SYMBOLCOMMON_NAMEaka. SYNONYMS
win.webmonitor (Back to overview)

WebMonitor RAT

aka: RevCode
URLhaus        

On its website, Webmonitor RAT is described as 'a very powerful, user-friendly, easy-to-setup and state-of-the-art monitoring tool. Webmonitor is a fully native RAT, meaning it will run on all Windows versions and languages starting from Windows XP and up, and perfectly compatible with all crypters and protectors.'
Unit42 notes in their analysis that it is offered as C2-as-a-service and raises the controversial aspect that the builder allows to create client binaries that will not show any popup or dialogue during installation or while running on a target system.

References
2020-11-16Trend MicroTrendmicro
@online{trendmicro:20201116:malicious:b459c3f, author = {Trendmicro}, title = {{Malicious Actors Target Comm Apps such as Zoom, Slack, Discord}}, date = {2020-11-16}, organization = {Trend Micro}, url = {https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-actors-target-comm-apps-such-as-zoom-slack-discord}, language = {English}, urldate = {2020-11-19} } Malicious Actors Target Comm Apps such as Zoom, Slack, Discord
WebMonitor RAT
2020-09-04KrabsOnSecurityMr. Krabs
@online{krabs:20200904:bitrat:bd0d3cd, author = {Mr. Krabs}, title = {{BitRAT pt. 2: Hidden Browser, SOCKS5 proxy, and UnknownProducts Unmasked}}, date = {2020-09-04}, organization = {KrabsOnSecurity}, url = {https://krabsonsecurity.com/2020/09/04/bitrat-pt-2-hidden-browser-socks5-proxy-and-unknownproducts-unmasked/}, language = {English}, urldate = {2020-09-05} } BitRAT pt. 2: Hidden Browser, SOCKS5 proxy, and UnknownProducts Unmasked
BitRAT WebMonitor RAT
2020-02-04RevCode
@online{revcode:20200204:revcode:bb6d2b3, author = {RevCode}, title = {{RevCode RAT}}, date = {2020-02-04}, url = {https://revcode.se/product/webmonitor/}, language = {English}, urldate = {2020-02-07} } RevCode RAT
WebMonitor RAT
2019-04-22KrebsOnSecurityBrian Krebs
@online{krebs:20190422:whos:2004970, author = {Brian Krebs}, title = {{Who’s Behind the RevCode WebMonitor RAT?}}, date = {2019-04-22}, organization = {KrebsOnSecurity}, url = {https://krebsonsecurity.com/2019/04/whos-behind-the-revcode-webmonitor-rat/}, language = {English}, urldate = {2020-01-13} } Who’s Behind the RevCode WebMonitor RAT?
WebMonitor RAT
2018-04-13Palo Alto Networks Unit 42Mike Harbison, Simon Conant
@online{harbison:20180413:say:920b109, author = {Mike Harbison and Simon Conant}, title = {{Say “Cheese”: WebMonitor RAT Comes with C2-as-a-Service (C2aaS)}}, date = {2018-04-13}, organization = {Palo Alto Networks Unit 42}, url = {https://researchcenter.paloaltonetworks.com/2018/04/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/}, language = {English}, urldate = {2019-12-20} } Say “Cheese”: WebMonitor RAT Comes with C2-as-a-Service (C2aaS)
WebMonitor RAT
Yara Rules
[TLP:WHITE] win_webmonitor_auto (20230715 | Detects win.webmonitor.)
rule win_webmonitor_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.webmonitor."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 00e8 17 42 0048a5 }
            // n = 4, score = 200
            //   00e8                 | add                 al, ch
            //   17                   | pop                 ss
            //   42                   | inc                 edx
            //   0048a5               | add                 byte ptr [eax - 0x5b], cl

        $sequence_1 = { 06 000b 3a58ff 1b03 fd 006cff1e }
            // n = 6, score = 200
            //   06                   | push                es
            //   000b                 | add                 byte ptr [ebx], cl
            //   3a58ff               | cmp                 bl, byte ptr [eax - 1]
            //   1b03                 | sbb                 eax, dword ptr [ebx]
            //   fd                   | std                 
            //   006cff1e             | add                 byte ptr [edi + edi*8 + 0x1e], ch

        $sequence_2 = { ff01 04e0 fd 0512002413 }
            // n = 4, score = 200
            //   ff01                 | inc                 dword ptr [ecx]
            //   04e0                 | add                 al, 0xe0
            //   fd                   | std                 
            //   0512002413           | add                 eax, 0x13240012

        $sequence_3 = { 3a58ff 2503fd006c ff1e e00e 000e }
            // n = 5, score = 200
            //   3a58ff               | cmp                 bl, byte ptr [eax - 1]
            //   2503fd006c           | and                 eax, 0x6c00fd03
            //   ff1e                 | lcall               [esi]
            //   e00e                 | loopne              0x10
            //   000e                 | add                 byte ptr [esi], cl

