Rewterz Threat Alert – WebMonitor RAT Bundled with Zoom Installer

Severity

High

Analysis Summary

Several types of cyber attacks have been seen targeting the remote collaboration app Zoom, as work from home brings a surge in active installations. Earlier, coinminers have also been bundled with the Zoom installer. Recently, another campaign was reported that bundles the WebMonitor RAT with the Zoom Installer. Note that although the installers are legitimate, the ones bundled with malware do not come from official sources of the Zoom app like Zoom’s own download center or legitimate app stores such as the Apple App Store and Google Play Store. They instead come from malicious sources. We also note that the Zoom app has been updated to version 5.0.cybercriminals may have repackaged the legitimate installers with WebMonitor RAT and released these repackaged installers in malicious sites.When running the ZoomInstaller.exe, it drops a copy of itself named Zoom.exe. ZoomInstaller.exe will then open the process notepad.exe to run Zoom.exe.

The backdoor connects to the URL dabmaster[.]wm01[.]to and executes commands from a remote malicious user, some of which are listed below (for the full list, please refer to our malware report):

• Add, delete, and change files and registry information
• Close connections
• Get software and hardware information
• Get webcam drivers/snapshot
• Record audio and log keystrokes
• Start, suspend, and terminate processes and services
• Start/stop screen stream
• Start/stop Wireless Access Point

It terminates itself when executed in the following virtual environments:

• Kernel-based Virtual Machine
• Microsoft Hypervisor
• Parallels Hypervisor
• VirtualBox
• VMware
• Xen Virtual Machine Manager

It also terminates itself if it finds a file name similar to any of the following:

• Malware
• Sample
• Sandbox

Since the system downloaded a legitimate Zoom application version (4.6), it won’t make the users suspicious.

Impact

• Unauthorized Remote Access
• Data exfiltration
• Data manipulation
• Process termination

Indicators of Compromise

Hostname

dabmaster[.]wm01[.]to

MD5

c3973cd1e3ee7ab64b6ebeed5f9caf08

SHA-256

753418831fcf215fe2d00ed33b9d2f1ed78bc92355e780c782fb35228007318e

SHA1

b3b75d04355c38b265ac8d7a5f033b58fd138c17

Source IP

213[.]188[.]152[.]96

URL

https[:]//213[.]188[.]152[.]96/recv7[.]php

Remediation

• Block the threat indicators at their respective controls.
• Do not download software from any source other than the official source.
• Keep all software updated to latest patched versions.