Cryptocurrency Stealer

CDEF-XWorm

March 1, 2026

Malware Analysis Reverse Engineering PE Windows .NET RAT XWorm Clipboard Hijacking Cryptocurrency Stealer Dnspy Sandbox

A .NET XWorm RAT that establishes triple persistence via scheduled task, startup shortcut, and registry Run key, implements keylogging, clipboard hijacking for crypto wallets, and communicates with multiple C2 servers over TCP using AES-ECB encrypted payloads.

HTB-Lupin

February 8, 2026

Malware Analysis Reverse Engineering Windows PE PHORPIEX Clipboard Hijacking Cryptocurrency Stealer USB Spreading UPnP Exploitation NAT Traversal MotW Bypass IDA

Reverse engineering PHORPIEX dropper - analyzing clipboard hijacking, USB spreading, and UPnP NAT traversal techniques.

↑