XWORM Delivered Via Ghost Crypt DLL Side-Loading

Kaung Khant Ko@kaungkhantko

•updated Oct 30, 2025•1•1•291

Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.