WEB MONITOR RAT FULL

The backdoor connects to the URL dabmasterwm01to and executes commands from a remote malicious user, some of which are listed below (for the full list, please refer to our malware report): ZoomInstaller.exe will then open the process notepad.exe to run Zoom.exe. When running the ZoomInstaller.exe, it drops a copy of itself named Zoom.exe. Here, ZoomInstaller.exe refers to the file that contains the combination of a non-malicious Zoom installer and RevCode WebMonitor RAT. The compromise starts with the user downloading the malicious file ZoomIntsaller.exe from malicious sources. For this particular instance, cybercriminals may have repackaged the legitimate installers with WebMonitor RAT and released these repackaged installers in malicious sites. Zoom is not the only app used for this type of threat, as many other apps have been used for this attack as well. Plenty of malware variants pose as legitimate applications to conceal their malicious intent.

We also note that the Zoom app has been updated to version 5.0.

They instead come from malicious sources. Note that although the installers are legitimate, the ones bundled with malware do not come from official sources of the Zoom app like Zoom’s own download center or legitimate app stores such as the Apple App Store and Google Play Store. We recently encountered a similar attack that drops a different malware: RevCode WebMonitor RAT (detected by Trend Micro as ). In early April, we spotted an attack leveraging Zoom installers to spread a cryptocurrency miner. We have witnessed threats against several messaging apps including Zoom. However, like they always do, cybercriminals are expected to exploit popular trends and user behavior. The coronavirus pandemic has highlighted the usefulness of communication apps for work-from-home (WFH) setups.

Web monitor rat