BreakglassIntelligence
Back to reports
highPhishing

XWorm V6.0 Multi-Stage Campaign — "backupallfresh2030" — Breakglass Intelligence Report

InvestigatedApril 3, 2026PublishedApril 3, 2026
Threat Actors:ProfileAssessmentTimelineIndicators- Track XWorm V6.0 @XCoderTools variants
xwormbackupallfreshc2ratcloudflaretor

TLP: WHITE Date: 2026-04-03 Analyst: GHOST (Breakglass Intelligence) Classification: Cybercrime — Remote Access Trojan (RAT) Source: Twitter tip from @smica83 / @JAMESWT_WT, tagged #XWorm

Executive Summary

A Turkish-origin threat actor operating under the GitHub alias flexhere687-art (email: flexhere687@gmail[.]com) is conducting an active XWorm V6.0 campaign using a multi-layered delivery chain. The campaign abuses Google Blogger (via custom domain backupallfresh2030[.]com), Filemail for payload hosting, and GitHub for secondary payload staging. The actor deploys at least THREE distinct delivery vectors: obfuscated JavaScript droppers, BAT files with UAC bypass, and trojanized Python 3.12 distributions carrying encrypted shellcode. The campaign has been active since at least 2026-03-22 and targets English-speaking victims through tax document, invoice, and shipping lures.

Key Findings

  • XWorm V6.0 (@XCoderTools) RAT deployed via multi-stage infection chain
  • Actor email exposed: flexhere687@gmail[.]com via GitHub commit history (OPSEC failure)
  • Turkish-origin indicators: BAT dropper contains Turkish comments ("Yonetici izni kontrolu"), payload named "sigortasevdalisi" (Turkish for "insurance enthusiast")
  • GitHub staging repos: flexhere687-art/xvxc- and flexhere687-art/vxcxc-xcv (created 2026-03-22, STILL LIVE)
  • 5 malicious executables hosted on GitHub, including 2 variants of XWorm (.NET)
  • Trojanized Python 3.12 distribution with PythonForWindows + PyCryptodome for in-memory shellcode loading
  • Filemail abuse for hosting 14MB trojanized Python ZIP payload
  • Two Blogspot staging domains confirmed: backupallfresh2030[.]com and marchcap28.blogspot[.]com
  • Persistence via: Registry Run key (mimics Realtek "RtkAudUService"), schtasks, Startup folder, LOLBin abuse (SyncAppvPublishingServer.vbs)
  • Defender evasion: Excludes entire C:\ drive, .exe/.bat/.ps1 extensions, and the install process from Defender scanning

Attack Chain

[EMAIL LURE] (tax docs, invoices, FedEx, CVs)
     |
     v
[JS DROPPER] (.js with fake double extension: "document.pdf                    .js")
     |
     +---> [PowerShell -EncodedCommand]
     |          |
     |          v
     |     [Filemail Download] -> python312x64.zip (14MB trojanized Python)
     |          |
     |          v
     |     [Protected.py] -> AES+XOR decrypt shellcode -> Reflective DLL load
     |          |
     |          v
     |     [XWorm V6.0 RAT] (in-memory, no disk artifact)
     |
     +---> [BAT DROPPER] (UAC bypass via VBS elevation)
                |
                v
           [GitHub raw download] -> dddd.exe / sigortasevdalisi.exe
                |
                v
           [Startup folder + Run key persistence]
                |
                v
           [XWorm V6.0 RAT] (disk-based .NET assembly)

Infrastructure Analysis

Domain Infrastructure

DomainTypeRegistrarCreatedNSPurposeStatus
backupallfresh2030[.]comCustom domainNamecheap2025-11-04lola/rodrigo.ns.cloudflare.comBlogger delivery pageLIVE
marchcap28.blogspot[.]comBlogspotGoogleUnknownGoogleSecond staging domainLIVE

Delivery Infrastructure

ServiceURL/IdentifierPurposeStatus
Google BloggerBlog ID 6582486935030313121Delivery page (CNAME via www)LIVE
Google BloggerBlog ID 4350113143311731351Second staging (#APRL 1 CAP#)LIVE
Filemailfilekey=53VkMz8l67SvighkrcVFIAwFCS9tbjRQ...Trojanized Python ZIP hostingLIVE
GitHubflexhere687-art/xvxc-Malware payload hosting (5 EXEs)LIVE
GitHubflexhere687-art/vxcxc-xcvSecond payload repoLIVE

GitHub Repository Contents (flexhere687-art/xvxc-)

