Extracted

Extracted

• • Target
    eaa.exe
  • Size 2.9MB
  • SHA256 483167a861fe737dc2c60534033e147bdf17363e6a21e44650a2ac9997f0982f
  • MD5 354695f7d8c42402a837ac224f540089
  • SHA1 0165d0475b8c5c0e6596d584886d43cef76143a2
  • SHA512 cd51e9d2a1cbe31ef725b206d2e2623bf5b9a9ecf38acf987d60c779d6f18b136c3491efeefb5265b5ad25e8cbef5c18484478ede8aff1179ea9841d864b63ef
  • SSDEEP 24576:cIA6KJKAVOqRvxhndXq7mvqj6UwA6KJKAVOqRvxhndXq7mvqj6U:NQLvwlwQLvwl
  • TLSH
    T14DE5382439FB502AB173EFAA8BE479DADA6FB7333B0764591051038A4723981DDC153E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionneptunerattrojan

  • Detects NeptuneRAT stealer

  • NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Neptunerat family

    neptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2