General
-
Target
2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f
-
Size
664KB
-
Sample
220222-ja4cssfbgj
-
MD5
d70e0374668e637143033871c188e611
-
SHA1
b139aae87bbebce9b4f30b34488e5725e5f2d9f4
-
SHA256
2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f
-
SHA512
c76e5c47dff15dcdf65504d85bbdb59292be24ba3d9eadb6ac4f191fc87b41769854a4e1a4bf7c7478ca433ed36b4245def44b7dc9176baaf3f7163c8495756d
Static task
static1
Behavioral task
behavioral1
Sample
2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
webmonitor
mukor.wm01.to:443
-
config_key
zOjouFvoVpF6QWsmVHlIAw7Ge07Wx6SW
-
private_key
dOhdo7byI
-
url_path
/recv5.php
Targets
-
-
Target
2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f
-
Size
664KB
-
MD5
d70e0374668e637143033871c188e611
-
SHA1
b139aae87bbebce9b4f30b34488e5725e5f2d9f4
-
SHA256
2e5e87e2a5336e6d41b03a70c5dd8ae7cbe459d6642d42414906c95c8de0463f
-
SHA512
c76e5c47dff15dcdf65504d85bbdb59292be24ba3d9eadb6ac4f191fc87b41769854a4e1a4bf7c7478ca433ed36b4245def44b7dc9176baaf3f7163c8495756d
-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload
-
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-