XWorm-RAT-V2[.]1-main[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
XWorm-RAT-V2.1-main.zip
Size 34.0MB
Sample240501-s7hl2ace85
SHA256 edbdc2e1bed353b533761a069b2d9a563683318fd1657ce09f9be2fa8ccd497a
MD5 88dfc456336a95ffeac16d9276083b7b
SHA1 8949c8c8778bd6412a456212d4ba2707f12e9d7a
SHA512 988ec72613d155bc362b1c0e0f1ee731f9653947328084e96eb436e7576b8e9c5114e59488216ea4f05d48126c5dbd7e983a02a412755b59b961f15c3ceea5f5
SSDEEP 786432:jiIKRjrYlNTspDclWQUF4DQXzTnHB35mjVjYX/BbmLqIZW:efApsGAX0Wh35mj+bY8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

agilenet

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
static1/unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DisableWD.dll	disable_win_def

Nirsoft 1 IoCs

resource	yara_rule
static1/unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/ProduKey.dll	Nirsoft

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
static1/unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Guna.UI2.dll	agile_net

Unsigned PE 61 IoCs

Checks for missing Authenticode signature.

resource
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Command Reciever.exe
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/FastColoredTextBox.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Guna.UI2.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/7zip.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/ACTWindows.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/AskUAC.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/BSOD.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/BlankScreen.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Bookmarks.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Bot.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Chat.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Chromium.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Clipboard.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Clipper.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Cmstp-Bypass.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Computerdefaults.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DeletePoints.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DeleteWD.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DicordTokens.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DisableWD.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Email.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Encoder.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/FileSeacher.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/FileZilla.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/HRDP.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/HVNC.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Info.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Install.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Keylogger.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/KillWindows.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Memory.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Microphone.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/NetInstall.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ngrok-Disk.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ngrok-Install.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Pastime.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/PreventSleep.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/ProduKey.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Programs.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ransomware.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/RunM.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/RunPE.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Script.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/TCPGET.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/UACBypass.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Update.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/VB.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/VNC.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WDExclusion.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WSound.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Wallpaper.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WebCam.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WifiKeys.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Worm.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/uninstall.dll
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Resource/data.dat
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/HVNC-Server.exe
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/ResHacker.exe
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/XHVNC.exe
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/XWorm RAT V2.1.exe
unpack001/XWorm-RAT-V2.1-main/XWorm RAT V2.1/dnlib.dll

File Explorer

XWorm-RAT-V2.1-main.zip

.zip 34.0MB
XWorm-RAT-V2.1-main/LICENSE

1KB
XWorm-RAT-V2.1-main/README.md

1KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Command Reciever.exe

.exe 6.5MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/FastColoredTextBox.dll

.dll 333KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Fixer.bat

122B
XWorm-RAT-V2.1-main/XWorm RAT V2.1/GeoIP.dat

1.0MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Guna.UI2.dll

.dll 2.1MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/NAudio.dll

.dll 502KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/7zip.dll

.dll 1.3MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/ACTWindows.dll

.dll 10KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/AskUAC.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/BSOD.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/BlankScreen.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Bookmarks.dll

.dll 28KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Bot.dll

.dll 10KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Chat.dll

.dll 18KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Chromium.dll

.dll 32KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Clipboard.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Clipper.dll

.dll 10KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Cmstp-Bypass.dll

.dll 11KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Computerdefaults.dll

.dll 10KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DeletePoints.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DeleteWD.dll

.dll 1.5MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DicordTokens.dll

.dll 6KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DisableWD.dll

.dll 13KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Email.dll

.dll 4.8MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Encoder.dll

.dll 11KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/FileSeacher.dll

.dll 474KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/FileZilla.dll

.dll 6KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/HRDP.dll

.dll 479KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/HVNC.dll

.dll 53KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Info.dll

.dll 17KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Install.dll

.dll 10KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Keylogger.dll

.dll 13KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/KillWindows.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Memory.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Microphone.dll

.dll 540KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/NetInstall.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ngrok-Disk.dll

.dll 12.3MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ngrok-Install.dll

.dll 384KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Pastime.dll

.dll 18KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/PreventSleep.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/ProduKey.dll

.dll 98KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Programs.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ransomware.dll

.dll 20KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/RunM.dll

.dll 10KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/RunPE.dll

.dll 11KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Script.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/TCPGET.dll

.dll 12KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/UACBypass.dll

.dll 16KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Update.dll

.dll 11KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/VB.dll

.dll 10KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/VNC.dll

.dll 657KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WDExclusion.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WSound.dll

.dll 540KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Wallpaper.dll

.dll 9KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WebCam.dll

.dll 209KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WifiKeys.dll

.dll 10KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Worm.dll

.dll 12KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/uninstall.dll

.dll 11KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Resource/data.dat

.exe 5.6MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/Background.png

.png 17KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/HVNC-Server.exe

.exe 112KB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/ResHacker.exe

.exe 1.0MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/vncviewer.exe

.exe 1.5MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/Uploader.php

747B
XWorm-RAT-V2.1-main/XWorm RAT V2.1/XHVNC.exe

.exe 1.9MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/XWorm RAT V2.1.exe

.exe 2.2MB
XWorm-RAT-V2.1-main/XWorm RAT V2.1/dnlib.dll

.dll 1.1MB

XWorm-RAT-V2.1-main.zip

SHA256 edbdc2e1bed353b533761a069b2d9a563683318fd1657ce09f9be2fa8ccd497a
MD5 88dfc456336a95ffeac16d9276083b7b
SHA1 8949c8c8778bd6412a456212d4ba2707f12e9d7a
SHA512 988ec72613d155bc362b1c0e0f1ee731f9653947328084e96eb436e7576b8e9c5114e59488216ea4f05d48126c5dbd7e983a02a412755b59b961f15c3ceea5f5
SSDEEP 786432:jiIKRjrYlNTspDclWQUF4DQXzTnHB35mjVjYX/BbmLqIZW:efApsGAX0Wh35mj+bY8
MD5 SHA1 SHA512 SSDEEP

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Command Reciever.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 67d9b4b35c02a19ab364ad19e1972645eb98e24dcd6f1715d2a26229deb2ccf5
MD5 a21db5b6e09c3ec82f048fd7f1c4bb3a
SHA1 e7ffb13176d60b79d0b3f60eaea641827f30df64
SHA512 7caab4f21c33ef90c1104aa7256504ee40ff0a36525b15eb3d48940862346ccf90a16eef87c06d79b0ffd920beb103ed380eae45df8c9286768890b15ed1067c
SSDEEP 98304:KAc94bqa9niwFYWLqDuTTTTTTdfPPpWLq+Guf2W2b6F72q0:KAcC9iwFYWuDCPPpWu+GduZ2L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6759710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

XWorm-RAT-V2.1-main/XWorm RAT V2.1/FastColoredTextBox.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
MD5 b746707265772b362c0ba18d8d630061
SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

346910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Projects_CSharp\FastColoredTextBox\FastColoredTextBox\obj\Debug\FastColoredTextBox.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Guna.UI2.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 84199a22c8669a39800272c3da0d969ec4e8d77d67b9d324ca049953a5042c71
MD5 d65fd6dbbd3c9ac74139aeaedc4a5816
SHA1 407ae10ccc8e19798bf75cb90b2150cb63a9db66
SHA512 b8a99e88d49a6f9ff89339fa5acc9df8b59665d2ec22ccb4741e501bba6b280b00336906a637d8f071f86a4dcd68ca4ac86683e651466f084cb96d0e3152eddf
SSDEEP 49152:ClU6fD73waJnBA5lV8jldVmIgA5iKOvhn:ClU6vznglEldVmIJi/vt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2220854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Ilham\source\repos\Guna.UI2\Guna.UI2\bin\Release\Secured\Guna.UI2.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/NAudio.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
MD5 3b87d1363a45ce9368e9baec32c69466
SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

d0:94:af:d7:9f:51:16:9c:c5:1a:e7:ea:23:e5:08:16:11:ae:03:76:1d:25:05:ee:5f:c2:9d:59:4a:68:c8:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

