home.social

#xorbee — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #xorbee, aggregated by home.social.

  1. Randy @[email protected] ·

    i've got a new malware analysis describing what i have dubbed XorBee RAT

    • delivered by #kongtuke via #clickfix
    • Python based
    • targets domain-joined Windows
    • uses port tcp/4444 for C2 traffic
    • obfuscates C2 traffic with XOR of the letter b
    • continuously runs a thread checking for monitoring tools and exists if seen
    • after authenticating with C2, enters reverse shell
    • related to ModeloRAT
    • first seen in October 2025

    rmceoin.github.io/malware-anal

    #xorbee

    #kongtuke #clickfix #xorbee