+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: Xworm plugin error (/showthread.php?tid=6319572)
Pages: Pages
1
2
Xworm plugin error - Rs6 - Feb 11, 2026
Hello to all 🙂
Can anyone recommend a crypter that is xworm 6.0 compatible and has no problem with plugins?
I mean no errors of this type when you try to open a plugin on the client:
Plugin error!Could not load file or assembly '1633280 bytes loaded from XWormClient,Version=1.0.0.0,Culture=neutral,PublicKeyToken=null' or one of its dependencies. An attempt was made to load a program with an incorrect format.
Thanks in advance.
RE: Xworm plugin error - R5N3T - Feb 11, 2026
Hopefully someone here can help you out with this, bro.
RE: Xworm plugin error - ServersFxcked - Feb 11, 2026
Wouldn't use anything passed 5.6 as its not the real xCoder
RE: Xworm plugin error - CL1B - Feb 11, 2026
(Feb 11, 2026 04:07 AM)ServersFxcked Wrote: Wouldn't use anything passed 5.6 as its not the real xCoder
^
RE: Xworm plugin error - jmark7 - Feb 11, 2026
thats is runtime detection from windows defender when the plugin is loaded.
No Crypter can bypass it, Only way to bypass is to re-fud the plugins.
You can PM me with your TG ID if you need professional solution on it.
RE: Xworm plugin error - Pankii - Feb 11, 2026
You have been caught by Amsi. You have to obfuscate your xworm DLL's or add amsi bypass in your client code. The second option might be worse than first but it makes permanent solution.
RE: Xworm plugin error - gvnscrutinizer - Feb 11, 2026
AMSI are scanning the plugin bytes.
(Feb 11, 2026 12:34 PM)jmark7 Wrote: thats is runtime detection from windows defender when the plugin is loaded.
No Crypter can bypass it, Only way to bypass is to re-fud the plugins.
You can PM me with your TG ID if you need professional solution on it.
Not true- you just need an amsi bypass that propagates for all sequential plugin loads by the rat payload
(Feb 11, 2026 12:45 AM)R5N3T Wrote: Hopefully someone here can help you out with this, bro.
its due to using a mid tier crypter which doesnt consider runtime activity from the payload itself i.e. loading plugins. the payload itself may have not triggered amsi but xworm loads plugins via assembly.load(byte) which get scanned by amsi.
RE: Xworm plugin error - CL1B - Feb 12, 2026
What's up with everyone thinking this has anything to do with AMSI?
The bytes have been loaded already, you guys clearly do not know how AMSI works.
This is caused by arch mismatching and nothing else, if you have the source code; Compile the stub and plugins in the same x64 arch.
In some cases (especially when dealing with old projects) there will a missing dependency, you can easily find, download and add this using dependency walker or fus log viewer.
For those who don't know how AMSI works; Go to mimikatz PS github and use the script command, watch how loud AMSI screams it's name.
Much different.
RE: Xworm plugin error - Frost Crypt - Feb 12, 2026
(Feb 12, 2026 05:04 AM)MarlboroMan Wrote: What's up with everyone thinking this has anything to do with AMSI?
The bytes have been loaded already, you guys clearly do not know how AMSI works.
This is caused by arch mismatching and nothing else, if you have the source code; Compile the stub and plugins in the same x64 arch.
In some cases (especially when dealing with old projects) there will a missing dependency, you can easily find, download and add this using dependency walker or fus log viewer.
For those who don't know how AMSI works; Go to mimikatz PS github and use the script command, watch how loud AMSI screams it's name.
Much different.
because it does most likely, I'm getting a very similar detection when my .net file is loaded into memory in powershell via [System.Reflection.Assembly]::Load($...);
When that happens I have to refud it to fix it.
Exception calling "Load" with "1" argument(s): "Could not load file or assembly '50688 bytes loaded from Anonymously
Hosted DynamicMethods Assembly, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. An
attempt was made to load a program with an incorrect format."
This is what I'm getting and WD blocks it SILENTLY, you need to keep wd opened to see the detection, there is no notification.
So if xworm is storing these plugins as bytes, wd tagged them and gives that silent detection when you're trying to load them.
So try to lose some of your big balls attitude because you don't know half as much as you think you know and bullying others while being wrong is pretty embarrassing.
Op can use any crypter he wants, until those plugins are refuded, they will fail to load.
RE: Xworm plugin error - CL1B - Feb 12, 2026
OP, You're better off with a stack overflow search.
Trust.
RE: Xworm plugin error - gvnscrutinizer - Feb 12, 2026
(Feb 12, 2026 05:04 AM)MarlboroMan Wrote: What's up with everyone thinking this has anything to do with AMSI?
The bytes have been loaded already, you guys clearly do not know how AMSI works.
This is caused by arch mismatching and nothing else, if you have the source code; Compile the stub and plugins in the same x64 arch.
In some cases (especially when dealing with old projects) there will a missing dependency, you can easily find, download and add this using dependency walker or fus log viewer.
For those who don't know how AMSI works; Go to mimikatz PS github and use the script command, watch how loud AMSI screams it's name.
Much different.
Youre so confidently wrong lmao. xworm and many other modular rats load plugins reflectively via assembly.load(byte[]). xworm is heavilty signatured so the bytes get scanned by amsi and blocked
RE: Xworm plugin error - possessed-client - Feb 12, 2026
(Feb 11, 2026 12:33 AM)Rs6 Wrote: Hello to all 🙂
Can anyone recommend a crypter that is xworm 6.0 compatible and has no problem with plugins?
I mean no errors of this type when you try to open a plugin on the client:
Plugin error!Could not load file or assembly '1633280 bytes loaded from XWormClient,Version=1.0.0.0,Culture=neutral,PublicKeyToken=null' or one of its dependencies. An attempt was made to load a program with an incorrect format.
Thanks in advance.
Well, flame wars notwithstanding, it's easy to figure out whether the problem is with AV detecting plugins or something else by testing in a VM with and without AV protection. And if it is AV, then yeah, you either have to FUD the plugins by modifying source and recompiling or trying various obfuscators. Alternatively, you have to bypass AMSI for the process trying to load the plugin, and if the plugin is detected even on disk before execution, then you have to rewrite how the RAT handles plugins, so it bypasses AMSI, then decrypts the plugin and only then loads and runs it.
Here's a recent topic with a similar problem: https://hackforums.net/showthread.php?tid=6317704
Your idea of using a crypter might work if it has a working AMSI bypass and the plugin isn't detected on disk (or maybe even in memory) before AMSI gets into play with Assembly.Load call to the plugin path or variable in memory.
RE: Xworm plugin error - Rs6 - Feb 13, 2026
Thanks to all for answers.
So if i understand correctly, i need to find or crypter that bypasses amsi or way to obfuscate plugins?
RE: Xworm plugin error - gvnscrutinizer - Feb 13, 2026
(Feb 13, 2026 09:10 AM)Rs6 Wrote: Thanks to all for answers.
So if i understand correctly, i need to find or crypter that bypasses amsi or way to obfuscate plugins?
yup. send me a pm if you want help with confirming its amsi blocking plugin loads and what would needa be done.
RE: Xworm plugin error - Frost Crypt - Feb 13, 2026
(Feb 13, 2026 09:10 AM)Rs6 Wrote: Thanks to all for answers.
So if i understand correctly, i need to find or crypter that bypasses amsi or way to obfuscate plugins?
you need to crypt better maintained products or find someone to refud those plugins otherwise you will just waste money on crypters