Report Overview
Visitedpublic
2025-05-08 08:03:47
Tags
Submit Tags
URL
github.com/analhacker/-/raw/main/XClient.exe
Finishing URL
about:privatebrowsing
IP / ASN
140.82.121.3
#36459 GITHUB
Title
about:privatebrowsing

Detections

urlquery
0
Network Intrusion Detection
0
Threat Detection Systems
5

Host Summary

HostRankRegisteredFirst SeenLast Seen
github.com
14232007-10-092016-07-132025-05-07
raw.githubusercontent.com
358022014-02-062014-03-012025-05-07

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules
SeverityIndicatorAlert
mediumraw.githubusercontent.com/analhacker/-/main/XClient.exeDetects XWorm RAT
mediumraw.githubusercontent.com/analhacker/-/main/XClient.exeDetect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

OpenPhish

No alerts detected


PhishTank

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


File detected

URL
raw.githubusercontent.com/analhacker/-/main/XClient.exe
IP / ASN
185.199.110.133
#54113 FASTLY
File Overview
File TypePE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
Size243 kB (242688 bytes)
MD534d6274d11258ced240d9197baef3468
SHA121f0e4e9f0d19ecb2027cbd98f6f7e1e5c2be131

Detections

AnalyzerVerdictAlert
RussianPanda public YARA rulesmalware
Detects XWorm RAT
YARAhub by abuse.chmalware
Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
VirusTotalmalicious

JavaScript (0)

HTTP Transactions (2)

URLIPResponseSize
GET github.com/analhacker/-/raw/main/XClient.exe
140.82.121.3302 Found243 kB
GET raw.githubusercontent.com/analhacker/-/main/XClient.exe
185.199.110.133200 OK243 kB