Extracted

• • Target

    a3a62c034f2eb97d3673d2a608073f7e

  • Size

    1.8MB

  • MD5

    a3a62c034f2eb97d3673d2a608073f7e

  • SHA1

    250644fc77d95c6dcaef531b0f351f5ce33bbfbd

  • SHA256

    167f23bd6318e7e1bbe296639468d866b2b457410daab0e6b941dac6bcc4563f

  • SHA512

    16c0b478ea9f1fcdeb9c13af022ac0f18879798eb7715aabd93446630dd0b9e3e9c3c1e31114657623c9c932502b99f41c1f3c52ede0306311f729810366ed71

  • SSDEEP

    49152:y4bKFBaK648EFZ6hBYiYsQvoQhTnAYD6Xa:yOK+AZIBYi/coQl

  Score

  10^/10

  webmonitorbackdoorinfostealerrat

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor payload

  • CustAttr .NET packer

    Detects CustAttr .NET packer in memory.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2