webmonitor | 9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e

Resubmissions

24/09/2021, 14:18

210924-rmb33shbfl10

23/09/2021, 13:46

210923-q2y1qaedfr10

17/09/2021, 17:02

210917-vj9fysgab610

Sharing

Copy URL Twitter E-mail

General

Target
9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
Size 360KB
Sample210924-rmb33shbfl
SHA256 9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
MD5 6e223f8e362245614a74d9865d0817b0
SHA1 dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e
SHA512 36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
- Size 360KB
- SHA256 9bbd49dbf0098e342cbb8935f8f40c92a395d45c04ef00f5df08b6953e30ca9e
- MD5 6e223f8e362245614a74d9865d0817b0
- SHA1 dd8d9ea9d62bcf6a7e69bbf6dd81457103bcc29e
- SHA512 36321cbe8c9b17a939241247baa27e204f51c2f8c8667cafd3ddd939159412ead8addf663b2285499396917f1bebe51cc9f1ec7c218645f877860010da5c4e1a
- MD5 SHA1 SHA512
Score

10^/10

webmonitor backdoor infostealer persistence rat suricata upx
- RevcodeRat, WebMonitorRat
  WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
  backdoor rat infostealer webmonitor
- suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
  suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
  suricata
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

RevcodeRat, WebMonitorRat

suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

Executes dropped EXE

UPX packed file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2