rat
XWorm
A commodity .NET RAT sold as malware-as-a-service, among the most frequently recovered families in open directories. Named by 4 reports, 8 detection rules, 1 IOC feed and 1 tracked actor.
Also written as: Xworm, XwormLoader. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Shadow RAT & XWorm Open Directory Campaign
RAT_XWorm_30_50_Config, RAT_XWorm_Rijndael256ECB_Crypto
Detection rules
ZeroTrace Multi-Family MaaS Operation (74.0.42.25)
RAT_XWorm_V56_Stub, TOOLKIT_XWorm_V56_Builder
Detection rules
Dual-RAT Analysis: Pulsar RAT vs. NjRAT/XWorm
NjRAT_XWorm_Triple_Persistence, NjRAT_XWorm_Core_Detection
IOC feeds
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-003: Commodity MaaS consumer running Shadow RAT and XWorm from one Windows VPS
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.