webmonitor | 9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e | Triage

Resubmissions

24-09-2021 14:18

210924-rmb33shbfl 10

23-09-2021 13:46

210923-q2y1qaedfr 10

17-09-2021 17:02

210917-vj9fysgab6 10

Sharing

General

Target

9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
Size

360KB
Sample

210917-vj9fysgab6
MD5

6e223f8e362245614a74d9865d0817b0
SHA1

dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e
SHA256

9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
SHA512

36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a

Score

10^/10

webmonitor backdoor infostealer persistence rat upx

Malware Config

Targets

- Target
  
  9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
- Size
  
  360KB
- MD5
  
  6e223f8e362245614a74d9865d0817b0
- SHA1
  
  dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e
- SHA256
  
  9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
- SHA512
  
  36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a
Score

10^/10

webmonitor backdoor infostealer persistence rat upx
- RevcodeRat, WebMonitorRat
  WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
  backdoor rat infostealer webmonitor
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

webmonitorbackdoorinfostealerpersistenceratupx

behavioral2