webmonitor | 06429eae76265388efa2e75096af8ed944a094ff8edcdcbed231a3a12cb5f7ee | Triage

Sharing

General

Target

06429eae76265388efa2e75096af8ed944a094ff8edcdcbed231a3a12cb5f7ee
Size

934KB
MD5

9fb987b3f3c05b245fe4d9b867296f3f
SHA1

85f479e1198ca53cb34a246ebe0f5843d94c36f2
SHA256

06429eae76265388efa2e75096af8ed944a094ff8edcdcbed231a3a12cb5f7ee
SHA512

73da4822024fb48d2161328f4e0dbf839d94be37b778a26f32f44dc1318cb4afb27b58e5063d9d51714bcf5f3aae92361567be4eed43aee54fd5ed9697632bea
SSDEEP

24576:cSbh2jS1gYm9Na46+hqQS8VXt8VB5h7FeQAyXmkOV:cpYl46+hqn8VXt8Vh7Fbmk0

Score

10^/10

webmonitor

Malware Config

Extracted

Family

webmonitor

C2

qqsola.wm01.to:443

Attributes

config_key
jJYLbTB9TsvWtCPWrodDFU1k5EBbvtuI
private_key
neS5F12vo
url_path
/recv5.php

Signatures

WebMonitor Payload 1 IoCs

resource	yara_rule
sample	family_webmonitor

Webmonitor family
webmonitor

Files

06429eae76265388efa2e75096af8ed944a094ff8edcdcbed231a3a12cb5f7ee
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 917KB - Virtual size: 916KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