Chains

Jun 3, 2020

CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Minor OS version

Major OS version

Entry point

510758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\code\GitHub\NAudio\NAudio\obj\Release\NAudio.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/7zip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 201b8405af13e843b30f4cb96961286b11114729a75e9388e2bd717785f95261
MD5 de03ce2ff4d7f7625352a8c4b44f3196
SHA1 357d3d42fccea225277810d28a43c17ab5dbf3a5
SHA512 675d230cd3c28d1b66aa24dc5966cebee426dd85d75775c29e4e61373019456f3d66dab6a2706132d32cd37aed366f00ebe9ce6ae80f31963e02bbf67e0a530e
SSDEEP 24576:u0/LsiV9P+XbiDmHzsvTK6BN2TBQLge+ErnuIAr24sNhHXZ:ucLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1338294

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\7zip\7zip\obj\Debug\7zip.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/ACTWindows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1c921e95d1f35e9aeba1d544362268bd1ac77a1006c215abeb6da9e041b3dee4
MD5 b421c1a1915efd31250603caf98a6efa
SHA1 9c54fffa90dc39ed9a63dd405644ca3679c543e8
SHA512 c6c99379e87fa4108307ce61eaaf1143d4d04c09ca3e8e13cd89b3e3ae3c01e3e641cdf6f9f414001705acb54b3a4bd615bf313764b62fe0f60286b6f8ab27e0
SSDEEP 192:xEioKRFQer7v67Y85ZIwI71tHThIW1PnyWVSBQMLuTF:+ibRFv8DIbtHTrnyWVSQTF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15946

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\ACTWindows\ACTWindows\obj\Debug\ACTWindows.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/AskUAC.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 742625b8c8e1ad522dde95931102926aa7f806657879705b4fccaf36614d8d77
MD5 4a76da7ba432413e023cc2daef5f73b4
SHA1 c4261cde5160753afba76604e6b71cfc1d95b58d
SHA512 b43d50ee1385ba9b0e3d712f8e64b7ba4d634fdd9e8927cc330c71d34aae97f66291172cc713176206e0b2bbfeadff34ca5aa0605aa71a00db3434ebaa555bf3
SSDEEP 192:mH563sg1GON8bIsgyBTkIW1Pn/KiVawMLOQ:mpFQ8bWyBTun/KwaAQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\AskUAC\AskUAC\obj\Debug\AskUAC.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/BSOD.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3980b827732c01092e7b11b8c1dfecbed4bff66a5e977bcb1c8d9ab14b4ef5b7
MD5 e82a0b53c1a19276e006db45bea7de6a
SHA1 3e5ff9be31351de44b4fc633e3d9d19aaecee967
SHA512 434c4d81726f4dc1492168bfe3e5761838b2ba457ba4f4e7fe4bd9e9c42287842860688864e1f07a5188fc1fa671d5f76bf851d31072844f6e3342f3a64bc798
SSDEEP 192:kJeGXJtrAeCwGv1GOq11ZTXIW1vnbcgpyAFTLOe:k5ZtrA3C9ZTlnb7pyAUe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\BSOD\BSOD\obj\Debug\BSOD.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/BlankScreen.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 033e790e1cb99781d3d9710553e74de6a3c5e9765eca6c717b23c515708e86a7
MD5 b9d4b5254e5647fdf8236e890d29810a
SHA1 93220a47529f7b0a9181c72481f81f366c211ac7
SHA512 33be9e0e4bfa8851b1fa389da59b2ed75d8852e8a6cf2b7a410d910578167ce50c917bab2ac264daafa65b0d1f3727a358bea1a01faa71790fab037131c55548
SSDEEP 192:ezfcER2CRuTzi9fTGOlF1LATWEIW1PnaiwpM4QLOBk:ocG2cS+UTWOnaiwpMCG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\BlankScreen\BlankScreen\obj\Debug\BlankScreen.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Bookmarks.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 83e61cafed75d7d799f4cc7b1e91c3b0c8785ce97a9dd8528a34ef2f8003ec9a
MD5 37de3820cfee60eeacbc1700fcc966fb
SHA1 5d85967609218b3df136aac0096383075cd5bddf
SHA512 ac4a0b26a7c9d939eae399fb1a0ed575d64ef769f0cd6026e6f12f4ec9d472cb105765320e8e3a5bb06c142ce2143be697cda4234e74cc5127cafe73755cc70f
SSDEEP 768:S6s1GRoX8l3E0edaVGMKFK2D3Vbuw1z9ruOc2GkYCrB9gB:U8kMR2D3Vb9ruOc2GktB9gB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Bookmarks\Bookmarks\obj\Debug\Bookmarks.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Bot.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ce5bce27f2a2b1d1e2fd52dbcf94b4d1f3ed133f491fabf8b80f1f6978c5552e
MD5 2cf7d3e1ec1b9f2d906b191df52802a1
SHA1 74168f86a77444e394fba5b5605153e099917cd3
SHA512 327bcce5b2e921615abde17cdfe4572e54f3e4c79f0f08bc314c8e891460a90c4d407db3c1c6b27d02555c0a81e02afa39c98d071121ab71449507b1b87113d6
SSDEEP 192:psFxWDh8iTEeo1EIpHRfoH1GO+0A5WgycT/IW1U9y/L2fqvVWMLW+:CqhDEdThUwn5hycTi9y/L2fqvVG+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Bot\Bot\obj\Debug\Bot.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Chat.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 29bf5ad7420bf165b555970a15b94b93f9dd288df87a66327022ff9602bccd8e
MD5 181599ac647dcaac9bee9be73e40501d
SHA1 fced4627ecc0f8172af1a34e54d226311b54634b
SHA512 1c835a6749caa39ad9188cda2c6629f2b78adb8388b4010e09e9ad5b326c137c237448006339b6c8ba9d6310bcde06bfb0a3e1ae72f14acca485f9a5bf363e40
SSDEEP 384:qL6SP+OzVEbK6LcuTKQt0InoIInfUUWRfE:M6SP+OBOKmcmqIInfUXm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Chat\Chat\obj\Debug\Chat.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Chromium.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ec15606129c31d519b6752d3567b1b2603efe877938443707080c05abaa161e5
MD5 34f049112ea43d6cee9ea124282854f5
SHA1 f0ff219107853d5d82f74603f1077d4f4c1c8317
SHA512 7b2947529d1f558ba4c54414b58b5f81cfb6fea8181879ec8cdcc2df9c3bff9d1f96a5d79a4191e02dcfb2be132fff39c6dd62283aabe72c3f7254e550e1175a
SSDEEP 768:xGW9spcK+tRAj0xtaqPXvYXP0vzAqaVh6wB3Zs/Yx/3:xGW9jZ2j0xtaqPvYXP4AqQh6Y1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\Chromium\Chromium\obj\Debug\Chromium.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Clipboard.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 75b37e44ec0d76cc4862de45f69f362499e7707b3fc0ed03c4b68b04a505ed43
MD5 9681d56abcdd302dc435e865d4375df2
SHA1 77fa370dbebdd13b18dc6f41f86d2dd64379ee75
SHA512 1e19afed9b96ae122faa34fdd04a79c9e65270f944992b33aa8a2f894847f01c7fe533c338574367ca8ea5ac0f57c291839e17fa97ecd8d972800b637c5efb54
SSDEEP 192:zPNE2c1og86hRlfOHdv1TLxIW1Pn/+97RML22nU:zFEl1og86RktTLbn/+9NeU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15590

