XWorm
Named by 4 kept items in this workspace.
3 items name it under threat actors and 1 under classification.key entities.
Search every workspace for XWorm. It matches the name as written, so it can find other things that share it.
The items that name it 4
RAT; C2 panel versions up to 7.4 has unauthenticated RCE flaw; PoC published by Mootoo
RAT identified by Hatching Triage analysis of WDS.bat, retrieved from mountaingoats4sale[.]xyz; associated C2 infrastructure at 45[.]157[.]233[.]46:25565; execution chain involves cmd.exe, PowerShell activity, in-memory payload loading, and persistence via a hidden scheduled task.
commercially available backdoor, leaked or cracked versions exist
All threat actors in this workspace.