Extracted

• • Target

    Perfectly Clear Workbench.exe

  • Size

    22.7MB

  • MD5

    07c8ab309a013e4786c9587db7a65bdf

  • SHA1

    ef8ab1daf015590cf14ce47a350a99c82b71d125

  • SHA256

    9f9f34da4353b46d4b59673ac0520cdf7bd5a513c0590dfde99363cf5f1db657

  • SHA512

    ef392d50539d36eac9609ffcd76a68fa2e18b9fde03e2f8d4554a557e1bd093129aae302211b0ccd04f39b277feff7067cf0bf33b34604e0ab5a3f8d34dfadf2

  Score

  10^/10

  webmonitorbackdoorinfostealerpersistenceratupxwarzonerat

  • Modifies WinLogon for persistence

    persistence

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat

  • WebMonitor Payload

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2