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Clipboard\Clipboard\obj\Debug\Clipboard.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Clipper.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3087f4c71222172069ffc441a2aca41785562a92260e6fca813a576a8e104fdc
MD5 a91c4c459bfc493552b37cd6ad79eb4e
SHA1 0147792b9c5c21b9a1e68f098803ad7d6876c6fa
SHA512 6932b326312501c82f0be5ed8fc22d659fbb008ba66087186e814a23b8d31b21f058a4d3226cc6569b713e9e4dc3e8cb535ec1edb395cb5c4548e573252a588e
SSDEEP 192:nfxgo6FiR3r9UdNltsOIO/dQ1GiMIW1Pbe/nPA8/YjNMLOi:nCFar+dN/IEuGiWi/nPA8/8Hi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Clipper\Clipper\obj\Debug\Clipper.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Cmstp-Bypass.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 995e755827bf8c1908e64d40a7851e05706b89e41dee63037e5c4be0b61f113e
MD5 b6168619969011ef036cced5e6d2bb88
SHA1 a69ffe4f8f41040ca839772e334d11147965e00e
SHA512 d43890212684841982cb180b246c776b4499f5c3b3d285f87b572a369553023899642cb70faeea2dc1d9f2eec99773d395b6573397d20aae18b685d24cffc7f6
SSDEEP 192:fZCBkF2mSmZbBYBIpN4YeTysxIGOyv4Bb9akegyaTRIW1vr/uTDFs5GATLec7hH0:fYM2mNOBI/UysxZ/QBbUkZyaTjr/6YGY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17130

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\Cmstp-Bypass\Cmstp-Bypass\obj\Debug\Cmstp-Bypass.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Computerdefaults.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6ca31d50033eb1829f126353a849177f74501a4a489148b5beaaee0e564bfe91
MD5 20d572d7bb194b9b7401aafba0b81f19
SHA1 adab6e88fd320519ca843630020ea3f4c79071cc
SHA512 3b1ed2f277e61484fc1592c62d2059c221d43652b9b5171a6037c85dee11105865832e3532f69fb7ad0f58c5460ede6f2746e62b03013793c00a3a0036a6422a
SSDEEP 192:/y3XzuK0MGO68mgyITjIW1PD/lf5lrljlQ0lIdlUwSxExocTLWlb:/ynzuKcLWyITND/lfeiMo11
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\Computerdefaults\Computerdefaults\obj\Debug\Computerdefaults.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DeletePoints.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8ea85db9c8e12d3a0240a02d6f0cd9b8b115a0fcb1b24b70d03278c828c31879
MD5 bcca9532b7ba99863f929f10087a6d43
SHA1 04a8c8374adb5ef9b316bdf92eba8deaf5e7f947
SHA512 d59453d83f9c9283c10ecaeadb2e376e86b4ae05f64a91f82b5b4653262db1bb0812ec4a4e1a30c68c8bb6f5ee1a784552936649af0e05cfeab203abd6082f69
SSDEEP 192:nPyV1Piyl52HzGO8X140TwIW12nH8i7eVMLW7:nPyfvWydXTZnHZ7et7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\DeletePoints\DeletePoints\obj\Debug\DeletePoints.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DeleteWD.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 887873a59e10d8000085ad987c802e9fa2d231f31eb2523f4b823f8083f462e0
MD5 d5051b56f7371238d8e7a5361951a6aa
SHA1 a0e45ec01df6bc37c26ffd45562009878de948c3
SHA512 f5879402cf0999cd3e4f9cf156c26cad7d7e73b7be84d311ffb0abaa065cf822e19c2f3c4a89a24588bd96c59e625201ac19f7d3702cd76089e87a27a7a4a6f6
SSDEEP 24576:8BW+1C0G0faR5wNRXLbLKavHBNmWC7vOIMmxXTffuu3TG+R+aNAdpCmlY/64IxLJ:8Bx1HQ0VXLpNyzM+XD2uDz+amLC0jHxL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1552342

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\DeleteWD\DeleteWD\bin\Debug\DeleteWD2.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DicordTokens.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 493ce4fdfceacc0ffdae460dafcc352a3792de437b6a7587c7731a5c900409b8
MD5 7ad4756cde3dd26bdbe03cc583527a06
SHA1 557e9a05dd00764c13c1c2ab93d3520f86a93dd1
SHA512 80d934b4befc75dffd1abe27945152cffd8a7f9be035ef5d534b2d5bee2f630a436a7841fd1c5ecc02876242d520cac5825c9016e6bcb7e12613baa29db1ad1f
SSDEEP 48:6OIT/BvVV5VydE/tjIaVvNXOu5RKgS8PCtcUl8nNMAcx3numn2sex05x0oT+Hml3:OBpVydE/9Fiwvx6tcUlrA0v0s+mltIJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12330

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\DicordTokens\DicordTokens\obj\Debug\DicordTokens.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DisableWD.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d384ec908583b271588a27748850e4cadf9d8b55a4afdfa54170738da54fc4ef
MD5 7af0f08b780ae3a26118f167a2c2f8b0
SHA1 c473cf621bac31c1af4e59903012fb027dc75105
SHA512 231c59aed5967fb42685b1cd867ade5cf6944c145de290eefc969d57f574cccae09451af3e42416b0c9126bac7e07bb57cbab74be269a9e99619411f79704bb3
SSDEEP 192:iQLEv8T4LLpNkQvmDbeNEDTRQmCkUE2WKU1GO0zb7lgJ1T9IW1Un/3eKtfLie9y1:iojqEdJUEDtw9zbyJ1TMn/3euG4XFU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\DisableWD\DisableWD\obj\Debug\DisableWD.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Email.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 08c0561606c50327e52d20d67e447431beffff4357c011d5df58c7923cea82c0
MD5 cbc0e4c9693b2769634ba4400249a4b3
SHA1 a889e9a53ab94ec507ff1a2a7e6fc3258647f82b
SHA512 9f0d39423c3b5076fdfd39f52282d6fb1cb044984a8de936108d114e139a657718209a878ba95d52f021c6bd554cd71a17f408c9c02de70dfa6f07d06ea78a8c
SSDEEP 98304:K1RA+vAQO328PXuSYibjYKcQo4wTej9r++rf2nydtrQ:kRA+C32/anYj2nOSm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5028830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Encoder.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 dc51fb8a0140ba8cfcb19dab7f29cfbcd0579a08c3c1d68b915d2b59a8a93a71
MD5 273d8c94b9b7cd9526d44289115e72c3
SHA1 b8e1911a0ca4f1439838f89e136e27dafe41c97e
SHA512 d3f3bd8e46baa152bdfdb5633136134d94920616fb00463a2437e162a50e7ea9d3f9f1c3e15fa1c814d10ae2d71275d8615ae1b4d268e15f7ecd4e89a3fe507a
SSDEEP 192:Jj9Y4KofL4k6PplZEdld5efBGOzutx1b+T+IW1PnQ7SiSpjzH/L2wRc0:Jj9woj4RUrPefMCuVqTAnQSpjz6wv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\Encoder\Encoder\obj\Debug\Encoder.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/FileSeacher.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 86bf7cfe573f4c36645cc30bcbc5a9aab7b9925f3a1f2cdcfb4b86829b09637a
MD5 5e500219492ffe9927eb36600e58fc10
SHA1 75d54f8e39c5c12fdfed92d9872283929a603368
SHA512 b593a6ba337f0d21cd8caf7d15fa14731a7dd2108560a2cdc700e2c2c8435d46781c7adf7d27da827d1bd5a0bb584a724d937d0e456dbe420d959cb783631c05
SSDEEP 6144:8+Zza7lMB+meGtSV41QJDsTDDh0Yhe6dwxLV/tuhg3MwBIl0T:8+Zza7lMB+mlS4Ys50ie6Cf4g3Zw0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