FileSizeSHA256 (prefix)TypePurpose
dddd.exe71KB8d82e375....NET XWorm V6.0Primary RAT payload
31.exe3.2MBa32a687c....NET assemblySecondary payload
sigortasevdalisi.exe8.4MBd0081085...PE32+ x86-64Loader/crypter (Turkish name)
Update_XCEmCHCVGH.exe9.8MBUnknownPE executableUpdate/loader

WHOIS & Registration

  • Registrar: Namecheap, Inc.
  • Registration Date: 2025-11-04T23:38:16Z (5 months before campaign activity)
  • Expiry: 2027-11-04
  • Privacy: Withheld for Privacy ehf (Iceland)
  • Cloudflare NS Pair: lola / rodrigo (shared account indicator)

Malware Analysis

Sample 1: dddd.exe (XWorm V6.0)

FieldValue
SHA2568d82e3757e9db0fc247350ab3140a21badcf8d6c60dfe79200d7d1e2a93dba14
MD5781f4d43b2bbe30677f88b32fbf8b3ec
Imphashf34d5f2d4577ed6d9ceec516c1f5a744
TypePE32 .NET assembly (Mono)
Size71,680 bytes
Compile Time2026-03-22 15:51:01 UTC
Framework.NET 4.0.30319 (VB.NET)
XWorm VersionV6.0 (@XCoderTools)

Capabilities (from User Strings analysis):

  • Remote shell execution (RunShell)
  • DDoS attacks (StartDDos/StopDDos)
  • File management (FM, DW, LN)
  • URL opening (Urlopen, Urlhide)
  • System control (PCShutdown, PCRestart, PCLogoff)
  • Plugin system (plugin, sendPlugin, savePlugin, RemovePlugins)
  • Keylogger (keyboard hook via GetKeyState/GetKeyboardLayout)
  • Screen capture ($Cap, #CAP)
  • Recovery data theft (RunRecovery)
  • Credential harvesting (OfflineGet)
  • Hosts file manipulation (Hosts, Shosts)
  • UAC bypass (UACFunc)
  • File encryption/decryption (ENC/DEC)
  • Process injection (injRun)
  • Telegram C2 notification (bot API + chat_id)
  • Sandbox/VM detection (VMware, VirtualBox, SbieDll.dll, VIRTUAL, microsoft corporation)
  • Anti-analysis (hosting check via ip-api.com)

Encrypted Config (AES-ECB, custom key derivation — config extraction pending):

  • Config stored in .NET #US heap as 15 encrypted strings
  • Key derivation uses non-standard method (not MD5/SHA256 of plaintext key)

Sample 2: Protected.py (Multi-Stage Python Loader)

Obfuscation Layers:

  1. Arithmetic expression obfuscation (chr values computed via complex math)
  2. Base64 + zlib + reverse + ROT13 + XOR(16) for code strings
  3. Custom builtins class reimplementation to hide exec/eval
  4. Junk string insertion throughout

Encryption Keys Extracted:

  • AES Key: a34c243e8fae4a20ad13a0e6be19749c9b0ba47ac8e79af0e4da57f59373c003
  • AES IV: ad4b127c683d974dbeab87331b864884
  • XOR Key 1: aab57c82934f7296a1cf7e8095eca567
  • XOR Key 2: 811ea130857d3fd0c8d32f8b401518e9

Persistence Mechanism:

  • Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run -> RtkAudUService
  • LOLBin: SyncAppvPublishingServer.vbs -> PowerShell -> pythonw.exe Protected.py
  • Install path: %APPDATA%\Templates\python312x64\

Sample 3: BAT Dropper (864eed)

FieldValue
SHA256864eedb88690d3a8479f9deb175e8cd8762b73459c5944684cc05055d14fde27
TypeBAT script (Unicode UTF-8)
LanguageTurkish comments

Actions:

  1. UAC elevation via VBScript (getadmin.vbs)
  2. Disable Windows Defender Enhanced Notifications
  3. Add exclusions: C:, .exe, .bat, .ps1, Microsys.exe process, Startup folder
  4. Download dddd.exe from GitHub raw
  5. Install as Microsys.exe in Startup folder
  6. Registry persistence: HKLM\...\CurrentVersion\Run -> "SysWOW64"

JS Dropper Analysis (0794ad)

Obfuscation: String interleaving with junk pattern IaYvjqgOMp Execution: WScript.Shell -> powershell -EncodedCommand Payload: Downloads trojanized Python from Filemail, extracts to %APPDATA%\Templates, executes Protected.py Fake signature: Microsoft Authenticode signature block appended to appear legitimate

