Overview

overview

10

Static

static

JANUARY OV...df.exe

windows7_x64

10

JANUARY OV...df.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    01a0edfce737d16102372ac1228f4095a3bdab926ecbccf64b452a4e9972a59a

  • Size

    1.3MB

  • Sample

    220205-yqqtzafafp

  • MD5

    6e74ee737021356a410d16ee3f974205

  • SHA1

    25b34754ee49727301a103f5ff7847d0be527aec

  • SHA256

    01a0edfce737d16102372ac1228f4095a3bdab926ecbccf64b452a4e9972a59a

  • SHA512

    5791685ded041980668086a48c4b307cafd186048d84e952f0b4fb0e0c75dc679efe2d4fc10ee85795d3ad1d80d08de237af33857623bddc415babedd5ae6700

Score
10/10
webmonitorbackdoorinfostealerrat

Malware Config

Extracted

Family

webmonitor

C2

niiarmah.wm01.to:443

Attributes
  • config_key

    4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O

  • private_key

    yvkn5wM8E

  • url_path

    /recv5.php

Targets

    • Target

      JANUARY OVERDUE INVOICE.pdf.exe

    • Size

      1.5MB

    • MD5

      f7d79ec6a3bf524f8f0c0e8d54949948

    • SHA1

      ff9535613f977f6321a1eca20c50e97d23c83259

    • SHA256

      b4fbe906439597a3d05b94f3a7001069687e598cabc9a82e47d6c43046be10a5

    • SHA512

      27dd0344afe613f24147e08aa1208e0fbea2c6618a69a97e48b94a9f412b44273dfd268653dcaec7a83e7fdb10601b6c58ee90bc412601879308f69f7d5d2783

    Score
    10/10
    webmonitorbackdoorinfostealerrat

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • WebMonitor Payload

    • CustAttr .NET packer

      Detects CustAttr .NET packer in memory.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks