Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Paste.ee Abuse Uncovered: XWorm & AsyncRAT Infrastructure

hunt.io | blog | #obfuscation | #c2 | #asyncrat | #xworm | #malware-delivery | #paste-ee

Summary

An obfuscated JavaScript downloader abusing paste.ee to stage payloads leads researchers to XWorm and AsyncRAT C2 infrastructure, with regex and SSL detection guidance for defenders.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Uncovering Threat Actor Tactics: How Open Directories Provide Insight into XWorm Delivery Strategies
Using open directories, Hunt.io shows how XWorm RAT samples masquerade as browsers, security tools and file-transfer apps—including a lone SecurityHealthService.exe on a Thai-hosted server.
blog · hunt.io
The Accidental Malware Repository: Hunting & Collecting Malware Via Open Directories (Part 1)
First in a hunting series: an open directory holding a phishing site and XWorm RAT, whose spoofed login pages — blockchain and device-verification lures — steal credentials and seed phrases.
blog · hunt.io
Gateway to Intrusion: Malware Delivery Via Open Directories
Two case studies of malware delivered via open directories: an AsyncRAT chain using VBScript and BITS to fetch a staged payload, and a Fernet-wrapped Python executable beside a SuperShell login page.
blog · bishopfox.com
From Fork to Framework: What Modifying Apollo Taught Us About Agent Invasion
Bishop Fox forked Mythic's Apollo agent and built a custom obfuscator to evade EDR, but Apollo's architecture assumed readable symbol names — obfuscation failed, pushing a from-scratch redesign.
blog · hunt.io
SilkParasite Infrastructure: SpiceRAT Servers Tied to Energy and Government Targets Across Central Asia
Hunt.io's SpiceRAT detections linked shared infrastructure across malware families from Bitdefender's SilkParasite report to energy, government, and telecom targets in Central Asia.
blog · hunt.io
A Practical Guide to Uncovering Malicious Infrastructure With Hunt.io
A step-by-step infrastructure hunting walkthrough: from an AsyncRAT-linked IP, pivoting through ASN data, ports, services and TLS certificates to uncover a wider cluster of systems.
back