📌 Description

XwormKiller - is a specialized utility designed to detect and eliminate XWorm RAT and similar Remote Access Trojans from infected Windows systems. It performs deep system analysis, process monitoring, and automatic cleanup.

✨ Features

• 🛡️ Deep Protection (custom hunter) – auto-engages the moment the primary scan finds no trace of the RAT; a hard time-boxed (5–10s) parallel sweep of running processes, deep user-writable folders, script stubs, WMI event-consumer persistence and covert C2 owners, with automatic quarantine
• 🧠 Weighted threat scoring – every process/file is scored across many signals instead of a single name match, drastically cutting false positives while catching more real threats
• ✍️ Authenticode verification – validates digital signatures via WinVerifyTrust (full chain check, not just presence)
• 📈 Entropy analysis – flags packed / encrypted payloads by measuring Shannon entropy
• 🧬 .NET image detection – reads the PE header to identify managed assemblies (XWorm and most commodity RATs are .NET)
• 🔎 Static signature scanning – searches binaries for XWorm markers and process-injection / loader indicators
• 🧵 Command-line & process-tree analysis – detects encoded PowerShell, LOLBin abuse, MSBuild inline-task loaders, and macro-dropper spawn chains (via WMI)
• 🌐 Network C2 analysis – parses active connections and flags ESTABLISHED links to remote RAT ports
• 🛡️ System process integrity check – verifies svchost.exe, explorer.exe, MSBuild.exe against path spoofing and DLL injection
• 🕵️ IFEO hijack detection – finds and removes Image File Execution Options debugger persistence
• 🔥 Active port scanning – detects open RAT ports and terminates associated processes
• 🚫 Firewall blocking – adds inbound/outbound rules to block RAT communication
• 🧹 Registry cleanup – removes autorun entries (with binary analysis of targets), scheduled tasks, and startup folder items
• 💾 Cache wipe – cleans temporary files, prefetch, and recycle bin
• 🎨 Colored console output – intuitive visual feedback with color-coded warnings
• 🔄 Self-protection – prevents the tool from terminating itself

🏗️ Build & Release

• Local build (Windows + .NET 8 SDK):

  dotnet publish XwormKiller/XwormKiller.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -o publish

• Automated release (GitHub Actions): push a version tag and CI builds the self-contained win-x64 executable and attaches it to a GitHub Release:

  git tag v1.1.0
  git push origin v1.1.0

  You can also trigger it manually from the Actions → Build and Release tab.

✅ Requirements

• Windows 10/11 (x64), run as Administrator

© XeoTeam. All rights reserved. Telegram: @xeocoder