491414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\FileSeacher\FileSeacher\bin\Debug\Final.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/FileZilla.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 da994e868ad929e7d90b413737789aedac7b5345ecede1c79be54715cd0c1ce5
MD5 926db64536c6996e5c377d89caacdde8
SHA1 f3233095e3a7dfe1ae7cf59a1bb10b3606ded6fb
SHA512 424b485add47844fa5fe6afc8cb9aae6f4038e374b1b334fb71fc5df4f47f363896ef88487a3405870e8f8e858651ce004368e867a41e2ffc1c282acfe928e3d
SSDEEP 96:MUW9xv14nJtKZhYSvvwZDo4i0udeW3AXTA:A9Z1+vKZhzvv0Do46T3AXU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\FileZilla\FileZilla\obj\Debug\FileZilla.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/HRDP.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 6549c2a9be50aed342cd29b4a48d2fd9c15bffd16eec7fb94a49e10472bf03a3
MD5 e3ce88d6f031a66fa267f53ce60d14fb
SHA1 52b937fcb2b78e677252b146c7c50e4230fa9153
SHA512 f20b978ca244d91d818b11e934334183b77eaf46ba6ce48fe3fd3a4e6ba189f466fc125c41bad556ac2c0d8e647f406cb403577198e8556d874164b15c352631
SSDEEP 12288:3KBbEVy2humYgLmm3HiYRbli1FaWFXlzeAWx:aB2yqjmm3Hi8c7aI0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

496954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\HRDP\HRDP\obj\Debug\HRDP.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/HVNC.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 23ed5325043d0b9e7a9115792b12817cec836ba09e5af2aab3408606da729681
MD5 88fbfa8f8c8defacf551be380d4dc432
SHA1 93056bf5046a009441e5d9bffeb902a7b81808f0
SHA512 a78434203e76147364d4c8868992ef48e28d3cb43b9df2da813c9b426798cf7d6defcbf3e2be1535d0953bac7e9033e58ae53bef98638a2e9c88529f8e7089c9
SSDEEP 1536:tZ5OcCnWMYDUTFm8Lq8rYYtGvAcRsAWYu:35Oc0FDu80YQv3Kbj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\HVNC\HVNC\obj\Debug\HVNC.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Info.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d31f883428d57974873a5adcf166e320037a13021bc5eae31cf3e727431dec65
MD5 d8c7f6dd28ddaa759bbabf4236117aba
SHA1 891845f7c701bff4b09f3af03713e5d37a1dfcfe
SHA512 cac59d8a5d84bd9ee6df7cc5af955b6e5cbe4bf3f596fa7881084d1eee3e2e6fad36f1cf75a0d3a5e733326dcada835ae7286b936763ee8471f3a1869560627f
SSDEEP 384:+coL2FWM9BbzdtlFcl/R4INNWQO4D/ibor:+co87zLlQNN1/icr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24010

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\Info\Info\obj\Debug\Info.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Install.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e50ec87823b23c2721a0f3a04b64454a58aea714d756e8a148766ba3502e6491
MD5 3f6d26632ad91a267f2439dd8fb947c1
SHA1 0979dd660be359006c1dd2989d356a6e3332f082
SHA512 fd337e33a8b2e807c29333f9a95dffae7c6b662727ab629b7713f0777ffda1abda9310ea714d53dc05139aeb4ba9eff1251a31f6592c4ba8e88172bb1d412d75
SSDEEP 192:cm05RWWAldVV+GOabZv1hbBIW1UM/usfLaxDTLuDw:cmuRW5lTV77bPhbYM/JaxCDw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16194

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\Install\Install\obj\Debug\Install.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Keylogger.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 815dfb13e0c4d5040ffb1dde7350cc77f227b2945b01c61bf54f85eefdd182cf
MD5 cfcbdfbaf8c6d4ab1c48440dbc1bc827
SHA1 18beafd6cc3515004cc7ab9fb9f7f25442cb7040
SHA512 701cdf04aa9d6bfe26ecaa2b45cfe05e7760da8e75a615782111e6b116f887b2112e23936cf4b6ca194a99dbbdac16e4a0ce9f0563c62e63e2ae3c276baa1fb7
SSDEEP 192:KAP2P9zc6dDt/Qv0LOTXIzuVuuGOX2+u1XeToIW1dD6rhuCVPRUmjQnxMLu40:KAP0Nt4v0q8tHOT8OrhhRUmjyT40
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\Keylogger\Keylogger\obj\Debug\Keylogger.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/KillWindows.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3b55e859b981ab37efb1c016407190922d836161bc1318b6e25656c3d300c86a
MD5 bc162213bc135674d1265bc52c4bf22d
SHA1 f9dd26a2d29d6525394426e2be64002d24d50626
SHA512 74aa5bbfd300f0377d4989d33f6645087b1d3e273413f11a2d46646ba84098a1c6e059b84e0e4f7372c111dac997275698aa4e4a8d8d7ce56ce842d99e587294
SSDEEP 192:Vj7isBYkmlO2GOvg1vTkIW1Pn/BMUpFc+IMLOw:VjDzPvTun/KUpFc3w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\KillWindows\KillWindows\obj\Debug\KillWindows.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Memory.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 23e5a0d72e31184d8a8769a2c02d7c94c6b75846436f76c511464c2c20ce8387
MD5 b8345a39a0f6e6a65f05bb1370b66d1e
SHA1 e416cfae4f709bfcf4b5f8e2b79775d462a161ef
SHA512 c6b33fc1841586e0371f46c72354de0aea64f8110a29a5c30836417e47c93bcc5d97ce3cc6faf0eecc44d4b9b2415e62e2a44fc52a69c045ced95e8bbb2cb275
SSDEEP 192:iep14DC2HwQG8A1OQGOz714uOIW1fn/eK+QMLuJNyL2:iepuC2Hwv444uen/eK+QJNyL2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14954

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Memory\Memory\obj\Debug\Memory.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Microphone.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f1106739567a2184b5dc8aabed3603c51c65fdccdf6875d9077bad6dfb422da0
MD5 8fe668835a897d92bdba015fc1cc8af5
SHA1 25c6d6eeccf6d945176dc6f2ad051961b93a68cb
SHA512 a3e75daeeb0b7a8524d214ff2c79dbdbf11c81f19f5d474243ea3b6b54ef238ad0be47d9d707e6f3f0986447a7291e17a41ee6ebad078807fedb6b996886e127
SSDEEP 6144:OO1+opclCf2v6exF0SyqeDI28DjyUbfb78+smmnJsCEmBy2pYARdd3NbFXElNZQ:O6zpFuvrFKDIT7bgFueXh/FXElNYu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

558906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\MIC\MIC\bin\Debug\Microphone.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/NetInstall.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 afefaf064810b08003b93aa1bd702d4b0fb15de29194bb2479a35443537ed348
MD5 9d8b706fa483d4974cdfc9e806b2863e
SHA1 700e319afc9f1ac197d8a2077b12fa44b6b34d60
SHA512 fe8e26b07ffb366eb59dd169da76bb881e16512cdc5e8f225043c1b487d9a08b2a256d3b5de52f3217a6348d57d48d554b3bced6aa6da85bc32f7b398b643b5f
SSDEEP 192:6ZTrGU8N06k8TQOPPz+0EX6QGOou3gysxeIW1PnQ97KpfATL2spY:6ZPGxjk8d+0EX4physxAnQ97KpfBspY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Documents\Visual Studio 2015\Projects\NetInstall\NetInstall\obj\Debug\NetInstall.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ngrok-Disk.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3b2735a924841ac27fdb239d637dc730ada783d3a673a97df2682869faf3087e
MD5 ccfb289bf29889c43369bd2166c17412
SHA1 525fe101583f9d9fa14d35c27c3e9b0b61940760
SHA512 5f7df0d4fc02b24ac0777e4ea4d35794865dbea93a65d3b44fd828fa5253ab27f4d9413260f5235751c5fb551998e7c8da07b78abe27ec2ea287bf86af9442ec
SSDEEP 196608:TKWRNtaaymwIm9CSiRmW2XDLj2k7AW2bx8rkjq/vEO6w/3EyVzgzqjD0w4JnZqq:TR3wazwc0W2X/9f8zjqHd33HD0w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12924498

