Extracted

Extracted

• • Target

    be684c0623c1f226849c386f594c2626c14c73470a989a8907a03c258e01abfc

  • Size

    64KB

  • MD5

    b2a52460d7ddcf0d1eb6cb98171309da

  • SHA1

    fe2ae9c1d227e045351d4c8e64089cade6ca2f48

  • SHA256

    be684c0623c1f226849c386f594c2626c14c73470a989a8907a03c258e01abfc

  • SHA512

    d332b3cefa05f13338ebfdf5d2f87de593d82371ad950d815a8b5e4c41f06fb8a8722ab9da77286c7d6da82effc2faa4b7de246943f86f39e91ce3c926deb8cd

  Score

  10^/10

  guloaderwebmonitorbackdoordownloaderinfostealerratupxpersistencesuricata

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor Payload

  • suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    suricata

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2