Xworm 3.1 - ((free))

It uses virtualization and sandbox detection to avoid analysis. Recent versions have been seen utilizing UEFI bootkits

Capable of launching network attacks (e.g., UDP/TCP floods). xworm 3.1

The main payload that establishes a socket connection to a remote server. It uses virtualization and sandbox detection to avoid

As of late 2025, XWorm 3.1 remains in active circulation, but its source code has been leaked multiple times, leading to fragmented "custom builds." The original author(s) likely shifted to a new project, but variants like XWorm RAT v3.2 (unofficial) and DiamondRAT (a rebrand) are emerging. XWorm 3.1 remains in active circulation

: Clicking a link in the PDF downloads an executable that initiates the infection.