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Documents\Visual Studio 2015\Projects\Ngrok-Disk\Ngrok-Disk\bin\Debug\Ngrok-Install.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ngrok-Install.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4cfcb5c0664fe82bcbe8c6502745d8d813222d05047537a2f6071709a2acd51d
MD5 c0f9f255b8cd7a6155925877d0ba9f71
SHA1 8187eb04ace363a20ccfba3afaeeeb96ac267276
SHA512 a4d7956f9de69537742c76d6e84c7a4c98ffcbb144515a334302653626af0722f511f12f82c488addb9688f6a6a110c2c4f703409196f002e157c09e120d6216
SSDEEP 6144:nqqDLJmokuhmMe7+1VIc2G5Gh7LgWTiMhxUkUVW1xFmgI0yV:qqnwok8mMe7+1n2G5A7LbbhxcUDI0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

399806

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Pastime.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 765c7a88112ee3ad03bc92cc3da37840082d62746bd5b02bcb8a57d5145345ae
MD5 f8556ea3b1f1a3a7e9a640a1092a556b
SHA1 1862722d6f56bd4e4ba82c35e51173c2cb839f19
SHA512 9dfde73863bf062e76be09a1e6aa104f8ded04f67654ec0e2af3dad705e7d0f912dd77d9eeb25ed9a4817856ee6082d6c21846a3496265b1fb24c1b02cab2ade
SSDEEP 384:y/vgBKHr2RVeapLyY9KeTj1kn26vOia/mT+//BeVUJsA8/VHMQ:4vgBKHr2Kap+Y9KmG1Fy/BPeA8/VHF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Pastime\Pastime\obj\Debug\Pastime.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/PreventSleep.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c568ab1ced62dda4047b101d321136a49356f082f3cf4afc2d5d1adf45c3adb3
MD5 e6c51c9850b9e65368b94b4c6ee64c2e
SHA1 45203f003cd009f369f0fc0cd1756ae66f49bde5
SHA512 909caee45d8f770b14f411cbd6e50cf17152258b5eacf27d8686b09cbf4ade0a452d996b8ff0e8a8a4f470ffff89709ab190f5d116c236c1dabcdac550d04df8
SSDEEP 192:hbA4MnX0GOwav19TvIW1Pn/+8p4jTH/Luj:hFyX1ot9TJn/np4jej
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Documents\Visual Studio 2015\Projects\PreventSleep\PreventSleep\obj\Debug\PreventSleep.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/ProduKey.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1edff19661db8d711a79adfb9c7d701aaf885d25d12d55bc804f0b6a5d49910c
MD5 e6f0cb7913c9c3f064f52f7407b5cc3b
SHA1 87943989d2eb6cae45a06dc526f267c7b76f57b6
SHA512 4634584da3f8534e3b1b0941e1827ca926b74d68fb2cfa165ce4b19b2c5200bf99fbc8f724fff99c8de5ffa123927e44f633dd693e2d15c45f5a3ce1d915fcf3
SSDEEP 1536:0mbucSAwsbzcvesvH29p9coCgSeX06hfKRXso2G9eUJxDbi0:Nb3SQ3cmsCXcovdX1TG9eU7/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Nirsoft
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106402

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\ProduKey\ProduKey\obj\Debug\ProduKey.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Programs.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ed86bac895c455ccd61180f0664be0b0d99f011e90e319f97afeabc286f7838f
MD5 4ab2e715a2549c938247d459dfcb33f5
SHA1 ce0073699cc018e274e6d93a6a3c36bd0488576b
SHA512 e68b10549fe86503c0b654b1477c22e69395f20b7c9ec208180c08cd5899964dc7f1e31c9c46cc4f63c1bd3a862ab74bce42cce9fa7443630269409fb1df4119
SSDEEP 192:BJS7Khum18KHFGOvJ1WTkIW1Pn/d+wqyzMLOVb:BJSmuYm8WTun/d+wqyNVb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15578

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Documents\Visual Studio 2015\Projects\Programs\Programs\obj\Debug\Programs.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Ransomware.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 2bd33a784af634af7590ad9dc43d574005dd95b2b2e20640b97cff0474af91c6
MD5 b5a034e9d15cb09b1460dd18f1257d83
SHA1 956156a47e690c8be8964dc3fb905e075a45e947
SHA512 026c51e39bb1647f05bd3d5b89357937d848ef5c374240fe8f41bf34eeb70429860d762032a0a954e98a49015d67272be436b14b51fd57e9956cc33aaa07030e
SSDEEP 384:HDKe2SiTtr8SCMNyKU9kbbsXfB+ZMmoI+sHT4k7MWYeLZtHyh:HDehCSCMNzIk3sXP87PYw4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Ransomware\Ransomware\obj\Debug\Ransomware.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/RunM.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ab0fde86be8a9edcad9cf9f91643edcf922e2236abb3176ac581183989fcf99c
MD5 752019b614caf2b24d6d20e12b790ab2
SHA1 6c927f44876b77ffbb5af5ec34fbfdc5e94e6b78
SHA512 172901e589cab6f6e0ddd845d9b4ce87d66e4133fe6e52a6827cb92e00c90405c0804c75cefd9acd4b17d70ba1359d80a621425253ccbdb9a4b9112e826b2efc
SSDEEP 192:kb1Q9BJL3C2tCcOEVyOS41NTNIW1Pnb/TPvlzZKA7CgWl:61Q7JCyDIeNTnnb/T3llP7CLl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\RunM\RunM\obj\Debug\RunM.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/RunPE.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c01ccb79af29e2053e5ab5486d2d0a07c2e4cb15a4df04e25d5f366cf2c94bcd
MD5 5e013ea771fc89907601dfc2af7a6fa2
SHA1 26a340eae644c066805e551a130bf822eef5563a
SHA512 17c37cb6976efadf7b3a92c0d75b34d86461cd2feb3a4d659379e6d8a7c095eb30753b3a31d129ba4bc43be49c31296e56843b54bbedc3dcc4f91b0c5e13785d
SSDEEP 192:glFfqh94qT5rmUrm1eNGOJeq1JQSnIW1fUst+fpo7MLus:glFChWqT5rm57kJQGUst4pods
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\PE SRC\RunPE\obj\Debug\RunPE.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Script.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 c6a37876cde8772f189f348f1469ad4527c5b9e387c29d653a3cc5283e3b639d
MD5 ed33c58ca58f149078212607da7e6d5c
SHA1 82fae75c33144beddb3f587fdf8632cd8fe4c7c7
SHA512 52abe4c280126996589eb732a09ba75f4b4f1b8288f46e918e7c2ff8919a33bf9816b4613a453b2bd66cfb4c4dd2adb987ebe8dea2eb6a2d18e9654936a552d0
SSDEEP 192:09a5mkxbPGOWki1iTcIW1Pk/2ZpFRML2G:0qmkxbOIoiTGk/YpFZG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Script\Script\obj\Debug\Script.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/TCPGET.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 8fbd4594f38a12a726d0618e20894e6615985ee96e787edcf2fa90f2f84dd150
MD5 8ff53cf98035b5f4cc4fbd149a89e886
SHA1 26dbdae3f67c4d08e5d2ae849e822988c8c9117e
SHA512 9d8937a329bf9de09cfb82330aae2dd5ac23392de960d27abac8700696f18169a62ab3307efd53046355ea936808529d548f4e2c185accc8fc78b1663a151ef0
SSDEEP 192:+8nfWHaosO7Pi7tkOfwZO1Z1011HoLIW12z/LDFJIgNQL2w:+ftPi7tpKAKHoUz/fFJIgFw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18046

