Overview

overview

10

Static

static

17453e7215...80.exe

windows7_x64

1

17453e7215...80.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

  • Size

    840KB

  • Sample

    220625-c7l2fsbagp

  • MD5

    8a2123d4809ffdc677df37b88d58769c

  • SHA1

    4138f2da78ccf7ed3a07d455fddb367f59568d04

  • SHA256

    17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

  • SHA512

    632870596e6f41adefce8a6589ee75b9df1ab483e619d2a2e555f6878a48007c5a38267c576ef3b056559d5348994427e46690034a59388aeee910f4fa93f671

Score
10/10
webmonitorbackdoorinfostealerratupx

Malware Config

Extracted

Family

webmonitor

C2

mafianclub.wm01.to:443

Attributes
  • config_key

    msK8483mYp1k2OzxD1I3yoSUcNW7v1k5

  • private_key

    WB8PgMeHa

  • url_path

    /recv5.php

Targets

    • Target

      17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

    • Size

      840KB

    • MD5

      8a2123d4809ffdc677df37b88d58769c

    • SHA1

      4138f2da78ccf7ed3a07d455fddb367f59568d04

    • SHA256

      17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

    • SHA512

      632870596e6f41adefce8a6589ee75b9df1ab483e619d2a2e555f6878a48007c5a38267c576ef3b056559d5348994427e46690034a59388aeee910f4fa93f671

    Score
    10/10
    webmonitorbackdoorinfostealerratupx

    • RevcodeRat, WebMonitorRat

      WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

      backdoorratinfostealerwebmonitor

    • WebMonitor Payload

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks