Analysis from ANY.RUN and Joe Sandbox indicates the following behaviors:
If you're dealing with this specific file, ensure you understand its contents and have appropriate software and knowledge to handle it safely. If it's from an unknown source, proceed with caution to avoid any potential risks to your computer or data. PassatHook -1-.rar
: If you ran the file, change your passwords from a different, clean device, as XWorm can capture keystrokes and browser credentials. Analysis from ANY
: Users often seek it for features such as improved aim (aimbots) and team strategy enhancements. Distribution change your passwords from a different
Specifically targets browser credentials, Discord tokens, Telegram sessions, and cryptocurrency wallets.
The malware often copies itself to system folders like C:\ProgramData\ to ensure it runs every time the computer starts.