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\TCPGET\TCPGET\obj\Debug\TCPGET.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/UACBypass.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ea912ca7c74d76924cdf1e634164d723a6d7a48212ab03c0f343a0132754a41b
MD5 83da32d85a967a145211834033855497
SHA1 39d75d57df6d102c73d0d4e771a0798c3f153d8c
SHA512 833a9853255218e1068eb6de8fcec2c985488475771c8209e8c5f8e43fd3ff3fde036b28233fd55f35f4eda2d698f4fe67b6f8410294c1728a9c0350c81f3fd7
SSDEEP 384:N0KGTIkYy8EjM/fVdpaAgiii5TvcayW0:N7yw/9dpaTi5T0aI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\UACBypass\UACBypass\obj\Debug\UACBypass.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Update.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 88160d78fc6c9f366475039635713a27b5604c9df54ae05ccb5e6db1801c9138
MD5 dd9fcdc7bc3e42d5099a25b6a448761f
SHA1 aa166f56013baf0dcee7ab0d836be44e8c37b706
SHA512 8e1072769a8d7a1eaa0f730c0ad0d931c285ba22c855090e997ce5d018c6d30beafae38d38928eaa0a48b06888246bfc3443810a5eab9a3ee81eb6d234a410a3
SSDEEP 192:HNswkD3S282f6vHR4QJwGOHbHKPBMbOIW1Um0zuWuyV9ip2f/LuT:HNswkDV3f654QDUbsMb/mwuWx9ip2yT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\Update\Update\obj\Debug\Update.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/VB.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9de6c632bf5bea4ba7937648351b592b002bf6ec25154d3f0a4732b5e9350973
MD5 6eedf6419333c35d3cfc2b9541860edd
SHA1 0babbf73776d7c90cd26ecd482104fd0e518d889
SHA512 e6b379a339cc56e155cbf19667d79fbc235e2f57eabd2b83515d8df3c5bb9e8581bb423d904d2a1b7e565d58d928f6712cc4ddda3279b058a2949e81b3c1e18f
SSDEEP 192:GszeShQd5ihhdBFzXzwyGOFGD01F4SPlF6IW1PnxlVQGjMLO0/:Gsz7y0PDzw/yjF4Bnxl+G90/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16366

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\VB\VB\obj\Debug\VB.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/VNC.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 87788f54632ee7f4cd9d485e44a08558e9acbc6e2c3819c0b6cd8ec1c613674c
MD5 fefafedef31e16b7e8c1ede371e6c02c
SHA1 216688ca704ab4aa0a8033709f05868639401603
SHA512 e2b0b2f31a47e446b94dde58028d5338e4065d7b12e3c63e9e9b136d4e5b000861d4b9ad4bb457816baf985f0370988a614bd14205751f2d564cf2dd22aa4b2b
SSDEEP 12288:PLttATbOJ0daaSiP5P4MCtm1OBD/t/1T0LcsiSfOTgSAiBGIXFpBmoS:TttAHg0AU5P4Z7/t9oLziSfSgSPoIF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

678910

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\VNC\VNC\obj\Debug\VNC.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WDExclusion.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 4085a76771f41a0883851a11eee48705e955b2a3209fd0147c13910326398332
MD5 6dc438673ea924bf31d595fd8bd228e8
SHA1 db24d51d61383f457da92464d07b6e2fbc933dd2
SHA512 03eb1e0db218a8cc592db99217926d20b0053b5536912da84ba87b3e8321557d4fa62bd74656f8deaa371676d80ed9c8111c2a5d60fe7ac6bdaa1aea519ac7e8
SSDEEP 192:8XPGbkNgv8pohG5cWa21t9ZhIW1Un/bVf2TLOJZ:EeYSv8bqWjt9Z4n/bVfR7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\XWorm V2.0 License Updated 12-7-2021\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\WDExclusion\WDExclusion\obj\Debug\WDExclusion.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WSound.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5c850743604d25754fc87b8c662707a01155ee540a40c8f55a0b0ad4acf376e4
MD5 02557db3964eb1226a7b172d0eeaaf77
SHA1 d91404cd4002ca3a0cdd5870ea05f53bba5310dd
SHA512 8b0a8d137f948cb9e4858ff25bd894feae75280c1045499ba896701d04218c4ab57c65ee8ade84e4e7632f6e8f443c8d75bc4f42fb402b56c947a00f42921ae4
SSDEEP 12288:o0fU7nZVe+WREYwEexJ6LRVYYbgOvd/3rGd9Bsu5:LCZIREYwMV3bgOF/3yd9Bsu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

558442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Documents\Visual Studio 2015\Projects\Sound\Sound\bin\Debug\WSound.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Wallpaper.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 21963c59c789ca47624a5ffe1ebd47c5f23fd6c0426e590f61aa11a27dc816c4
MD5 f0f5c337c0523296cdaedc985248dee6
SHA1 ae086d9b264ba40047e3ab618c0e4748aa12716a
SHA512 67a0f8785e0cae77fa12962ceb82c302071884daf340e1fe4cb515c6d3fc9553f09060919954b8d8d2a361b1c6a16236b1ca238bcba20e3c1774b9895cf66fea
SSDEEP 192:520xpA2/cbmyGOWQ1ST8IW1Pd//zRAp63N/L2DQU:52cpA2/cbm/ySTmd//zRAp63AkU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\Wallpaper\Wallpaper\obj\Debug\Wallpaper.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WebCam.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 1b7a87ecc2814bfe887cdc5fa8a4b8f0bfc4692d4d0a87ee8dbe0fcdcd2fb23f
MD5 f10c859011f17c97017a919ed8e48be1
SHA1 b117025ad2da5ca26f1adc4a3d0507526faf33e8
SHA512 235c12971a1e936e43df5fa9a45b55fbd758e5148b8a7c33e6178ea668fb785a8a109e6ae4a8f4c93d9e8a804a7615f3ea4316911b8452444ea7b6e2543bdd8f
SSDEEP 3072:FTlWR/jKGR5BfF/g50PBgakLA3LC2FY+EdzYZHAx+dqRN51hdJFxtZV9l5hhJxZY:FR+22fFcgBgakL320zYZHpMXM/sW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

220006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Documents\Visual Studio 2015\Projects\WCAM\WCAM\bin\Debug\WebCam.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/WifiKeys.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 66f1542ee1ef212bb0e18b588800228ca2e113e0d5eec0f20c09f08225f61075
MD5 3705833eefefe24becb312f01953e926
SHA1 072413a9f83b092b5a7ba52c5db2d0fb08b16438
SHA512 652360e13b977b0c4542f48358aaa02fd4fbe46c29a99736119de8a02803824787ef76eb7f08f63b5b68a7d72d3bdd24f3462af571c7f75ae9187a320ec5598c
SSDEEP 192:qxOw7xyKgH38NvW//ocWuxJaGODu11iTCIW1Pk+jLqGCTYuTLuTeOrre:qd7xyKgH3qvM/ocjzn2miT0k+XtCTYR/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16306

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

c:\users\laptop\documents\visual studio 2015\Projects\WifiKeys\WifiKeys\obj\Debug\WifiKeys.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Worm.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5b32dad4ad2b350157eda3061dc821645e7cd291970509ab32e9023b8c945951
MD5 bef245a79659e08fcecc5c1f50be3f57
SHA1 eb91878b63a181723a75745c83d7fe6cd168ae8b
SHA512 380c90ae5c484ad0ddc6b29abb85c881940dc98c0bc71d3938c9601ca932ec2237928cb335bf12cf086a3316c71954432f55a6ed60362411f1cee078d32510c3
SSDEEP 192:WYfsyJl5ATYZeLtUFslQxGOC9e1PkzIW1PnGEHHFDLIMLOX:W6Jf8YZ/F0N9UPk9nGQFL4X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\XWorm V2.0 License Updated\XWorm V2.0\XWorm V2.0\XWorm V2.0\P\Worm\Worm\obj\Debug\Worm.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/uninstall.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 420c4a9616a17dcf49c790b01c00e65c2510cd052b255d9a85da955b1c8a8e7c
MD5 b940dbf98a4b1c79e7b56f015fc8b856
SHA1 6f526b0bd8f1f84745089980cd3472e2fbe4fdc2
SHA512 6f5fc00a4d13ded7c6543aad7481a6dd2f026d16fb648e7d454d3a9f884a5a6296e188119773d399ac8440b07816c273a7840c4e925990e4d24d34a57bcced92
SSDEEP 192:c+qBfv8vZvrSpshmeb7hSoeS/nmGODbHoPBfbjIW1Um0zHB0VAXp7y/LWZEk:czBfv8vZvr5Dld7gbifbOmwHoip7hZEk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17626

