Extracted

• • Target

    2e084ca9b86b432252097b8cbb9fb8b470cc1ca9d3eedb8e9033e2ff09d126a9

  • Size

    668KB

  • MD5

    897f3c7d741c4d5c7fc96f322a6f5a6a

  • SHA1

    9738e0d5982f1a2255d7a72dc580bc85c554569e

  • SHA256

    2e084ca9b86b432252097b8cbb9fb8b470cc1ca9d3eedb8e9033e2ff09d126a9

  • SHA512

    30c433ff994848289cac9f500b7428b1bc06b119fb3260b0f48e5de0f2f841275ffbfab978d947b23f050acad647dd01925c33ddca9c2fa80cc9d9e50cb0c620

  Score

  10^/10

  webmonitorbackdoorinfostealerpersistenceratupx

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor payload

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2