Extracted

• • Target

    601683bffc489875354dd4a6b03f824c940b139799d03aefd279643080fae5c2

  • Size

    717KB

  • MD5

    c00d1cf7fb01a9b33e438cd16b6eb578

  • SHA1

    0d8c3833492d4106b7164d6ed9fa019838152832

  • SHA256

    601683bffc489875354dd4a6b03f824c940b139799d03aefd279643080fae5c2

  • SHA512

    2f5cac64da4edce25f0cffcc96fb1e500c0ee919ac0b7a466ddeab665ce6db1373a897fee492b36bed3b1a39be8b47af7676b2ef93f3b556b9794b2d78cac92a

  Score

  10^/10

  webmonitorbackdoorinfostealerratupx

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Drops startup file

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2