Overview

overview

10

Static

static

10

XWorm-5.6-main.zip

windows7-x64

1

XWorm-5.6-main.zip

windows10-2004-x64

1

Resubmissions

03-02-2025 19:11

250203-xv42qazngt 10

03-02-2025 19:07

250203-xswbss1rdm 10

03-02-2025 19:04

250203-xrbwrs1qhn 10

02-02-2025 15:00

250202-sdj8rswpez 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    XWorm-5.6-main.zip

  • Size

    17.4MB

  • MD5

    f8766a4d7853f38b9a5cb8b9e7e601a0

  • SHA1

    23eb644f84f35180aaf334f00659e8b907b45833

  • SHA256

    09630f5f1a47d6fe6b02d74de4c077876b6c607c183e241e82e72d10fb4c0ea0

  • SHA512

    65dbea03faa6f50d454292cbccd51ca099ab82bb56136643df69ea4790a842464a99cce79a26b8d1813be221bd4486c7c16d7b14597f269e0f2030f2d2f2574a

  • SSDEEP

    393216:wA1udbqUg2idC/kZz9g+430arKdAcXrO5VyAEBQ2T0ORhk:wCXUg2IhZS65rO5V8BQS04hk

Score
10/10
by aflatonstormkittyxwormnjrat

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

By AFlatoN

C2

147.185.221.22:40639

Mutex

b2e31adf64af873c0fa30a8ea1b8e5b8

Attributes
  • reg_key

    b2e31adf64af873c0fa30a8ea1b8e5b8

  • splitter

    Y262SUCZ4UJJ

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 1 IoCs
  • Njrat family
    njrat
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Xworm family
    xworm
  • Unsigned PE 46 IoCs

    Checks for missing Authenticode signature.

Files

  • XWorm-5.6-main.zip
    .zip
  • XWorm-5.6-main/README.md
  • XWorm-5.6-main/XWorm 5.6.zip
    .zip
  • Background.png
    .png
  • ClientsFolder/51D95E7CA784F71CFB78/Recovery/DiscordToken_09-09-2024 00;51;47;190.txt
  • FastColoredTextBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Fixer.bat
  • GMap.NET.Core.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GMap.NET.WindowsForms.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • GeoIP.dat
  • Guna.UI2.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • IconExtractor.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Icons/icon (1).ico
  • Icons/icon (10).ico
  • Icons/icon (11).ico
  • Icons/icon (12).ico
  • Icons/icon (13).ico
  • Icons/icon (14).ico
  • Icons/icon (15).ico
  • Icons/icon (16).ico
  • Icons/icon (17).ico
  • Icons/icon (2).ico
  • Icons/icon (3).ico
  • Icons/icon (4).ico
  • Icons/icon (5).ico
  • Icons/icon (6).ico
  • Icons/icon (7).ico
  • Icons/icon (8).ico
  • Icons/icon (9).ico
  • Logs/ErrorLogs.txt
  • NAudio.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Newtonsoft.Json.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Code Sign

    Headers

    Imports

    Sections

  • Plugins/ActiveWindows.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Chat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Chromium.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Clipboard.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Cmstp-Bypass.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/FileManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/FilesSearcher.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HBrowser.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HRDP.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HVNC.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HVNCMemory.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/HiddenApps.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Informations.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Keylogger.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Maps.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/MessageBox.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Microphone.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Ngrok-Installer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Options.dll
    .dll .ps1 windows:4 windows x86 arch:x86 polyglot

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Pastime.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Performance.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/ProcessManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Programs.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Ransomware.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Recovery.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Regedit.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/RemoteDesktop.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/ReverseProxy.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/RunPE.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/ServiceManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Shell.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/StartupManager.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/Stealer.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/TCPConnections.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/UACBypass.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/VB.NET Compiler.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/VoiceChat.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/WSound.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Plugins/WebCam.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • README.md
  • RES/U40957361f7481084776e6aedU9f0U1
  • RES/XWorm.ACT.resources
  • RES/XWorm.About.resources
  • RES/XWorm.Builder.resources
  • RES/XWorm.Chat.resources
  • RES/XWorm.Clipboard.resources
  • RES/XWorm.Clipper.resources
  • RES/XWorm.CustomOpen.resources
  • RES/XWorm.DDosAttack.resources
  • RES/XWorm.EditReg.resources
  • RES/XWorm.FM.resources
  • RES/XWorm.FilesSearcher.resources
  • RES/XWorm.Ftp.resources
  • RES/XWorm.Fun.resources
  • RES/XWorm.HApps.resources
  • RES/XWorm.HBrowser.resources
  • RES/XWorm.HRDP.resources
  • RES/XWorm.HVNC.resources
  • RES/XWorm.Hash.resources
  • RES/XWorm.Hosts.resources
  • RES/XWorm.INFO.resources
  • RES/XWorm.Keylogger.resources
  • RES/XWorm.MBox.resources
  • RES/XWorm.MIC.resources
  • RES/XWorm.Main.resources
  • RES/XWorm.Maps.resources
  • RES/XWorm.Performance.resources
  • RES/XWorm.Port.resources
  • RES/XWorm.ProcessV.resources
  • RES/XWorm.Programs.resources
  • RES/XWorm.Proxy.resources
  • RES/XWorm.Ransomware.resources
  • RES/XWorm.Registry.resources
  • RES/XWorm.RemoteDesktop.resources
  • RES/XWorm.Resources.resources
    .vbs
  • RES/XWorm.RunPE.resources
  • RES/XWorm.ServiceManager.resources
  • RES/XWorm.Shell.resources
  • RES/XWorm.Sound.resources
  • RES/XWorm.StartupManager.resources
  • RES/XWorm.TBotNotify.resources
  • RES/XWorm.TXT.resources
  • RES/XWorm.TcpConnectionForm.resources
  • RES/XWorm.ToolsBox.resources
  • RES/XWorm.VBCode.resources
  • RES/XWorm.VoiceChat.resources
  • RES/XWorm.WebCam.resources
  • RES/XWorm.ngrok.resources
  • SimpleObfuscator.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Sounds/Chat.wav
  • Sounds/Intro.wav
  • XWorm V5.6.exe.config
    .xml
  • Xworm V5.6.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • XwormLoader.exe
    .exe windows:6 windows x86 arch:x86


    Headers

    Sections