SYMBOLCOMMON_NAMEaka. SYNONYMS
win.webmonitor (Back to overview)

WebMonitor RAT

aka: RevCode
VTCollection     URLhaus        

On its website, Webmonitor RAT is described as 'a very powerful, user-friendly, easy-to-setup and state-of-the-art monitoring tool. Webmonitor is a fully native RAT, meaning it will run on all Windows versions and languages starting from Windows XP and up, and perfectly compatible with all crypters and protectors.'
Unit42 notes in their analysis that it is offered as C2-as-a-service and raises the controversial aspect that the builder allows to create client binaries that will not show any popup or dialogue during installation or while running on a target system.

References
2020-11-16Trend MicroTrendmicro
Malicious Actors Target Comm Apps such as Zoom, Slack, Discord
WebMonitor RAT
2020-09-04KrabsOnSecurityMr. Krabs
BitRAT pt. 2: Hidden Browser, SOCKS5 proxy, and UnknownProducts Unmasked
BitRAT WebMonitor RAT
2020-02-04RevCode
RevCode RAT
WebMonitor RAT
2019-04-22KrebsOnSecurityBrian Krebs
Who’s Behind the RevCode WebMonitor RAT?
WebMonitor RAT
2018-04-13Palo Alto Networks Unit 42Mike Harbison, Simon Conant
Say “Cheese”: WebMonitor RAT Comes with C2-as-a-Service (C2aaS)
WebMonitor RAT
Yara Rules
[TLP:WHITE] win_webmonitor_auto (20230808 | Detects win.webmonitor.)
rule win_webmonitor_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.webmonitor."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 06 000b 3a58ff 1b03 fd 006cff1e e00e }
            // n = 7, score = 200
            //   06                   | push                es
            //   000b                 | add                 byte ptr [ebx], cl
            //   3a58ff               | cmp                 bl, byte ptr [eax - 1]
            //   1b03                 | sbb                 eax, dword ptr [ebx]
            //   fd                   | std                 
            //   006cff1e             | add                 byte ptr [edi + edi*8 + 0x1e], ch
            //   e00e                 | loopne              0x10

        $sequence_1 = { 41 0080cd41009c d34100 e8???????? }
            // n = 4, score = 200
            //   41                   | inc                 ecx
            //   0080cd41009c         | add                 byte ptr [eax - 0x63ffbe33], al
            //   d34100               | rol                 dword ptr [ecx], cl
            //   e8????????           |                     

        $sequence_2 = { 0094be4100d891 41 0084e84100a872 42 00a06a4200f8 }
            // n = 5, score = 200
            //   0094be4100d891       | add                 byte ptr [esi + edi*4 - 0x6e27ffbf], dl
            //   41                   | inc                 ecx
            //   0084e84100a872       | add                 byte ptr [eax + ebp*8 + 0x72a80041], al
            //   42                   | inc                 edx
            //   00a06a4200f8         | add                 byte ptr [eax - 0x7ffbd96], ah

        $sequence_3 = { 0028 fa 41 0014b4 42 }
            // n = 5, score = 200
            //   0028                 | add                 byte ptr [eax], ch
            //   fa                   | cli                 
            //   41                   | inc                 ecx
            //   0014b4               | add                 byte ptr [esp + esi*4], dl
            //   42                   | inc                 edx

        $sequence_4 = { b9???????? ffe1 ba???????? b9???????? ffe1 ba???????? b9???????? }
            // n = 7, score = 200
            //   b9????????           |                     
            //   ffe1                 | jmp                 ecx
            //   ba????????           |                     
            //   b9????????           |                     
            //   ffe1                 | jmp                 ecx
            //   ba????????           |                     
            //   b9????????           |                     

        $sequence_5 = { 000e 6c 74ff f5 }
            // n = 4, score = 200
            //   000e                 | add                 byte ptr [esi], cl
            //   6c                   | insb                byte ptr es:[edi], dx
            //   74ff                 | je                  1
            //   f5                   | cmc                 

