webmonitor | 381c0425a341144eabce9490808898b95dfeeadb09aa280116eb688b93f3abeb

General

Target
c0822708a2d2b1be0e853e96f1473f44
Size 765KB
Sample240311-nt3b3abb5x
SHA256 381c0425a341144eabce9490808898b95dfeeadb09aa280116eb688b93f3abeb
MD5 c0822708a2d2b1be0e853e96f1473f44
SHA1 eb299b3f06b4d1bda482fc98dad3fa740c8f0919
SHA512 1b1392855592307ba4b0d344e49ad0a83be48a17970132c7df61aab28bde0c6c01e46dc15653cbf40665b2afa7e36baf57ecf2147f050e3ebfe2e3ea0f7f8b26
SSDEEP 12288:DX7ER6qdlNwAunE4rd8PtAFnqIPbnokP8CJxSj18ScVwb9bTVxYoVVwqsEJn5znR:DX7Edw7nEwd8CxqIPLBJxSB8tVwZbTQM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

webmonitor

C2

niiarmah.wm01.to:443

Attributes

config_key
4EcDHH7aWbl50LayUnuRlJWUXiKQWk0O
private_key
yvkn5wM8E
url_path
/recv5.php

Targets

- Target
  STATEMENT OF ACCOUNT.exe
- Size 962KB
- SHA256 77732e74850050bb6f935945e510d32a0499d820fa1197752df8bd01c66e8210
- MD5 d39da4595ca51a748ac33447965d80e3
- SHA1 e7e0ec21e7cb1d67c906169e6e039d4b29c423c7
- SHA512 620cf557f657213ff9f52b2939fdd689906f4b634a20210d3a6062802b25e30d3085c3b6bf0336c880fa8deedafc67f4daee2dd999f911d86184bda47d3ba178
- SSDEEP 24576:0FsVd+29QFw53L5o3DVUYR35Xc32WBjshPQ:0FsqtFwaFi3JX
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

webmonitor backdoor infostealer rat
- RevcodeRat, WebMonitorRat
  WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.
  backdoor rat infostealer webmonitor
- WebMonitor payload
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

RevcodeRat, WebMonitorRat

WebMonitor payload

Checks computer location settings

Unexpected DNS network traffic destination

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2