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\LapTop\Desktop\uninstall\uninstall\obj\Debug\uninstall.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Resource/data.dat

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d6e9972976881d3dad7ac2a0c66cd7dd81420908aae8b00195a02fdf756cfc5e
MD5 b8703418e6c3d1ccd83b8d178ab9f4c9
SHA1 6fb0e1e0ee5bc745f52a1c29e3cf4b88a2298dd6
SHA512 75ff6e911691e3d0d32c25d4b6d275a2b6157dae418ce5507f3e3f1b321c3f0dee516b7db0fd6588860019a19862f43c5335c465829de7a418a71999b71cfc3f
SSDEEP 98304:sbl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Ucf:s6OuK6mn9NzgMoYkSIvUcwti7TQlvciA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5879150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\attat\source\repos\Millenium RAT Buillder V2.9 (not ready)\Millenium\Millenium\obj\Release\net462\conhost.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/HVNC-Server.exe

IMPHASH 638c3474e6b92f46c9790abce213198c
SHA256 83178407d4761df1439304df2f08ec6df4e216986fab12590b6339186291b591
MD5 2bc558b0cf60f8c5a17d16299e07a030
SHA1 9a6a53a088cdbab38201b11015e58aacb85e1dc6
SHA512 21ed30fb07a670ca4cf44527d34d201735dac1a9c23e7cc709983c3dbff75cdeec8380c2fe795270fd77203fa9e59b34a324acdb0815c8654b819269e52d9ce8
SSDEEP 3072:cl/0Gw9hSR3UFqhHe9Z0SZDz4PUF8FaBh3:cl8GjtChHh3
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9147

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\LapTop\Desktop\HVNC\Source\Server\Release\Server.pdb

kernel32

CreateThread ResetEvent GetProcAddress CreateEventA LoadLibraryW RaiseException DecodePointer WriteConsoleW SetFilePointerEx SetEndOfFile HeapReAlloc CloseHandle ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers CreateFileW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA SetEvent Sleep WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection SetConsoleTitleW AllocConsole HeapSize GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetStringTypeW GetFileType UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetLastError GetModuleFileNameW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind SetLastError DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc LCMapStringW GetModuleHandleW

user32

wsprintfW LoadCursorW LoadIconW ShowWindow RegisterClassExW CreateWindowExW EndPaint BeginPaint ReleaseDC PostQuitMessage AppendMenuW GetClientRect TranslateMessage PeekMessageW GetMessageW DefWindowProcW GetSystemMenu GetKeyState PostMessageW GetDC FillRect InvalidateRgn DispatchMessageW

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC BitBlt SetDIBits DeleteObject CreateSolidBrush DeleteDC

ws2_32

inet_ntoa WSAGetLastError htons recv ntohs socket send getsockname getpeername WSAStartup listen closesocket bind accept

advapi32

SystemFunction036

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/ResHacker.exe

SHA256 aeeac91ca85c59309a8d6f7109a84e1ee6d4817498417373e7c3c93dac7bb1e5
MD5 d285a10c73da68b027951a2038a7ae0d
SHA1 e3e5712df92ed49d6cd429799e6e557af093da06
SHA512 150b47f6b4ab2c33c818843ddf30562c85055c1be5bbda7bc347bf36116b4d8d8f7b78303342e9eb667facd37a841eb7d930de325f25d170b680e97f8dfed48e
SSDEEP 24576:XS9wlTzi2gQO1PMV2DCHAJ2glv9fJVOYfJSzaSArbz2jQOS/:C9ijgQO1PMDozYAPz2UN/
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

757932

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

736KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Tools/vncviewer.exe

IMPHASH 66356bfceadca611b2dc546e6b5d92af
SHA256 823168f7ff268a96aa80d915d946411ef214e7597c73312b19f9723d704b1396
MD5 b8d15cd10f1e9ff6adeae64fbbeb755b
SHA1 f962549e42b58a056b11a9ba9750a30bc76844d7
SHA512 1478c76b08a8aa9cf9db927ea371c192ade81d8e27d394613f05aa60011fa8bc46ada115ab4c8c9aa75fcf86dbb62f7089a211f58270c984a204c91465cd07af
SSDEEP 24576:Jj/05kjHhc0Vo68/RWyVae30Zh6FSCTpf2kveQn5poM5lcOBo:JY5kdc0G68/RVoe3+MTZ2kFroM5lxBo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

b0:ba:dc:c2:ba:6f:a7:72:c9:4e:d0:b2:a2:0d:c4:2a:71:11:89:c2:fc:27:c1:1b:4f:f8:0a:0d:0d:f0:38:13

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=uvnc bvba,O=uvnc bvba,L=Antwerpen,C=BE

Chains

Feb 6, 2020

CN=uvnc bvba,O=uvnc bvba,L=Antwerpen,C=BE

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

Major OS version

Entry point

181984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ImageList_ReplaceIcon ord6 CreateToolbarEx InitCommonControlsEx ImageList_Create ord17

winmm

timeGetTime timeSetEvent timeKillEvent PlaySoundA

ws2_32

inet_addr gethostbyname WSAStartup WSACleanup ioctlsocket recv bind WSAAsyncSelect listen accept getpeername closesocket send __WSAFDIsSet connect socket select WSAGetLastError htons shutdown setsockopt

kernel32

FindClose LoadLibraryA FindNextFileA GetTempPathA DeleteFileA lstrcpyA CreateFileA SetFilePointer lstrlenA MoveFileExA SetEndOfFile SetErrorMode SystemTimeToFileTime CompareFileTime SetFileTime WriteFile GetDriveTypeA InitializeCriticalSection LeaveCriticalSection FileTimeToSystemTime ReadFile FlushFileBuffers CreateDirectoryA GetLogicalDriveStringsA lstrcmpiA EnterCriticalSection MoveFileA GetFileTime DeleteCriticalSection FileTimeToLocalFileTime MulDiv ExpandEnvironmentStringsA AllocConsole GetStdHandle WriteConsoleA OutputDebugStringA GetComputerNameA GetVersionExA CreateFileW GetProcessHeap SetEnvironmentVariableA CompareStringW WriteConsoleW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapReAlloc FindFirstFileA GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentDirectoryW PeekNamedPipe GetFileInformationByHandle GetDriveTypeW HeapSize CopyFileA GetConsoleCP SetHandleCount LoadLibraryW GetLocaleInfoW GetModuleFileNameW HeapCreate IsProcessorFeaturePresent SetLastError TlsFree IsValidCodePage GetOEMCP GetACP IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCPInfo LCMapStringW RtlUnwind RaiseException ExitThread GetStartupInfoW HeapSetInformation GetCommandLineA FindFirstFileExA GetFullPathNameA GetFileType InitializeCriticalSectionAndSpinCount SetStdHandle GetDateFormatA GetTimeFormatA HeapAlloc ExitProcess GetModuleHandleW GetTimeZoneInformation GetLocalTime GetSystemTimeAsFileTime HeapFree InterlockedExchange DecodePointer EncodePointer InterlockedDecrement InterlockedIncrement TlsAlloc DuplicateHandle GetCurrentThreadId SetThreadPriority CreateSemaphoreA TlsSetValue GetCurrentThread GetCurrentProcess TlsGetValue QueryPerformanceFrequency QueryPerformanceCounter GetConsoleMode GetProcAddress FreeLibrary GlobalFree MultiByteToWideChar WideCharToMultiByte GlobalSize GetPrivateProfileStringA WritePrivateProfileStringA GlobalUnlock GetPrivateProfileIntA GlobalAlloc GlobalLock CreateThread ResumeThread LocalFree CloseHandle GetModuleFileNameA ResetEvent GetLastError Beep GetFileAttributesA CreateEventA Sleep RemoveDirectoryA FormatMessageA GetTickCount SetEvent WaitForSingleObject GetModuleHandleA lstrcatA DosDateTimeToFileTime GetVolumeInformationA GetVersion LocalFileTimeToFileTime lstrcpynA CreateMutexA ReleaseMutex SetVolumeLabelA SetFileAttributesA GetCurrentDirectoryA SetCurrentDirectoryA SetEnvironmentVariableW GetStringTypeW

