Overview

overview

10

Static

static

0b41b1f1d3...48.exe

windows7_x64

10

0b41b1f1d3...48.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0b41b1f1d338b4b082a88a385334d4cc85b6b7ef582bf15c5bd104839f195348

  • Size

    1.6MB

  • Sample

    210515-dxn7hbw622

  • MD5

    727c2d4c6016849316ae589295508acc

  • SHA1

    9782d9c356d7c7f83a92daf941cd0e34b2301e32

  • SHA256

    0b41b1f1d338b4b082a88a385334d4cc85b6b7ef582bf15c5bd104839f195348

  • SHA512

    cf083b91c210cc43006410648d096519cc45f6d2db40f2980f4b2816784ddfa8cf2b40b5eec277e0986cd192d3285806293d17ffd944d3376e9fa6798324bab8

Score
10/10
webmonitorbackdoorinfostealerpersistenceratupx

Malware Config

Targets

    • Target

      0b41b1f1d338b4b082a88a385334d4cc85b6b7ef582bf15c5bd104839f195348

    • Size

      1.6MB

    • MD5

      727c2d4c6016849316ae589295508acc

    • SHA1

      9782d9c356d7c7f83a92daf941cd0e34b2301e32

    • SHA256

      0b41b1f1d338b4b082a88a385334d4cc85b6b7ef582bf15c5bd104839f195348

    • SHA512

      cf083b91c210cc43006410648d096519cc45f6d2db40f2980f4b2816784ddfa8cf2b40b5eec277e0986cd192d3285806293d17ffd944d3376e9fa6798324bab8

    Score
    10/10
    webmonitorbackdoorinfostealerpersistenceratupx

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks