XWorm is a commodity .NET remote access trojan that has circulated widely since 2022, popular enough that automated sandboxes and public malware repositories carry thousands of tagged samples. It is a reasonable example of what a modern commodity RAT's infrastructure actually looks like - not because any one sample is remarkable, but because there are enough of them in public view to see the pattern.
//What a Config Looks Like
A Joe Sandbox report on an XWorm V5.6 sample lists a typical configuration: a loopback address paired with an external domain, a port, an AES key, a persistence identifier, and an install filename. The sample used AES encryption for its C2 traffic and triggered Suricata network detection rules during analysis - XWorm is well enough known that signature-based network detection for it already exists in common open rule sets.
That AES-based, domain-plus-port configuration shape is broadly consistent with what the sampled 2025 MalwareBazaar submissions show, though the specific values - domain, port, key - differ sample to sample, as expected for a commodity tool each operator configures independently.
Infrastructure patterns
A recurring pattern across 2025 samples in MalwareBazaar is the use of ply.gg tunnel hostnames on unusual, high-numbered ports - for example, a C2 address of copy-victor.gl.at.ply.gg on port 17983. ply.gg is a tunneling service that exposes a local port through a public hostname, which lets an operator run C2 infrastructure from a home connection or a disposable host without ever owning a domain or a public IP themselves. Other samples use raw IP addresses directly, or free dynamic-DNS names such as those under duckdns.org. The ply.gg pattern appears across samples first seen from August through December 2025, suggesting it was a live, sustained pattern rather than a single campaign.
One caution worth noting for anyone building detections from automated sandbox tags: family labeling in these public repositories is noisy. Several samples carry both an XWorm tag and a njRat or AsyncRAT tag from the same automated verdict, so family attribution from sandbox labels alone should be treated as a hint, not a confirmed identification.
//What This Rewrite Does Not Cover
A full config-extraction methodology - the exact decryption routine, key derivation, or a working parser - needs a dedicated technical write-up, and this rewrite did not find one specific enough to cite with confidence. The withdrawn version of this article claimed to ship a Python-based extractor; no such tool exists in this site's own work, and nothing here should be read as one.