XWorm

Malware Family

6 247 indicators of compromise attributed to XWorm across abuse.ch threat intelligence feeds.

Domains

322

IPs

317

URLs

7

Hashes

5 601

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (322)IPs (317)URLs (7)Hashes (5 601)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
ms-pupils.gl.at.ply.ggdomain
jbbjbjkb-61631.portmap.hostdomain
dextecrop.availinfra.camdomain
laohen29.myvnc.comdomain
ashashh-64209.portmap.hostdomain
ogonna.ydns.eudomain
xinclas.vmcentra.topdomain
yttt-52788.portmap.hostdomain
noajadfylf.localto.netdomain
fuckniggers69420911-30770.portmap.hostdomain
subscribe-marina.gl.at.ply.ggdomain
ultraportal.4nmn.comdomain
tcp4.tunnel4.comdomain
different-walt.gl.at.ply.ggdomain
names-again.at.playit.ggdomain
cloud.lurstanmailer.comdomain
slashxx.duckdns.orgdomain
niggaboo32-34796.portmap.hostdomain
privatedns.jiahouse.comdomain
embargogo2378.duckdns.orgdomain
64.89.161.16ip
102.220.160.146ip
103.83.86.162ip
209.54.101.190ip
8.148.5.193ip
94.156.179.152ip
185.215.151.120ip
217.60.195.87ip
203.202.232.149ip
84.38.133.144ip
114.207.112.13ip
104.250.180.178ip
2.27.63.221ip
83.217.209.98ip
198.23.177.219ip
81.159.116.2ip
2.27.160.11ip
103.83.87.183ip
209.25.140.25ip
150.241.70.126ip
http://94.159.113.64/a.jpgurl
http://94.159.113.64/b.jpgurl
https://vmailnewwqmwe.vercel.app/new.msiurl
https://pastebin.com/raw/BUKERxVjurl
https://pastebin.com/raw/frTxisXLurl
http://158.94.211.208/OBOXW2026.txturl
https://pastebin.com/raw/Rq7yMK0Wurl
e036bb5441416bcd7ba4b93cdbec47d1e9e76fb3470834b73521a811cfacf5d2hash
2d4be0055da6f8a61126b5a3194445600e55796689b6b8eb38f0481793f5e3c1hash
9ce6f4d5a77d9ee2e7ff89b5a68b3665317d0338ac13f241bc01578953c0ceb9hash
fb10cd116026ce4912245d49d329cb1208c565734068374d7864a149f73f2992hash
4d69cdf147806770e348951d3a7068cb97cc1da5b6f50eae2f20b5eeb1eadc60hash
7324dc59e2c7c2362de668932d9d38df2263dec910523d0596d1411a4f131d6fhash
e2da1a6b59314cd806e16ea995d0b3700bc8f5ab2ffdd327e0064370f0cb5b2dhash
9a0d8a0fc3c799da381bc0ca4410fd0672f0a8b7c28c319db080325f4db601fehash
d25f0a9a460873e9a1441bb8078100932a8d5d708ea4f5b14bd66aa726a181cchash
19a057d7cafbfdc9b5d9436fb79b796f927ee8f9e3a2edaef9bfd25f3f87cee9hash
3e473b446670593d0f188a1f6d5a65b186dd02715b4fe7bbfef5df905815aa21hash
9284545d6d4a27ef2314218c18aafb6c77ecbf7be2f79333f238b40314d238f9hash
4d23f39da1e4a0435bf6a051547dd2790f90b94713f0a3282e50cf51e62fc2e5hash