        $sequence_4 = { 6c 68ff080800 8a3401 a3???????? 0800 }
            // n = 5, score = 200
            //   6c                   | insb                byte ptr es:[edi], dx
            //   68ff080800           | push                0x808ff
            //   8a3401               | mov                 dh, byte ptr [ecx + eax]
            //   a3????????           |                     
            //   0800                 | or                  byte ptr [eax], al

        $sequence_5 = { 000d???????? 04e4 fd 0468 ff05???????? }
            // n = 5, score = 200
            //   000d????????         |                     
            //   04e4                 | add                 al, 0xe4
            //   fd                   | std                 
            //   0468                 | add                 al, 0x68
            //   ff05????????         |                     

        $sequence_6 = { ff05???????? 000d???????? 04b8 fe04f4 }
            // n = 4, score = 200
            //   ff05????????         |                     
            //   000d????????         |                     
            //   04b8                 | add                 al, 0xb8
            //   fe04f4               | inc                 byte ptr [esp + esi*8]

        $sequence_7 = { ffe1 ba???????? b9???????? ffe1 }
            // n = 4, score = 200
            //   ffe1                 | jmp                 ecx
            //   ba????????           |                     
            //   b9????????           |                     
            //   ffe1                 | jmp                 ecx

        $sequence_8 = { 00e8 dd7000 008bf98b5d1c 8d4de4 }
            // n = 4, score = 100
            //   00e8                 | add                 al, ch
            //   dd7000               | fnsave              dword ptr [eax]
            //   008bf98b5d1c         | add                 byte ptr [ebx + 0x1c5d8bf9], cl
            //   8d4de4               | lea                 ecx, [ebp - 0x1c]

        $sequence_9 = { 00e8 f61c00 008bd9895df0 8b451c }
            // n = 4, score = 100
            //   00e8                 | add                 al, ch
            //   f61c00               | neg                 byte ptr [eax + eax]
            //   008bd9895df0         | add                 byte ptr [ebx - 0xfa27627], cl
            //   8b451c               | mov                 eax, dword ptr [ebp + 0x1c]

        $sequence_10 = { 0108 eb5a 8b4508 83ceff }
            // n = 4, score = 100
            //   0108                 | add                 dword ptr [eax], ecx
            //   eb5a                 | jmp                 0x5c
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   83ceff               | or                  esi, 0xffffffff

        $sequence_11 = { 0108 8b442410 891e 894604 }
            // n = 4, score = 100
            //   0108                 | add                 dword ptr [eax], ecx
            //   8b442410             | mov                 eax, dword ptr [esp + 0x10]
            //   891e                 | mov                 dword ptr [esi], ebx
            //   894604               | mov                 dword ptr [esi + 4], eax

        $sequence_12 = { 00d1 6848007269 48 00856948008b }
            // n = 4, score = 100
            //   00d1                 | add                 cl, dl
            //   6848007269           | push                0x69720048
            //   48                   | dec                 eax
            //   00856948008b         | add                 byte ptr [ebp - 0x74ffb797], al

        $sequence_13 = { 00d1 6848004069 48 00d1 }
            // n = 4, score = 100
            //   00d1                 | add                 cl, dl
            //   6848004069           | push                0x69400048
            //   48                   | dec                 eax
            //   00d1                 | add                 cl, dl

        $sequence_14 = { 000f b681 fc b84500ff24 }
            // n = 4, score = 100
            //   000f                 | add                 byte ptr [edi], cl
            //   b681                 | mov                 dh, 0x81
            //   fc                   | cld                 
            //   b84500ff24           | mov                 eax, 0x24ff0045

        $sequence_15 = { 00856948008b ff558b ec 83ec0c }
            // n = 4, score = 100
            //   00856948008b         | add                 byte ptr [ebp - 0x74ffb797], al
            //   ff558b               | call                dword ptr [ebp - 0x75]
            //   ec                   | in                  al, dx
            //   83ec0c               | sub                 esp, 0xc

    condition:
        7 of them and filesize < 1867776
}
[TLP:WHITE] win_webmonitor_w0   (20200304 | Revcode RAT)
rule win_webmonitor_w0 {
    meta:
        description = "Revcode RAT"
        author = "James_inthe_box"
        reference = "ee1b9659f2193896ce3469b5f90b82af3caffcba428e8524be5a9fdf391d8dd8"
        date = "2020/02"
        maltype = "RAT"
        source = "https://pastebin.com/M2k5Vg3c"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webmonitor"
        malpedia_version = "20200304"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""

    strings:
        $string1 = "SCREEN_STREAM_START"
        $string2 = "CLIPBOARD_SET"
        $string3 = "SERVICES_RESUME"
        $string4 = "KEYLOG:"
        $string5 = "WEBCAM_DRIVERS"
        $string6 = "image.bmp" wide
        $string7 = "APPACTIVATE" wide
 
    condition:
        all of ($string*)
}
Download all Yara Rules