Trojan:Win64/XWorm.GVA!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.GZK!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.GZM!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.GXF!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.AXM!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.ZAP!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.CVL!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.MBX!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.MBY!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family. 

Trojan:Win64/XWorm.BAA!MTB is a multi-functional malware-as-a-service remote access trojan (RAT) linked to ClickFix campaign that establishes persistence on Windows devices. This is done by creating files in user directories like C:\Users\Public\jsc.exe and placing a malicious .url file in the Startup folder. It modifies Windows Registry keys to maintain control and communicates with its command-and-control infrastructure, including the IP address 192[.]3.182.92[:]7006 and domain kribyrisk[.]com. The XWorm’s capabilities include launching remote commands for Windows shutdown, keylogging, screen capture, DDoS attacks, and downloading additional payloads, providing threat actors with comprehensive control over infected devices. 

The “!MTB” suffix refers to Machine Threat Behavior, which indicates that this trojan was detected using behavioral analysis or machine learning models. Instead of relying solely on a static signature (like a known file hash), the antivirus engine identified the program's actions, sequence of operations, or code patterns as malicious. These patterns are consistent with the known behavior of the XWorm family.