        $sequence_6 = { ff05???????? 000d???????? 04b8 fe04e4 fd 04e0 fd }
            // n = 7, score = 200
            //   ff05????????         |                     
            //   000d????????         |                     
            //   04b8                 | add                 al, 0xb8
            //   fe04e4               | inc                 byte ptr [esp]
            //   fd                   | std                 
            //   04e0                 | add                 al, 0xe0
            //   fd                   | std                 

        $sequence_7 = { 00dc 7442 000477 42 0028 }
            // n = 5, score = 200
            //   00dc                 | add                 ah, bl
            //   7442                 | je                  0x44
            //   000477               | add                 byte ptr [edi + esi*2], al
            //   42                   | inc                 edx
            //   0028                 | add                 byte ptr [eax], ch

        $sequence_8 = { 00e8 dd7000 008bf98b5d1c 8d4de4 }
            // n = 4, score = 100
            //   00e8                 | add                 al, ch
            //   dd7000               | fnsave              dword ptr [eax]
            //   008bf98b5d1c         | add                 byte ptr [ebx + 0x1c5d8bf9], cl
            //   8d4de4               | lea                 ecx, [ebp - 0x1c]

        $sequence_9 = { 00d1 6848007269 48 00856948008b }
            // n = 4, score = 100
            //   00d1                 | add                 cl, dl
            //   6848007269           | push                0x69720048
            //   48                   | dec                 eax
            //   00856948008b         | add                 byte ptr [ebp - 0x74ffb797], al

        $sequence_10 = { 0108 eb5a 8b4508 83ceff }
            // n = 4, score = 100
            //   0108                 | add                 dword ptr [eax], ecx
            //   eb5a                 | jmp                 0x5c
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   83ceff               | or                  esi, 0xffffffff

        $sequence_11 = { 0108 8b442410 891e 894604 }
            // n = 4, score = 100
            //   0108                 | add                 dword ptr [eax], ecx
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]
            //   891e                 | mov                 dword ptr [esi], ebx
            //   894604               | mov                 dword ptr [esi + 4], eax

        $sequence_12 = { 00d1 6848004069 48 00d1 }
            // n = 4, score = 100
            //   00d1                 | add                 cl, dl
            //   6848004069           | push                0x69400048
            //   48                   | dec                 eax
            //   00d1                 | add                 cl, dl

        $sequence_13 = { 000f b681 fc b84500ff24 }
            // n = 4, score = 100
            //   000f                 | add                 byte ptr [edi], cl
            //   b681                 | mov                 dh, 0x81
            //   fc                   | cld                 
            //   b84500ff24           | mov                 eax, 0x24ff0045

        $sequence_14 = { 00e8 f61c00 008bd9895df0 8b451c }
            // n = 4, score = 100
            //   00e8                 | add                 al, ch
            //   f61c00               | neg                 byte ptr [eax + eax]
            //   008bd9895df0         | add                 byte ptr [ebx - 0xfa27627], cl
            //   8b451c               | mov                 eax, dword ptr [ebp + 0x1c]

        $sequence_15 = { 00856948008b ff558b ec 83ec0c }
            // n = 4, score = 100
            //   00856948008b         | add                 byte ptr [ebp - 0x74ffb797], al
            //   ff558b               | call                dword ptr [ebp - 0x75]
            //   ec                   | in                  al, dx
            //   83ec0c               | sub                 esp, 0xc

    condition:
        7 of them and filesize < 1867776
}
[TLP:WHITE] win_webmonitor_w0   (20200304 | Revcode RAT)
rule win_webmonitor_w0 {
    meta:
        description = "Revcode RAT"
        author = "James_inthe_box"
        reference = "ee1b9659f2193896ce3469b5f90b82af3caffcba428e8524be5a9fdf391d8dd8"
        date = "2020/02"
        maltype = "RAT"
        source = "https://pastebin.com/M2k5Vg3c"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor"
        malpedia_version = "20200304"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""

    strings:
        $string1 = "SCREEN_STREAM_START"
        $string2 = "CLIPBOARD_SET"
        $string3 = "SERVICES_RESUME"
        $string4 = "KEYLOG:"
        $string5 = "WEBCAM_DRIVERS"
        $string6 = "image.bmp" wide
        $string7 = "APPACTIVATE" wide
 
    condition:
        all of ($string*)
}
Download all Yara Rules