webmonitor | cfcd72068fc5249a78ffbf4e8fe8cd912aa2f0042460e2bf9e468b8046e6f784

General

Target

cfcd72068fc5249a78ffbf4e8fe8cd912aa2f0042460e2bf9e468b8046e6f784
Size

3.6MB
Sample

220708-vxcn5sedd3
MD5

28e0b16bf3de480ee6c45ba870963a37
SHA1

7bd03305d9dcbb7aa32d20aca4b734dd46de2189
SHA256

cfcd72068fc5249a78ffbf4e8fe8cd912aa2f0042460e2bf9e468b8046e6f784
SHA512

0ada3c7367b5d0da0cf129055c6026805d6f674f36afd741791781ac11976430dc70f89ffec0b79a21bcb4ba75abcf114faf60e1cf159a674a95dc02d4c91a6a

Score

10^/10

Malware Config

Extracted

Family

webmonitor

C2

adriannarodriques99.wm01.to:443

Attributes

config_key
2mipSao9q2jxZoyTEiiLfTe14laxsarw
private_key
3afif4V5a
url_path
/recv5.php

Targets

- Target
  
  cfcd72068fc5249a78ffbf4e8fe8cd912aa2f0042460e2bf9e468b8046e6f784
- Size
  
  3.6MB
- MD5
  
  28e0b16bf3de480ee6c45ba870963a37
- SHA1
  
  7bd03305d9dcbb7aa32d20aca4b734dd46de2189
- SHA256
  
  cfcd72068fc5249a78ffbf4e8fe8cd912aa2f0042460e2bf9e468b8046e6f784
- SHA512
  
  0ada3c7367b5d0da0cf129055c6026805d6f674f36afd741791781ac11976430dc70f89ffec0b79a21bcb4ba75abcf114faf60e1cf159a674a95dc02d4c91a6a
Score

10^/10

webmonitor backdoor evasion infostealer rat themida trojan
- RevcodeRat, WebMonitorRat
  WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
  backdoor rat infostealer webmonitor
- WebMonitor payload
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Themida packer
  Detects Themida, an advanced Windows software protection system.
  themida
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RevcodeRat, WebMonitorRat

WebMonitor payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Checks BIOS information in registry

Themida packer

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2