Extracted

• • Target

    2699fd4e118ec814f98e7b62546f8d4d10b28fbef3cafe4442a920d81f6a9016

  • Size

    546KB

  • MD5

    ea8bd15c924883beb0675399bc9e790a

  • SHA1

    0b18ec8eaa1b11315be4d08618f2df14d60a9be1

  • SHA256

    2699fd4e118ec814f98e7b62546f8d4d10b28fbef3cafe4442a920d81f6a9016

  • SHA512

    7d0c8cadee1a10cdcc039603a114f39cbf9b514a90d98f3142eb300bd73082672e7dae7cc2611f28e89175d600964a7f81cfd5c045b92212cd1dff5ee1665ce6

  Score

  10^/10

  webmonitorbackdoorinfostealerpersistenceratsuricataupx

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor Payload

  • suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    suricata

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2