9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

General
Target

9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

Size

360KB

Sample

210923-q2y1qaedfr

Score
10 /10
MD5

6e223f8e362245614a74d9865d0817b0

SHA1

dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e

SHA256

9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

SHA512

36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a

Malware Config

Extracted

Family webmonitor
C2

restrep0.wm01.to:443

Attributes
config_key
rmGRTTf00SgxCRDiG5pe71nlU5TxVucQ
private_key
7geUgzWms
url_path
/recv4.php
Targets
Target

9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

MD5

6e223f8e362245614a74d9865d0817b0

Filesize

360KB

Score
10 /10
SHA1

dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e

SHA256

9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

SHA512

36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a

Tags

Signatures

  • RevcodeRat, WebMonitorRat

    Description

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    Tags

  • WebMonitor Payload

  • suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    Description

    suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    Tags

  • Executes dropped EXE

  • UPX packed file

    Description

    Detects executables packed with UPX/modified UPX open source packer.

    Tags

  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation