Reverse Engineering XorCrypt exe | From Suspected Ransomware to C++ Infostealer
Source: YouTube · Malware Research Diary · published Nov 4, 2026 · 1:00:16
The analyst examines a low-detection info stealer ("stealer.exe"), finding standard credential-harvesting behavior but surprisingly robust anti-analysis tricks, including EDR/AV unhooking and sandbox/debugger detection 7:10, 38:18.
Key Takeaways:
• Triage shows only 14/71 generic detections; CAPA results mislead because authors include dummy APIs to evade static signatures 1:05, 8:05
• Typical flow: API resolution, then anti-VM/registry checks, memory checks (bails on ≤4GB RAM), and tick-count timing to spot debuggers 17:52, 19:00, 20:46
• Standout anti-hooking: patches EDR/AV API hooks, overwriting jump instructions (0xE9) with NOPs (0x90) to blind tools monitoring calls like CreateFile 36:06, 38:18
• Dedicated disable routines target Kaspersky, McAfee, and BitDefender; inconsistent, non-modular coding suggests an entry-level developer 40:08, 43:01
• Exfiltration uses a hardcoded Telegram bot token and chat ID (partially reconstructed as 6979899...) with user-agent "stealer 1.0" 48:36, 50:08
• Data gathering is otherwise standard: browser credentials, passwords, crypto wallets (Phantom), software detection 59:03
Despite its anti-detection arsenal, the "vibe-coded," unprofessional style marks the author as entry-level; the analyst also warns never to run debuggers on machines used for analysis 59:52, 19:42.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everyone. Welcome back to another session in analyzing malware. It's been a while. Um lately I've been um working on my um malware config decoder. Um and there haven't seemed to be anything interesting lately um that I seen. So if there's anything that um mailware that might be interesting um please let me know. I would love to take a look and basically share a video about it. Um, today I have a few malware um in that I download today. I think we just going to take a look at this uh short cryp um so short this is a ransomware I believe. So let's check on first total 14 out of 71. Um that's pretty low in detection. Um very generic um detection. Um, let me run kappa and in here collection repair zip telegram nothing stand out I mean is okay so the process is well is Um the runtime I be…