Threat Actor Profile

Attribution Assessment

  • Confidence: HIGH
  • Country: Turkey
  • Evidence:
    • Turkish language in BAT dropper ("Yonetici izni kontrolu" = "Admin permission check")
    • Filename "sigortasevdalisi.exe" (Turkish: "insurance enthusiast")
    • Email: flexhere687@gmail[.]com (exposed in GitHub commits)
    • GitHub account created 2026-03-22 (purpose-built for this campaign)
    • Consistent UTC+3 activity window in commit timestamps

OPSEC Failures

  1. GitHub email exposed: flexhere687@gmail[.]com in every commit
  2. Turkish language artifacts not scrubbed from BAT dropper
  3. Turkish filename in payload repository
  4. Blog title left as operational note: "#2030 domain# namecheap# ALL INJECT"
  5. All infrastructure still live 12+ days into the campaign

Actor Timeline

DateEvent
2025-11-04Domain backupallfresh2030[.]com registered via Namecheap
2026-03-22 00:15GitHub account flexhere687-art created
2026-03-22 00:25First repo (vxcxc-xcv) created with initial dddd.exe
2026-03-22 15:51dddd.exe compiled (XWorm V6.0)
2026-03-24Payload updates pushed
2026-03-25First MalwareBazaar submissions (FedEx lure)
2026-03-28More payload uploads
2026-03-30BAT dropper variant submitted to MalwareBazaar
2026-04-01Tax document JS dropper variants (smica83/JAMESWT_WT reports)
2026-04-01marchcap28 blogspot updated ("#APRL 1 CAP#")

Social Engineering Lures

Lure FilenameThemeVectorDate
James_Smith_Tax_Documents_2025.pdf.jsUS TaxJS dropper2026-04-01
Fedex_statement_of_accounts_inv_03_24_2026_pdf.jsFedEx InvoiceJS dropper2026-03-25
DSB confirmation of funds transfers.jsBank TransferJS dropper2026-03-25
Maria Popescu cv 24-03-26.jsCV/ResumeJS dropper2026-03-26
IMG-01252610-W0W63-CAM087IMG.jpeg.batImage FileBAT dropper2026-03-30
Swift_Copy-40125.exe{124~KB}.exeSWIFT TransferEXE2026-04-03
Order Request..exePurchase OrderEXE2026-04-03
1014578922 INV_PL SWB Specimen.xlamInvoiceCVE-2017-118822026-03-24

MITRE ATT&CK Mapping

TacticTechniqueIDApplication
Initial AccessPhishing: Spearphishing AttachmentT1566.001Email with JS/BAT/XLAM attachments
ExecutionUser Execution: Malicious FileT1204.002JS/BAT dropper execution
ExecutionCommand and Scripting Interpreter: PowerShellT1059.001Encoded PowerShell commands
ExecutionCommand and Scripting Interpreter: PythonT1059.006Trojanized Python distribution
ExecutionCommand and Scripting Interpreter: Windows Command ShellT1059.003BAT dropper
PersistenceBoot or Logon Autostart: Registry Run KeysT1547.001RtkAudUService, SysWOW64
PersistenceBoot or Logon Autostart: Startup FolderT1547.001Microsys.exe in Startup
PersistenceScheduled TaskT1053.005schtasks for minute-interval execution
Defense EvasionImpair Defenses: Disable Windows DefenderT1562.001Add-MpPreference exclusions
Defense EvasionMasqueradingT1036Fake Realtek audio service name
Defense EvasionObfuscated Files or InformationT1027Multi-layer JS/Python obfuscation
Defense EvasionSigned Binary Proxy ExecutionT1216SyncAppvPublishingServer.vbs LOLBin
Defense EvasionVirtualization/Sandbox EvasionT1497VMware/VirtualBox/Sandboxie detection
DiscoverySystem Information DiscoveryT1082CPU, GPU, RAM, OS enumeration
CollectionScreen CaptureT1113$Cap/#CAP commands
CollectionInput Capture: KeyloggingT1056.001LowLevelKeyboardProc hook
Command & ControlApplication Layer Protocol: WebT1071.001HTTP POST C2 communication
Command & ControlWeb ServiceT1102Telegram bot API for notifications
ExfiltrationExfiltration Over C2 ChannelT1041Data sent via XWorm C2 protocol

