💳 Fake Financial Receipts Deliver XWorm Across LATAM — Quiet, Layered, Built to Blend In

This wasn’t noisy ransomware.

This wasn’t smash-and-grab malware.

This was quiet.

Targeted.

Operationally aware.

A new campaign targeting Brazilian businesses delivers XWorm v5.6 through fake financial receipts — and the infection chain is engineered to avoid early detection at almost every step.

The payload? Commodity RAT.

The delivery? Not commodity at all.

🎯 Why This Campaign Works

The lure is simple:

“Comprovante-Bradesco…”
A banking receipt.

In LATAM corporate environments, payment confirmations and financial documents are routine.

High click probability.
High operational realism.

The file appears as:

receipt.pdf.js

Double extension trick.

But this isn’t just a JavaScript dropper.

It’s padded to 1.2MB with junk entropy to evade static scanners that skip oversized scripts.

That’s intentional.

🧩 The Infection Chain (Stage-by-Stage)

🥷 Stage 1 — Obfuscated JavaScript Dropper

• Heavy Unicode junk injection

• Emoji padding

• Homoglyph noise

• Delimiter-based string reconstruction

No complex crypto.

Just runtime .replace() cleanup → Base64 → UTF-16LE decode → PowerShell launcher.

Execution method?

Not the usual noisy WScript.Shell.Run.

Instead:

WMI process creation via Win32_Process.

Hidden window.
5-second sleep delay.
Sandbox evasion.

Already quieter than most commodity droppers.

☁️ Stage 2 — Cloudinary Steganography

PowerShell downloads what appears to be:

optimized_MSI_lpsd9p.jpg

Hosted on Cloudinary.

Legitimate image hosting service.

To perimeter tools, this looks like normal user traffic.

But inside the image:

Markers:
BaseStart-
-BaseEnd

Between them?
Base64-encoded .NET assembly.

Loaded directly into memory using:

[Reflection.Assembly]::Load()

No disk artifact.
No traditional file scan.

Fileless execution.

🔐 Stage 3 — Dedicated Persistence Module

Instead of dropping XWorm directly, attackers deploy a VB.NET DLL persistence module.

Purpose: Survival.

It registers a scheduled task.

But not via:

schtasks /create

That would trigger EDR alerts.

Instead:

It interacts directly with Task Scheduler COM APIs through .NET wrappers.

Meaning:

No command-line artifacts.
No obvious process chain.
Task simply “appears.”

And what does it relaunch?

Stage 2 PowerShell loader.

Modular design.
Self-healing infection loop.

🧬 Stage 4 — XWorm Injection via CasPol.exe

Final payload is retrieved from:

voulerlivros[.]com.br/arquivo_20260116064120.txt

The .txt file?

Reversed Base64.

Decoded → .NET binary → XWorm v5.6.

But it doesn’t execute standalone.

It injects into:

CasPol.exe

A legitimate Microsoft .NET utility.

Living-off-the-Land Binary (LOLBIN) abuse.

Trusted process.
Outbound TCP to:

jholycf100[.]ddns[.]com.br
Port: 7000

Protocol delimiter:

<Xwormmm>

Classic XWorm fingerprint.

🔥 What This Means for Businesses

This isn’t “just another RAT.”

This is identity compromise infrastructure.

Once XWorm has access:

• Browser credential harvesting

• Session token theft

• SaaS compromise

• Email access

• Financial system abuse

• Lateral movement

• Ransomware staging

And because early-stage behavior blends in:

• Image download

• PowerShell background execution

• Legitimate binary injection

Mean Time To Detection increases.

And when detection is late?

Impact spreads.

📊 Strategic Takeaway

This campaign rewards defenders who catch:

• JS/WSH spawning PowerShell

• Cloud-hosted “images” with abnormal content

• CasPol.exe generating outbound traffic

• Scheduled tasks created via COM APIs

Commodity malware.

Non-commodity tradecraft.

This is what mature regional targeting looks like.