XWorm V5.2.zip
- SHA256 bbd19b42209127ad2b015d76f6fc37e35f2c4d751b1b4847a92fd218dd0caf1c
Behavioral task
behavioral1
Sample
XWorm V5.2/XWorm V5.2.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
XWorm V5.2/XWorm V5.2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
XWorm V5.2/XWormLoader 5.2 x32.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
XWorm V5.2/XWormLoader 5.2 x32.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
XWorm V5.2/XWormLoader 5.2 x64.exe
Resource
win7-20240221-en
| resource | yara_rule |
|---|---|
| static1/unpack001/XWorm V5.2/Guna.UI2.dll | family_agenttesla |
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
| resource | yara_rule |
|---|---|
| static1/unpack001/XWorm V5.2/Plugins/Options.dll | disable_win_def |
| resource | yara_rule |
|---|---|
| static1/unpack001/XWorm V5.2/Plugins/Recovery.dll | family_stormkitty |
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
| resource | yara_rule |
|---|---|
| static1/unpack001/XWorm V5.2/XWorm V5.2.exe | agile_net |
A PDF can contain malformed data to evade detection
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/XWorm V5.2/FastColoredTextBox.dll |
| unpack001/XWorm V5.2/GMap.NET.Core.dll |
| unpack001/XWorm V5.2/GMap.NET.WindowsForms.dll |
| unpack001/XWorm V5.2/IconExtractor.dll |
| unpack001/XWorm V5.2/Mono.Cecil.Mdb.dll |
| unpack001/XWorm V5.2/Mono.Cecil.Pdb.dll |
| unpack001/XWorm V5.2/Mono.Cecil.Rocks.dll |
| unpack001/XWorm V5.2/Mono.Cecil.dll |
| unpack001/XWorm V5.2/MonoMod.Backports.dll |
| unpack001/XWorm V5.2/MonoMod.Core.dll |
| unpack001/XWorm V5.2/MonoMod.ILHelpers.dll |
| unpack001/XWorm V5.2/MonoMod.Iced.dll |
| unpack001/XWorm V5.2/MonoMod.Utils.dll |
| unpack001/XWorm V5.2/Plugins/ActiveWindows.dll |
| unpack001/XWorm V5.2/Plugins/All-In-One.dll |
| unpack001/XWorm V5.2/Plugins/Chat.dll |
| unpack001/XWorm V5.2/Plugins/Clipboard.dll |
| unpack001/XWorm V5.2/Plugins/Cmstp-Bypass.dll |
| unpack001/XWorm V5.2/Plugins/FileManager.dll |
| unpack001/XWorm V5.2/Plugins/FileSeacher.dll |
| unpack001/XWorm V5.2/Plugins/HBrowser.dll |
| unpack001/XWorm V5.2/Plugins/HRDP.dll |
| unpack001/XWorm V5.2/Plugins/HVNC.dll |
| unpack001/XWorm V5.2/Plugins/HVNCMemory.dll |
| unpack001/XWorm V5.2/Plugins/HiddenApps.dll |
| unpack001/XWorm V5.2/Plugins/Informations.dll |
| unpack001/XWorm V5.2/Plugins/Keylogger.dll |
| unpack001/XWorm V5.2/Plugins/Maps.dll |
| unpack001/XWorm V5.2/Plugins/MessageBox.dll |
| unpack001/XWorm V5.2/Plugins/Microphone.dll |
| unpack001/XWorm V5.2/Plugins/Ngrok-Disk.dll |
| unpack001/XWorm V5.2/Plugins/Options.dll |
| unpack001/XWorm V5.2/Plugins/Pastime.dll |
| unpack001/XWorm V5.2/Plugins/Performance.dll |
| unpack001/XWorm V5.2/Plugins/ProcessManager.dll |
| unpack001/XWorm V5.2/Plugins/Programs.dll |
| unpack001/XWorm V5.2/Plugins/Ransomware.dll |
| unpack001/XWorm V5.2/Plugins/Recovery.dll |
| unpack001/XWorm V5.2/Plugins/Regedit.dll |
| unpack001/XWorm V5.2/Plugins/RemoteDesktop.dll |
| unpack001/XWorm V5.2/Plugins/ReverseProxy.dll |
| unpack001/XWorm V5.2/Plugins/RunPE.dll |
| unpack001/XWorm V5.2/Plugins/ServiceManager.dll |
| unpack001/XWorm V5.2/Plugins/Shell.dll |
| unpack001/XWorm V5.2/Plugins/StartupManager.dll |
| unpack001/XWorm V5.2/Plugins/Stealer.dll |
| unpack001/XWorm V5.2/Plugins/TCPConnections.dll |
| unpack001/XWorm V5.2/Plugins/UACBypass.dll |
| unpack001/XWorm V5.2/Plugins/VB.NET Compiler.dll |
| unpack001/XWorm V5.2/Plugins/WSound.dll |
| unpack001/XWorm V5.2/Plugins/WebCam.dll |
| unpack001/XWorm V5.2/RVGLib.dll |
| unpack001/XWorm V5.2/SimpleObfuscator.dll |
| unpack001/XWorm V5.2/XWorm V5.2.exe |
| unpack001/XWorm V5.2/XWormLoader 5.2 x32.exe |
| unpack001/XWorm V5.2/XWormLoader 5.2 x64.exe |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
AgentTesla payload
Feb 21, 2023
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Jun 3, 2020
CN=Razer USA Ltd.,O=Razer USA Ltd.,L=Irvine,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Mar 8, 2023
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
StormKitty payload
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.