Heavily obfuscated batch file loads XWorm hosted on GitHub 20 January 2025 VMRay Labs found a multi-stage obfuscated batch script with low detections on VirusTotal which downloads and executes XWorm from GitHub. The sample uses a UTF-16 Byte Order Marker and an open source Batch obfuscator to hinder manual analysis.
Keep up to date with our weekly digest of articles. Get the latest news, invites to events, and threat alerts!
Ready to stress-test your malware sandbox? Join us for a no-fluff, all-demo webinar that shows you real techniques to evaluate and optimize your sandboxing solution!