user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat Trojan:MSIL/XWormRAT.A!MTB
Trojan:MSIL/XWormRAT.A!MTB - Windows Defender threat signature analysis

Trojan:MSIL/XWormRAT.A!MTB - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: Trojan:MSIL/XWormRAT.A!MTB
Classification:
Type:Trojan
Platform:MSIL
Family:XWormRAT
Detection Type:Concrete
Known malware family with identified signatures
Variant:A
Specific signature variant within the malware family
Suffix:!MTB
Detected via machine learning and behavioral analysis
Detection Method:Behavioral
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Trojan - Appears legitimate but performs malicious actions for .NET (Microsoft Intermediate Language) platform, family XWormRAT

Summary:

This threat is a Remote Access Trojan (RAT) from the XWormRAT family, detected by machine learning behavioral analysis. It is designed to grant an attacker full remote control over the infected machine, enabling data theft, keystroke logging, and deployment of further malware.

Severity:
Medium
VDM Static Detection:
No specific strings found for this threat
Known malware which is associated with this threat:
Filename: 717A9267F1F4B00C0B8E44E9ABCA7FC0.exe
2308bb46acec261999dd1455b9586ac7ebf3f677630e04256807130a6322e62e
08/12/2025
→VirusTotal↓Download Sample
Filename: 81FA4BB844407B3CFDACD65902B7970D.exe
661481bcb96c23a0add2db58217ea0e2c162cbd6340365a92eca0cf96996e088
08/12/2025
→VirusTotal↓Download Sample
Filename: Solara.exe
3845ad8b92bf909843c14f50367c81c5583fc8bce481faa95eb6ffb2cfed59f1
03/12/2025
→VirusTotal↓Download Sample
Filename: 0b2a20629f103349d431fb0d0211fd94.exe
f423abf74d7dcf81f7b72bf6610c04807aa2d6039301c8935e4e1dcf7e7be132
24/11/2025
→VirusTotal↓Download Sample
Filename: aimware.exe
e0105c7b151f4d6b2056accc32677e459a549c3a54ca231c380bd9fcdf989e7d
22/11/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected machine from the network immediately. Use Windows Defender to perform a full scan and remove the detected threat. Investigate the initial access vector and change all user credentials on the compromised system.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 05/11/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