Want More XWorm?, (Wed, Mar 4th)

The report describes a recent wave of XWorm (Win.XWorm) infections: attackers use obfuscated JavaScript to drop PowerShell loaders which decode and run an XOR-encrypted DLL that performs process hollowing to inject the XWorm client. The author includes the extracted configuration (C2 IP, mutex, AES key, install filename), file SHA256 IOCs, and notes reuse of a previously observed C2 address.