Skip to main content

XWorm

Malware Family

6 525 indicators of compromise attributed to XWorm across abuse.ch threat intelligence feeds.

Domains

383

IPs

397

URLs

9

Hashes

5 736

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (383)IPs (397)URLs (9)Hashes (5 736)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
datahawk.duckdns.orgdomain
ms-pupils.gl.at.ply.ggdomain
plusheditz-49070.portmap.hostdomain
q4k7uphvys.localto.netdomain
rattedniggers-60092.portmap.hostdomain
ghfjfgj57765r67ghght-56660.portmap.hostdomain
or3k-51808.portmap.hostdomain
ceee.zapto.orgdomain
dpunk.duckdns.orgdomain
needforrat.hopto.orgdomain
ayidhh-48261.portmap.hostdomain
hlgzssmbz.localto.netdomain
asd.exfrp.sbsdomain
valid-witnesses.gl.at.ply.ggdomain
xwsub.cincv.groupdomain
d5nnast9u1.localto.netdomain
kittyland.ggdomain
9vun520l.aamothership.comdomain
212.ip.ply.ggdomain
19.tcp.cpolar.topdomain
68.219.64.89ip
158.94.211.208ip
130.12.181.118ip
151.242.63.220ip
31.40.204.71ip
135.136.134.57ip
209.145.51.44ip
143.92.51.33ip
191.101.130.75ip
64.188.66.196ip
43.228.157.124ip
45.153.34.27ip
172.94.15.100ip
41.105.137.137ip
31.56.209.56ip
8.148.5.193ip
104.249.10.187ip
13.143.66.14ip
31.40.204.237ip
178.173.247.121ip
http://94.159.113.64/a.jpgurl
http://94.159.113.64/b.jpgurl
https://vmailnewwqmwe.vercel.app/new.msiurl
https://pastebin.com/raw/BUKERxVjurl
https://pastebin.com/raw/frTxisXLurl
http://158.94.211.208/OBOXW2026.txturl
https://pastebin.com/raw/Rq7yMK0Wurl
http://209.145.51.44/keepon.exeurl
https://pastebin.com/raw/Zsds1pcWurl
8c70051aa52ca2f2651c74085863afee2bf7bab1e5141a414cd7f96e59366da7hash
a467b27938a326b5e8e3a06faffec85324e5d94afcfb1be03715becd36eeb8fdhash
fc2f9be23bf0b4e188ed50d3b97efc0b4f24088388b5f9662e568fad61d6811fhash
b9087262c43b95872dd38e9ecb73aabec8361afa88c74ccb2b66641d15aff630hash
3e725d0efe588ac45c5bfa6aee1b6d5e75b65aa3a301e274c5e8e825ac390b7ehash
dce10cbe9a1a377f126f00a29965c0a6750b0e4702de791dd3ab51e4c743b675hash
8cafe02ae7050245022e1afdd9552286c7d3cf944d15cea2d4c7f74fe909e2echash
f8d8e8cefdddc14bd1efd94853b1259109f35811f51082dfd33cb275f87ddb23hash
36c01710f8ff21e4e5a5e72373c419d3fadd9f22de8d7e78b1502e03a42bdd4ehash
5b02bf5ea457bb4d01c5f5778aee826a7d8a00fbfa09d8412cad5d960438377dhash
6a8e589c2368fbd7a40d55391c8a57e6a09be10726db5b328c45e2e2ff7cbe99hash

Another file to check? Run a file hash reputation check.