General

  • Target

    ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b

  • Size

    365KB

  • MD5

    af76619743662c5e9ccfaa1f940b8354

  • SHA1

    bf8e2c7b4a84ca177d7ae9c4ba6155d2dbc74b38

  • SHA256

    ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b

  • SHA512

    be9eaaadc9cf5509e301c9908e555b2ac0dbf984aede52545a78b98ce459f222050e1d0fc01aa4afdca275d921f79c972b325de55a9d91285c1298e6b5291373

  • SSDEEP

    6144:cxLA03gnBCrzHbklDubM1oFRgfHaSjcVfUpJqTyZp0KfgxcFmQoZgfHlgASbyz:cxLAzBCX7ktu2qg/aSjosL4Kfgo5oZ4/

Score
10/10

Malware Config

Extracted

Family

webmonitor

C2

primeservers1.wm01.to:443

Attributes
  • config_key

    AP8PrfNym8htAX0Za6LL12tdOuH5BSPp

  • private_key

    U6yRoBXHU

  • url_path

    /recv5.php

Signatures

  • WebMonitor payload 1 IoCs
  • Webmonitor family
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Files

  • ea419643de9a10a418292f1603f86bab0942f436af5e7a8309351ce552e68d2b
    .exe windows x86


    Headers

    Sections

  • out.upx
    .exe windows x86


    Headers

    Sections