xThreat

Multi-Engine Malware Detonation & Config Extraction Workbench

Submit binaries, archives, JARs, remote payloads, or hashes. xThreat correlates static PE/bytecode unpacking, extracted C2 configurations, Hatching Triage VM detonation, VirusTotal v3, and Falcon Sandbox in one unified workspace.

Open Analysis WorkbenchSearch IOC TelemetryAPI Reference
4 Integrated Engines
VT v3 · Triage · Falcon · JLab
PE / ELF / JAR / URL / Hash
Static + Dynamic VM
50 MB Stream Limit
upload.ee & dosya.co unpack
Verified Researcher Access
D1 SHA-256 API Keys
LIVE TELEMETRY SPECIMEN INSPECTOR
Invoice_Q4_Remittance.exe
SHA-256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MALICIOUS · 94/100
VIRUSTOTAL V3
54 / 72
TRIAGE VM SCORE
10 / 10
SHANNON ENTROPY
7.48 (Packed .rsrc)
EXTRACTED FAMILY / CONFIGRedLine Stealer
C2: http://185.215.113.42:8080/gate.php
C2: wss://185.215.113.42:8443/ws
VirtualAllocExWriteProcessMemoryCryptUnprotectData
Inspect Full Report →

Built for Reverse Engineers & SOC Analysts

Every component is wired to real static unpacking, cryptographic hashing, and multi-engine sandbox telemetry.

ENG-01

Multi-Engine Correlation

Simultaneously queries VirusTotal v3 (70+ engines), Hatching Triage VM detonation, Falcon Sandbox, and xThreat Static Heuristics.

VirusTotal v3 · Hatching Triage · Falcon Sandbox
CFG-02

Malware Config & C2 Extraction

Automatically extracts hardcoded C2 URLs, IP:Port sockets, Discord/Telegram webhooks, WebSockets, mutexes, and persistence keys.

RedLine · LummaC2 · Stealc · AsyncRAT · CobaltStrike
JLAB-03

JLab Static Archive & PE Inspector

Calculates Shannon entropy, parses PE sections and suspicious Win32 API imports, and inspects JAR/ZIP bytecode entries in memory.

PE32/PE32+ · JAR/ZIP Bytecode · Shannon Entropy
NET-04

Protected Remote Payload Fetcher

Streams remote binaries up to 50 MB with built-in SSRF protection and automated direct-link unpackers for upload.ee and dosya.co.

RFC1918 SSRF Guard · upload.ee & dosya.co Unpacker
IOC-05

Structured IOC Intelligence

Query hashes (MD5/SHA-1/SHA-256), IPv4 hosts, ASN networks, C2 domains, and malware families with benign infrastructure allowlisting.

hash: · ip: · domain: · family: · Benign Allowlist
API-06

REST API & Telegram Alerting

Authenticate automated pipelines with SHA-256 hashed Bearer API keys and receive real-time HTML-escaped Telegram alerts.

Bearer xth_live_* · D1 SHA-256 Auth · Telegram Bot

Access Tiers & Researcher Verification

xThreat enforces strict researcher verification to protect sandbox capacity and prevent adversary abuse.

Verified Researcher

Approved Access

For independent malware analysts, incident responders, and academic researchers.

  • 50 MB file upload & remote URL payload unpacking
  • Full static PE / JAR / entropy / C2 config extraction
  • VirusTotal v3 + Hatching Triage VM sandbox integration
  • Personal SHA-256 hashed REST API key (xth_live_*)
Apply for Researcher Account

SOC & Enterprise Operations

Dedicated Node

For security operations centers requiring isolated private detonation and custom webhooks.

  • Private-by-default submissions & isolated D1 retention
  • Automated Falcon Sandbox & multi-topic Telegram routing
  • High-concurrency REST API rate limits
  • Role-based team administration
Request SOC Provisioning