IOC Summary

Network Indicators

  • backupallfresh2030[.]com (Blogger delivery domain)
  • www[.]backupallfresh2030[.]com (CNAME -> ghs.google.com)
  • marchcap28[.]blogspot[.]com (Second staging domain)
  • hxxps://2007[.]filemail[.]com/api/file/get?filekey=53VkMz8l67SvighkrcVFIAwFCS9tbjRQNSIziw1sS8FshApkve0_aRg5y3k (Payload ZIP)
  • hxxps://raw[.]githubusercontent[.]com/flexhere687-art/xvxc-/main/dddd.exe (GitHub payload)
  • hxxp://ip-api[.]com/line/?fields=hosting (Sandbox detection)

File Indicators

SHA256FilenameType
8d82e3757e9db0fc247350ab3140a21badcf8d6c60dfe79200d7d1e2a93dba14dddd.exe.NET XWorm V6.0
a864e410c00b15f65d31ebfeb96b061dbba7ca0615063d9ab59ef8b6b593d8b2dddd.exe (v2).NET XWorm (variant)
a32a687c22c7c8a2466bf4f84cd7faab3f27a3f03c8ac507d87d542966675aa931.exe.NET assembly
d00810850aade1b7624660fedcd4753fea29a9dfe4bebbf4afe933d3aa981b93sigortasevdalisi.exePE32+ loader
687f0be5399d54a1b841fdae68c75d2e46dd12f1c76f14687da58222191bbb08python312x64.zipTrojanized Python
333aae0b09f9a443c3fd9b381f04f684e87aa6ad8fc55f8ac3293e8df80b45d5James_Smith_Tax_Documents_2025.pdf.jsJS dropper
0794add65a271388acc6ab87a0dc2fe47373b40921f22dec12c02f74fbe6b1542license.jsJS dropper
c6c0e723cfc8bc80ec71b0f02627cf3030c27f6aa209b23cbd94d041eab64384James_Smith_Tax_Documents_2025.pdf.jsJS dropper (variant)
864eedb88690d3a8479f9deb175e8cd8762b73459c5944684cc05055d14fde27IMG-01252610-W0W63-CAM087IMG.jpeg.batBAT dropper

Behavioral Indicators

  • Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\RtkAudUService
  • Registry: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysWOW64
  • Registry: HKLM\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications
  • Scheduled Task: Minute-interval task for persistence
  • Install Path: %APPDATA%\Templates\python312x64\
  • Startup File: %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Microsys.exe
  • Log File: \Log.tmp
  • Mutex: Encrypted (extraction pending)
  • User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
  • Imphash: f34d5f2d4577ed6d9ceec516c1f5a744

Actor Indicators

  • GitHub: flexhere687-art (User ID 270032735)
  • Email: flexhere687@gmail[.]com
  • Blogger IDs: 6582486935030313121, 4350113143311731351

Immediate (24-48 hours)

  • Block all IOC domains/URLs at proxy/firewall
  • Search for RtkAudUService and SysWOW64 registry Run key entries
  • Search for %APPDATA%\Templates\python312x64\ directory
  • Search for Microsys.exe in Startup folders
  • Search for SyncAppvPublishingServer.vbs LOLBin execution in EDR logs
  • Report GitHub repos flexhere687-art/xvxc- and flexhere687-art/vxcxc-xcv for takedown

Short-term (1-2 weeks)

  • Submit flexhere687@gmail[.]com to abuse databases
  • Report backupallfresh2030[.]com to Namecheap abuse
  • Report Blogger abuse for Blog IDs 6582486935030313121 and 4350113143311731351
  • Report Filemail link as malicious
  • Deploy YARA and Suricata rules (see below)

Medium-term (1-3 months)

  • Monitor for new domains using same Cloudflare NS pair (lola/rodrigo)
  • Monitor GitHub for new repos from same actor
  • Track XWorm V6.0 @XCoderTools variants

Abuse Reports

GitHub

Namecheap

  • Domain: backupallfresh2030[.]com
  • Email: abuse@namecheap.com
  • Evidence: Used as custom domain for malware delivery via Blogger

Google (Blogger)

Filemail

  • Link: hxxps://2007[.]filemail[.]com/api/file/get?filekey=53VkMz8l67SvighkrcVFIAwFCS9tbjRQNSIziw1sS8FshApkve0_aRg5y3k
  • Content: Trojanized Python distribution with XWorm RAT loader

References

GHOST -- Breakglass Intelligence "One indicator. Total infrastructure."

Share