XWorm - High-Entropy Anti-Analysis Decoy (T1497)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•1

Hunts for the IAT_PHANTOM_FIX evasion routine where Python generates thousands of SHA-512 hashes to delay execution and fool heuristics. This rule specifically looks for 'python.exe' processes executing command lines that contain a loop iterating a large number of times (at least 1000) and performing SHA-512 hashing, indicative of anti-analysis techniques used by malware like XWorm.