11-05-26, 02:00 AM
xia is a 500KB under DLL Stealer
What sets us apart from other stealers?
Other Node.js-based stealers typically use hard obfuscation and only appear as FUD during the scan phase. Our code behaves like legitimate code both during scan time and runtime. Another difference is that our code uses DLL sideloading. To put it simply, when you place our DLL next to a signed or legitimate EXE program, that legitimate program executes our DLL.
Features;
- Cookies (Chromium SQLite + Firefox cookies.sqlite)
- Login credentials (Web Data, DPAPI decrypt)
- Credit cards (Web Data, DPAPI decrypt)
- Autofill data (Web Data, plaintext)
- 25 crypto wallet extensions (MetaMask, Phantom, Coinbase, Binance, Ronin, Exodus, Atomic, TronLink, Math, Yoroi, Guarda, Jaxx, Wombat, Ever,Kardia, Terra, Keplr, Solflare, Maiar, ZilPay, Harmony, Polkadot, Fewcha, Petra, Martian)
- Downloads + Desktop .txt files (under 10 MB, max 50)
- Hash-obfuscated API resolution
- Self delete
- Sideload DLL (All program included it doesn’t matter which ones like OneDrive, Discord etc.)
- No administrator privileges are required to run it
- It runs at lightning speed whenever you place it next to any legitimate EXE file, whether signed or unsigned
- A different signature and different behavior in every build
- Fully undetected run time + scan
- UAC Bypass: Automatically escalates to administrator privileges when the executable is not already running with elevated
- Ring‑3 Rootkit: Hides files, processes, registry keys, and network connections to maintain stealth.
- Discord Webhook Log
- Persistence: Registers itself to start automatically with the system, surviving reboots and logouts.
- Anti‑VM & Anti‑Debug: Detects virtual machines and debuggers, then exits with a convincing error message.
- Under 500KB
Why choose xia over standard crypters and Stealers?
While crypters only obfuscate payloads for a short time before being detected, xia actively terminates the security software itself, granting a far longer window of undetected operation and greater
xia supports all Windows versions and builds (10 and 11)
More info & showcase;
Signal: indianpoorbitch.01
What sets us apart from other stealers?
Other Node.js-based stealers typically use hard obfuscation and only appear as FUD during the scan phase. Our code behaves like legitimate code both during scan time and runtime. Another difference is that our code uses DLL sideloading. To put it simply, when you place our DLL next to a signed or legitimate EXE program, that legitimate program executes our DLL.
Features;
- Cookies (Chromium SQLite + Firefox cookies.sqlite)
- Login credentials (Web Data, DPAPI decrypt)
- Credit cards (Web Data, DPAPI decrypt)
- Autofill data (Web Data, plaintext)
- 25 crypto wallet extensions (MetaMask, Phantom, Coinbase, Binance, Ronin, Exodus, Atomic, TronLink, Math, Yoroi, Guarda, Jaxx, Wombat, Ever,Kardia, Terra, Keplr, Solflare, Maiar, ZilPay, Harmony, Polkadot, Fewcha, Petra, Martian)
- Downloads + Desktop .txt files (under 10 MB, max 50)
- Hash-obfuscated API resolution
- Self delete
- Sideload DLL (All program included it doesn’t matter which ones like OneDrive, Discord etc.)
- No administrator privileges are required to run it
- It runs at lightning speed whenever you place it next to any legitimate EXE file, whether signed or unsigned
- A different signature and different behavior in every build
- Fully undetected run time + scan
- UAC Bypass: Automatically escalates to administrator privileges when the executable is not already running with elevated
- Ring‑3 Rootkit: Hides files, processes, registry keys, and network connections to maintain stealth.
- Discord Webhook Log
- Persistence: Registers itself to start automatically with the system, surviving reboots and logouts.
- Anti‑VM & Anti‑Debug: Detects virtual machines and debuggers, then exits with a convincing error message.
- Under 500KB
Why choose xia over standard crypters and Stealers?
While crypters only obfuscate payloads for a short time before being detected, xia actively terminates the security software itself, granting a far longer window of undetected operation and greater
xia supports all Windows versions and builds (10 and 11)
More info & showcase;
Signal: indianpoorbitch.01