General
-
Target
b2c9e863e22409bbd43d7e3a43b6895081092124cb5c795a76272d7f392e1769
-
Size
1.1MB
-
Sample
220418-t6mp2aaed7
-
MD5
4d08cd26844d557101ce21938812261c
-
SHA1
fce26de220032955493d70dfb7b2b3e9bf04d909
-
SHA256
b2c9e863e22409bbd43d7e3a43b6895081092124cb5c795a76272d7f392e1769
-
SHA512
dcf1b8fed11f5b4bbc54e0e80bf5cda4cd7cf34bb2f478bbf4971a36d78bc6c7cb36b5e57539bc7bbc1445d476913dca818ef7cab208ef7da7beed17f2dd0809
Static task
static1
Behavioral task
behavioral1
Sample
b2c9e863e22409bbd43d7e3a43b6895081092124cb5c795a76272d7f392e1769.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b2c9e863e22409bbd43d7e3a43b6895081092124cb5c795a76272d7f392e1769.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
webmonitor
niiarmah.wm01.to:443
-
config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
-
private_key
yvkn5wM8E
-
url_path
/recv5.php
Targets
-
-
Target
b2c9e863e22409bbd43d7e3a43b6895081092124cb5c795a76272d7f392e1769
-
Size
1.1MB
-
MD5
4d08cd26844d557101ce21938812261c
-
SHA1
fce26de220032955493d70dfb7b2b3e9bf04d909
-
SHA256
b2c9e863e22409bbd43d7e3a43b6895081092124cb5c795a76272d7f392e1769
-
SHA512
dcf1b8fed11f5b4bbc54e0e80bf5cda4cd7cf34bb2f478bbf4971a36d78bc6c7cb36b5e57539bc7bbc1445d476913dca818ef7cab208ef7da7beed17f2dd0809
Score10/10-
RevcodeRat, WebMonitorRat
WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
-
WebMonitor Payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Suspicious use of SetThreadContext
-