Overview

overview

10

Static

static

10

0d80dfd621...85.exe

windows7_x64

10

0d80dfd621...85.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85

  • Size

    361KB

  • Sample

    220529-y6kmwschbj

  • MD5

    92175d22a32d45d8d1beadf1e99ad9f6

  • SHA1

    13dfbe33cc691dd6533c45d001970f5e6b0e26d0

  • SHA256

    0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85

  • SHA512

    5ea867093683a1a4f920ad0d4a35b3ce935be982a44ada394d74213dcdea70aff66a93eb782c345c3bbf0bb3ea2f4afb28e6e96d3f08e8eee0997b778d3ac187

Score
10/10
webmonitorbackdoorinfostealerpersistenceratupx

Malware Config

Extracted

Family

webmonitor

C2

pitbullcant.wm01.to:443

Attributes
  • config_key

    A7HOB9ROz2LrVrPGPRzC4MVB2KltDr7S

  • private_key

    i9KVkEro3

  • url_path

    /recv5.php

Targets

    • Target

      0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85

    • Size

      361KB

    • MD5

      92175d22a32d45d8d1beadf1e99ad9f6

    • SHA1

      13dfbe33cc691dd6533c45d001970f5e6b0e26d0

    • SHA256

      0d80dfd6210c601119788192d13201c70ad7ec9375a3f308ee1322aaab79cb85

    • SHA512

      5ea867093683a1a4f920ad0d4a35b3ce935be982a44ada394d74213dcdea70aff66a93eb782c345c3bbf0bb3ea2f4afb28e6e96d3f08e8eee0997b778d3ac187

    Score
    10/10
    webmonitorbackdoorinfostealerpersistenceratupx

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • WebMonitor Payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks