EvilCoder Project Selling Multiple Dangerous Tools Online
ID: b9ac7c79-e97c-5dd7-b624-bacab31ae14f
STIX ID: report--b9ac7c79-e97c-5dd7-b624-bacab31ae14f
Feed Name: Cyble Blog
Threat Score
This report analyzes XWorm, a .NET-based Remote Access Trojan advertised on dark web marketplaces that combines RAT capabilities (keylogging, screen capture, webcam/microphone access, HVNC/hidden RDP), credential/cryptocurrency theft (clipper, browser and wallet theft), DDoS and built‑in ransomware functionality; it details anti-analysis and persistence mechanisms, C2 communication (system6458.ddns.net:6666), command handling, and provides extensive file-hash indicators and recommended mitigations.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.