General

  • Target

    XWorm V5.6.zip

  • Size

    25.2MB

  • MD5

    3df07d8344e5800f75f38fdade2aaec0

  • SHA1

    133feffb7e48be2ce194324972d6e0424f2fd52f

  • SHA256

    1836e05f25dddf9426969e13ab80d1dcdf8d7b496b1a05d98ebae9303c18b956

  • SHA512

    38b91983dbc23e6bbb3443045aea54952f93da08ce68aa661583c9522c30a9e22a1c16bf99bfdc6a39a8a4bae353ef12ba978357ab8a3315fde2275bc4ff8579

  • SSDEEP

    393216:Cv6y2gszSnnHTrQWQD59U/p+HZZPz+NJWRL4UPBu+89YWOcC16kh0upLTLrD9dO6:MwSnHTm59UhfJWRbPwYiC1euNrbO6

Score
10/10

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • StormKitty payload 1 IoCs
  • Stormkitty family
  • Xworm family
  • Unsigned PE 46 IoCs

    Checks for missing Authenticode signature.

Files

  • XWorm V5.6.zip
    .zip

    Password: hack1ngt0ols

  • XWorm V5.6/Background.png
    .png

    Password: hack1ngt0ols

  • XWorm V5.6/FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    Password: hack1ngt0ols

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Fixer.bat
  • XWorm V5.6/GMap.NET.Core.dll
    .dll windows:4 windows x86 arch:x86

    Password: hack1ngt0ols

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/GMap.NET.WindowsForms.dll
    .dll windows:4 windows x86 arch:x86

    Password: hack1ngt0ols

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/GeoIP.dat
  • XWorm V5.6/Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    Password: hack1ngt0ols

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • XWorm V5.6/IconExtractor.dll
    .dll windows:4 windows x86 arch:x86

    Password: hack1ngt0ols

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Icons/icon (1).ico
  • XWorm V5.6/Icons/icon (10).ico
  • XWorm V5.6/Icons/icon (11).ico
  • XWorm V5.6/Icons/icon (12).ico
  • XWorm V5.6/Icons/icon (13).ico
  • XWorm V5.6/Icons/icon (14).ico
  • XWorm V5.6/Icons/icon (15).ico
  • XWorm V5.6/Icons/icon (16).ico
  • XWorm V5.6/Icons/icon (17).ico
  • XWorm V5.6/Icons/icon (2).ico
  • XWorm V5.6/Icons/icon (3).ico
  • XWorm V5.6/Icons/icon (4).ico
  • XWorm V5.6/Icons/icon (5).ico
  • XWorm V5.6/Icons/icon (6).ico
  • XWorm V5.6/Icons/icon (7).ico
  • XWorm V5.6/Icons/icon (8).ico
  • XWorm V5.6/Icons/icon (9).ico
  • XWorm V5.6/Logs/ErrorLogs.txt
  • XWorm V5.6/NAudio.dll
    .dll windows:4 windows x86 arch:x86

    Password: hack1ngt0ols

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • XWorm V5.6/Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    Password: hack1ngt0ols

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/ActiveWindows.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Chat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Chromium.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Clipboard.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Cmstp-Bypass.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/FileManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/FilesSearcher.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/HBrowser.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/HRDP.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/HVNC.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/HVNCMemory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/HiddenApps.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Informations.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Keylogger.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Maps.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/MessageBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Microphone.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Ngrok-Installer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Options.dll
    .dll .ps1 windows:4 windows x86 arch:x86 polyglot

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Pastime.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Performance.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/ProcessManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Programs.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Ransomware.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Recovery.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Regedit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/RemoteDesktop.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/ReverseProxy.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/RunPE.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/ServiceManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Shell.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/StartupManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/Stealer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/TCPConnections.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/UACBypass.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/VB.NET Compiler.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/VoiceChat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/WSound.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Plugins/WebCam.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/RES/U40957361f7481084776e6aedU9f0U1
  • XWorm V5.6/RES/XWorm.ACT.resources
  • XWorm V5.6/RES/XWorm.About.resources
  • XWorm V5.6/RES/XWorm.Builder.resources
  • XWorm V5.6/RES/XWorm.Chat.resources
  • XWorm V5.6/RES/XWorm.Clipboard.resources
  • XWorm V5.6/RES/XWorm.Clipper.resources
  • XWorm V5.6/RES/XWorm.CustomOpen.resources
  • XWorm V5.6/RES/XWorm.DDosAttack.resources
  • XWorm V5.6/RES/XWorm.EditReg.resources
  • XWorm V5.6/RES/XWorm.FM.resources
  • XWorm V5.6/RES/XWorm.FilesSearcher.resources
  • XWorm V5.6/RES/XWorm.Ftp.resources
  • XWorm V5.6/RES/XWorm.Fun.resources
  • XWorm V5.6/RES/XWorm.HApps.resources
  • XWorm V5.6/RES/XWorm.HBrowser.resources
  • XWorm V5.6/RES/XWorm.HRDP.resources
  • XWorm V5.6/RES/XWorm.HVNC.resources
  • XWorm V5.6/RES/XWorm.Hash.resources
  • XWorm V5.6/RES/XWorm.Hosts.resources
  • XWorm V5.6/RES/XWorm.INFO.resources
  • XWorm V5.6/RES/XWorm.Keylogger.resources
  • XWorm V5.6/RES/XWorm.MBox.resources
  • XWorm V5.6/RES/XWorm.MIC.resources
  • XWorm V5.6/RES/XWorm.Main.resources
  • XWorm V5.6/RES/XWorm.Maps.resources
  • XWorm V5.6/RES/XWorm.Performance.resources
  • XWorm V5.6/RES/XWorm.Port.resources
  • XWorm V5.6/RES/XWorm.ProcessV.resources
  • XWorm V5.6/RES/XWorm.Programs.resources
  • XWorm V5.6/RES/XWorm.Proxy.resources
  • XWorm V5.6/RES/XWorm.Ransomware.resources
  • XWorm V5.6/RES/XWorm.Registry.resources
  • XWorm V5.6/RES/XWorm.RemoteDesktop.resources
  • XWorm V5.6/RES/XWorm.Resources.resources
    .vbs
  • XWorm V5.6/RES/XWorm.RunPE.resources
  • XWorm V5.6/RES/XWorm.ServiceManager.resources
  • XWorm V5.6/RES/XWorm.Shell.resources
  • XWorm V5.6/RES/XWorm.Sound.resources
  • XWorm V5.6/RES/XWorm.StartupManager.resources
  • XWorm V5.6/RES/XWorm.TBotNotify.resources
  • XWorm V5.6/RES/XWorm.TXT.resources
  • XWorm V5.6/RES/XWorm.TcpConnectionForm.resources
  • XWorm V5.6/RES/XWorm.ToolsBox.resources
  • XWorm V5.6/RES/XWorm.VBCode.resources
  • XWorm V5.6/RES/XWorm.VoiceChat.resources
  • XWorm V5.6/RES/XWorm.WebCam.resources
  • XWorm V5.6/RES/XWorm.ngrok.resources
  • XWorm V5.6/SimpleObfuscator.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • XWorm V5.6/Sounds/Chat.wav
  • XWorm V5.6/Sounds/Intro.wav
  • XWorm V5.6/XWorm V5.6.exe.config
    .xml
  • XWorm V5.6/Xworm V5.6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • XWorm V5.6/XwormLoader.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.