user32

LoadKeyboardLayoutA PostThreadMessageA CallNextHookEx GetForegroundWindow SetWindowsHookExA GetWindowThreadProcessId ToAscii GetKeyState keybd_event VkKeyScanW GetKeyboardState ToUnicode CreateDialogParamA IsDlgButtonChecked SetWindowRgn LoadBitmapA PtInRect IntersectRect GetDesktopWindow GetMenuStringA ScreenToClient ModifyMenuA SendDlgItemMessageA DrawTextA GetParent GetWindowTextLengthA TranslateMessage PeekMessageA GetMenuItemCount DispatchMessageA GetComboBoxInfo EnableWindow DestroyIcon EnumDisplaySettingsExA MonitorFromPoint GetMonitorInfoA MonitorFromWindow SystemParametersInfoA GetSystemMetrics EnumDisplayDevicesA ValidateRect RegisterClassExA SetCapture GetScrollInfo SetCaretBlinkTime ReleaseCapture CallWindowProcA GetCaretBlinkTime GetTopWindow GetWindow MapWindowPoints GetMessageA TrackPopupMenu GetMenuItemID CharToOemA OemToCharA wvsprintfA SetDlgItemTextA DialogBoxParamA LoadImageA EndDialog SetForegroundWindow TranslateAcceleratorA CreateAcceleratorTableA GetSubMenu LoadStringA LoadMenuA SetMenuDefaultItem IsClipboardFormatAvailable RegisterClipboardFormatA SetWindowLongA SetCursorPos RedrawWindow GetCursorPos CloseClipboard GetClipboardData EmptyClipboard OpenClipboard SetClipboardData GetClipboardOwner EndPaint DestroyWindow SetCursor GetDlgItemInt GetSystemMenu SetTimer GetWindowRect PostQuitMessage IsIconic FillRect SendNotifyMessageA KillTimer GetFocus LoadIconA InvalidateRgn GetClientRect SetFocus RegisterWindowMessageA BeginPaint GetDC SetDlgItemInt SetRect MessageBoxA InvalidateRect CreateWindowExA ReleaseDC EnableMenuItem ChangeClipboardChain DefWindowProcA SetWindowPos ShowWindow CreatePopupMenu GetSysColorBrush DrawMenuBar AppendMenuA IsWindow ShowScrollBar PostMessageA AdjustWindowRectEx ScrollWindowEx UpdateWindow DestroyMenu LoadCursorA SetClipboardViewer SetScrollInfo CheckMenuItem RegisterClassA MoveWindow GetKeyboardLayoutNameA SendMessageA GetWindowTextA GetWindowLongA GetDlgItem SetWindowTextA GetDlgItemTextA DestroyAcceleratorTable

gdi32

DeleteDC SetStretchBltMode SelectPalette RealizePalette CombineRgn CreatePalette SetDIBColorTable SetBrushOrgEx StretchBlt GetDeviceCaps GetStockObject CreateRectRgnIndirect Rectangle CreatePen SetBkMode CreateFontA SetTextColor LineTo MoveToEx CreatePolygonRgn SetROP2 UpdateColors BitBlt CreateDIBSection DeleteObject SelectObject CreateCompatibleDC CreateRectRgn CreateSolidBrush

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

advapi32

OpenProcessToken GetKernelObjectSecurity LookupPrivilegeValueA GetSecurityDescriptorLength AdjustTokenPrivileges IsValidAcl RegCloseKey RegOpenKeyExA RegQueryValueExA GetSecurityDescriptorDacl GetSecurityDescriptorGroup IsValidSecurityDescriptor GetSecurityDescriptorSacl IsValidSid GetSecurityDescriptorOwner SetKernelObjectSecurity GetSecurityDescriptorControl RegSetValueExA

shell32

SHGetMalloc SHBrowseForFolderA ShellExecuteA SHGetSpecialFolderPathA SHGetPathFromIDListA SHGetSpecialFolderLocation SHFileOperationA Shell_NotifyIconA SHGetFolderPathA

imm32

ImmAssociateContext

gdiplus

GdiplusShutdown GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncoders GdipSaveImageToFile GdiplusStartup

XWorm-RAT-V2.1-main/XWorm RAT V2.1/XHVNC.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e92707537fe99713752f3d3f479fa68a0c8dd80439c13a2bb4ebb36a952b63fd
MD5 4904329d091687c9deb08d9bd7282e77
SHA1 bcf7fcebb52cad605cb4de65bdd077e600475cc7
SHA512 b7ba131e9959f2f76aa3008711db9e6f2c4753a232140368be5c8388ab0e25154a31e579ef87fe01a3e4bc83402170bb9fbf242c6f01528455246b793e03fdfb
SSDEEP 24576:CmErCsazef+APWb6+CILRbTcJiWevOIWr9Lrdl5p0WdaMCtGjC+Ub:CPF+CWb6+CILRncZe65rb5p0ehVCr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1876686

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

XWorm-RAT-V2.1-main/XWorm RAT V2.1/XWorm RAT V2.1.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 ea9258e9975b8925a739066221d996aef19b4ef4f4c91524f82e39d403f25579
MD5 835f081566e31c989b525bccb943569c
SHA1 71d04e0a86ce9585e5b7a058beb0a43cf156a332
SHA512 9ec58f8c586ecf78ef8d75debc5dba58544558566423a634724bb5ab192aaf64f9ccbee9a5af48124a3366b2a7d24b4db71bb5743978201b881c08bad8f6fb0c
SSDEEP 49152:LdYJMfC7koydmRzCxWO8e89khof23mKijV6WvFw3BAz2tIm0U:qc3vdUEWFySfdw3rtIm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2239630

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\attat\source\repos\XWorm RAT V2.1\XWorm RAT V2.1\obj\Release\XWorm RAT V2.1.pdb

XWorm-RAT-V2.1-main/XWorm RAT V2.1/dnlib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e8bc7a627149386cb3cf714ae0101f69440f72cf2e7468a677b727b32aaed755
MD5 9ed69fbbfdec5d95ea229da3969dd77b
SHA1 7972339f0a1b6a28a2f335c84cdfc5d9beee72b6
SHA512 61bfaa00736487ed736a27c1a9e45ce14b578452471866d195ce1a4736e72bd4bec98938b8cbb83ffbf09cbf188e9b8760452cc95ee30565414882aadd0171a6
SSDEEP 24576:+9itfCdSZYeP0jsLpPl44znxuhv7fBTu1Z:W5QF6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1162638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\dnlib\dnlib\src\obj\Release\net35\dnlib.pdb

Sharing

General

Malware Config

Signatures

File Explorer

XWorm-RAT-V2.1-main.zip

XWorm-RAT-V2.1-main/LICENSE

XWorm-RAT-V2.1-main/README.md

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Command Reciever.exe

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/FastColoredTextBox.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Fixer.bat

XWorm-RAT-V2.1-main/XWorm RAT V2.1/GeoIP.dat

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Guna.UI2.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/NAudio.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/7zip.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/ACTWindows.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/AskUAC.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/BSOD.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/BlankScreen.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Bookmarks.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Bot.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Chat.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Chromium.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Clipboard.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Clipper.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Cmstp-Bypass.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Computerdefaults.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DeletePoints.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DeleteWD.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DicordTokens.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/DisableWD.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Email.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/Encoder.dll

mscoree

dotnet

XWorm-RAT-V2.1-main/XWorm RAT V2.1/Plugins/FileSeacher.dll