to creation of a BITS Client job to download and execute a batch file.T1204.002 · Malicious FileThe user opened a ZIP archive containing a Windows shortcut that initiated the infection chain.T1218.005 · MshtaThe shortcut command launched mshta.exe with a remote HTA URL.T1566.001 · Spearphishing AttachmentThe incident was assessed as likely stemming from a phishing email.