Zero-Dwell Threat Intelligence Reports

Themida-Packed Swift.exe Flags as Trojan.Malgent With High-Severity Hits.exe

64bits detect-debug-environment corrupt themida

XWorm Variant Shows Dual C2, AES Keys, and Full RAT Features.exe

calls-wmi assembly payload

XWorm V6.4 Backdoor Uses TCP + Telegram C2 for Remote Control.exe

calls-wmi checks-user-input assembly persistence payload

XWorm Variant Performs ip-api Recon and Beacons to TCP C2 on 56475.exe

detect-debug-environment calls-wmi assembly malware obfuscated

Roblox Account Manager.exe Flags High-Severity Trojan/GameHack Traits.exe

long-sleeps detect-debug-environment checks-user-input assembly executes-dropped-file persistence clipboard checks-usb-bus

Packed XWorm V6.5 Sample Detected With Telegram ChatBot Indicators.exe

detect-debug-environment checks-user-input assembly

Packed Crack Tool Unmasked as XWorm/Packy Trojan With Temp Payload.exe

long-sleeps detect-debug-environment calls-wmi checks-memory-available assembly

MSIL Dropper Executes PowerShell Defender Bypass and Drops nerestpc.exe.exe

long-sleeps detect-debug-environment calls-wmi checks-user-input assembly persistence

Win64 XWorm Backdoor Abuses Shell-Open Registry for Persistence.exe

64bits overlay spreader

Catlavan XWorm Variant Shows Stealer Activity and Dual C2 Channels.exe

detect-debug-environment calls-wmi assembly malware obfuscated

XWorm V6 Dropper Uses Pastebin + Telegram C2 and AES Key.exe

long-sleeps checks-user-input assembly malware

XWorm Variant Fetches C2 From Pastebin and Deploys crvwv.exe.exe

assembly malware obfuscated service-scan