Skip to main content

XWorm

Malware Family

6 649 indicators of compromise attributed to XWorm across abuse.ch threat intelligence feeds.

Domains

391

IPs

418

URLs

11

Hashes

5 829

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (391)IPs (418)URLs (11)Hashes (5 829)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
christian-optimal.gl.at.ply.ggdomain
sddfgdqw45tj-35300.portmap.hostdomain
sex4fun.duckdns.orgdomain
wormsito.duckdns.orgdomain
mail.clearvwtp.shopdomain
xw.jukt.topdomain
koyet88723-44608.portmap.hostdomain
tagmentos.bingbaochow.camdomain
system.yg.inkdomain
kellydarosa.ddns.com.brdomain
ugvsss-39887.portmap.hostdomain
hebasix.duckdns.orgdomain
system.vx.inkdomain
fuckniggers69420911-30770.portmap.hostdomain
jxjdhjdx-61930.portmap.hostdomain
infogruposyc.duckdns.orgdomain
kdxho645fm.localto.netdomain
lodalasan22wwee.duckdns.orgdomain
loganwolverin2042.webredirect.orgdomain
sdlpsajdioasjd-60039.portmap.hostdomain
172.245.92.217ip
31.56.209.234ip
107.174.20.215ip
209.127.35.204ip
46.151.182.18ip
94.154.32.41ip
156.233.71.222ip
151.241.154.193ip
135.136.134.57ip
83.142.209.150ip
31.6.50.206ip
64.188.66.196ip
45.153.34.27ip
85.203.4.222ip
155.103.69.171ip
194.116.236.223ip
194.59.31.98ip
45.133.116.16ip
91.236.186.56ip
104.168.5.18ip
http://94.159.113.64/a.jpgurl
http://94.159.113.64/b.jpgurl
https://vmailnewwqmwe.vercel.app/new.msiurl
https://pastebin.com/raw/BUKERxVjurl
https://pastebin.com/raw/frTxisXLurl
http://158.94.211.208/OBOXW2026.txturl
https://pastebin.com/raw/Rq7yMK0Wurl
http://209.145.51.44/keepon.exeurl
https://pastebin.com/raw/Zsds1pcWurl
https://pastebin.com/raw/V8ESQmNyurl
http://45.141.27.27/dll/url
eb01888a925ab40f28e87749cb35cd0feb6fbb8381a21719f97f47a560f8ddafhash
bdabe0d31f4a9b3fac4226b6b981013d8f0daf900b9241820761d4595bd14596hash
621c958504b020d469f2759a6acd5494552921515ff9b01fc73892fa6488d463hash
9f3f1e2fb2144b98704d12094feec42ee6f17a12d934717cc2641bd22d711faahash
d9575b6fd3ef66d1a260ab641f2c8a1d28c7440299b61c4390a96b00dd58f46ehash
820bb1a31f421b90ea51efc3e71cc720c8c2784fb1e882e732e8fafb8631a389hash
1beba7bcaf594abc134967d46daba76c2b554b2358df3e1b6dcc993e336e6490hash
b7e3ed8add4ed1f4d78dd45fd97486240585c79ebb5f636949d0e2e62f3b6e14hash
2596da0f53ad33155f7fb8ff9c807289ab6e32586e6f74a8a23eea128c403d01hash

Another file to check? Run a file hash reputation check.