Extracted

• • Target

    ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b

  • Size

    365KB

  • MD5

    af76619743662c5e9ccfaa1f940b8354

  • SHA1

    bf8e2c7b4a84ca177d7ae9c4ba6155d2dbc74b38

  • SHA256

    ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b

  • SHA512

    be9eaaadc9cf5509e301c9908e555b2ac0dbf984aede52545a78b98ce459f222050e1d0fc01aa4afdca275d921f79c972b325de55a9d91285c1298e6b5291373

  Score

  10^/10

  webmonitorbackdoorinfostealerratsuricataupx

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor payload

  • suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    suricata: ET MALWARE WebMonitor/RevCode RAT CnC Domain in DNS Lookup

    suricata

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  behavioral1behavioral2