Extracted

• • Target

    0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85

  • Size

    361KB

  • MD5

    92175d22a32d45d8d1beadf1e99ad9f6

  • SHA1

    13dfbe33cc691dd6533c45d001970f5e6b0e26d0

  • SHA256

    0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85

  • SHA512

    5ea867093683a1a4f920ad0d4a35b3ce935be982a44ada394d74213dcdea70aff66a93eb782c345c3bbf0bb3ea2f4afb28e6e96d3f08e8eee0997b778d3ac187

  Score

  10^/10

  webmonitorbackdoorinfostealerpersistenceratupx

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor Payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2