#xworm #opendir at:

http://107.173.143\.44/60

c2: 151.241.154\.23:7007

— from @James_inthe_box (https://x.com/James_inthe_box/status/2107491399730073763)

#xworm #opendir at:

http://107.173.143\\.44/60

c2: 151.241.154\\.23:7007

2CLoader malware dodges sandboxes and security tools to deliver Vidar and Remus infostealers. See how it works and how to detect it.

#2CLoader #Vidar #Remus #XWorm #Infostealer #MalwareLoader #ThreatLabz #CyberSecurity

ThreatLabz tracked 2CLoader, a Windows loader using anti-analysis and HTTP C2 to deliver Vidar, Remus, and XWorm via XOR-encrypted JSON. #2CLoader #Vidar #XWorm

2CLoader binds its AES key to its own .text hash, then drops Vidar, Remus and XWorm. https://intel.threadlinqs.com/threat/TL-2026-2819 #ThreatIntel #XWorm #Vidar #Remus

Two new posts with #pcap, #malware, other files and #indicators for #XWorm (Tuesday, 2026-09-08) and #AMOS #Stealer (Thursday, 2026-09-10).

www.malware-traffic-analysis.net/2026/index.h...

Lua loader hides in fake .ttf font files - fileless RATs via VEH-encrypted shellcode. https://intel.threadlinqs.com/threat/TL-2026-2402 #ThreatIntel #Rakhni #Agent #XWorm