Extracted

• • Target

    CulMasterBot.exe

  • Size

    758KB

  • MD5

    2417767a8d9740d0c304bb72ed185b67

  • SHA1

    21bbd4db761968bc1fb0708767ef10814dd41868

  • SHA256

    7f8878badd48f61c9af71d304ee2cc5d2e580a92816b721a206d2889063f4b81

  • SHA512

    c0b947608909829271cefb797017933a02d55a378eb6f70ecba20c3d86658c46fb58a515e90d32419cfdeab63d7e166fc699cbf0bfba8b5135301b5d8b9f63ae

  • SSDEEP

    12288:7fQqQuCmgRYeJIDdrd+pQkKVn6nY4u5fsR1b:7fQqQuiJIprdOQJn6nbuiF

  Score

  10^/10

  xwormdiscoveryrattrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2