{
  "family": "blasterx",
  "sample_count": 0,
  "category": "worm",
  "description": "BlasterX is a variant of the notorious Blaster worm that caused widespread disruption on the internet in the early 2000s. Operating as a network worm, BlasterX rapidly self-propagates by exploiting vulnerabilities in the Windows DCOM RPC service, requiring no user interaction to infect vulnerable systems. Once a machine is compromised, the worm executes a payload designed to participate in Distributed Denial of Service (DDoS) attacks, often targeting specific infrastructure or websites. A hallmark of the Blaster family is its ability to cause systems to repeatedly crash and reboot, leading to significant downtime and loss of productivity. The rapid spread of BlasterX highlighted critical flaws in patch management practices, underscoring the absolute necessity for organizations and home users to promptly apply security updates released by software vendors.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "W32.Blaster.X",
    "Lovsan Variant"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is BlasterX?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "BlasterX is a network worm variant of the original Blaster malware, known for rapid self-propagation."
      }
    },
    {
      "@type": "Question",
      "name": "How does BlasterX infect systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It exploits vulnerabilities in the Windows DCOM RPC service without requiring any user action."
      }
    },
    {
      "@type": "Question",
      "name": "What is the primary payload of BlasterX?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its payload typically involves enlisting the infected machine into a botnet to perform DDoS attacks."
      }
    },
    {
      "@type": "Question",
      "name": "What is a common symptom of a BlasterX infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A frequent symptom is the unexpected and repeated crashing and rebooting of the operating system."
      }
    },
    {
      "@type": "Question",
      "name": "How can BlasterX infections be prevented?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Prevention relies on timely installation of security patches and maintaining active firewall defenses."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1210",
    "T1498",
    "T1489",
    "T1190"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1210",
      "name": "Exploitation of Remote Services",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1489",
      "name": "Service Stop",
      "tactic": "Impact"
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Blasterx binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Blasterx installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "CISA Alert (TA03-223A) - W32/Blaster Worm Analysis",
      "url": "https://www.cisa.gov"
    },
    {
      "name": "NIST National Vulnerability Database - CVE-2003-0352 Details",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0352"
    },
    {
      "name": "Symantec Security Response - W32.Blaster.Worm Profile",
      "url": "https://support.broadcom.com"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "lateral_movement",
    "execution"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "medium",
  "first_seen": 2003,
  "motivation": "Disruption",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Government",
    "Telecommunications",
    "Global / Opportunistic"
  ],
  "lineage": {
    "derived_from": [
      "blaster_lovsan_worm"
    ],
    "variants": [
      "w32.blaster.b",
      "w32.blaster.c",
      "w32.blaster.f"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-NTA",
    "D3-FPA",
    "D3-EFA",
    "D3-SDA"
  ],
  "cve": [
    "CVE-2003-0352",
    "CVE-2003-0715"
  ],
  "iocs": {
    "file_hashes": [
      "e2b5d4c81a9f0e3b6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a",
      "f3c6e5d92b0a1f4c7b8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b"
    ],
    "delivery": [
      "Direct remote exploitation of TCP port 135 (DCOM RPC) across public and intranet IP subnets",
      "Automated port scanning targeting Microsoft Windows 2000 and Windows XP endpoints"
    ],
    "persistence": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\windows auto update = msblast.exe",
      "Remote execution via TFTP payload transfer following RPC exploit shellcode execution"
    ]
  },
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}