Extracted

• • Target
    2026-05-31_625f154c4c06f24654b2140778e2364a_cobalt-strike_icedid_luca-stealer_njrat
  • Size 205KB
  • SHA256 eefcaf150ba268a65a124d30c90a4f45f58ec9ee68a2afa664d0fbf59112f29c
  • MD5 625f154c4c06f24654b2140778e2364a
  • SHA1 03d38d9002119c390713168c34d0fc0382700a5d
  • SHA512 9b516ba4b69e5424a06e2411164469c9fc349154286a9e240e4e23e0e60c63230b1c94c51adc50ff3d26f44c22dac589aa2012330252f5b1436bae43ac0e9a70
  • SSDEEP 3072:yW4PjkP2DdTRrlCcJPsRjNyHeBGBuUB+9cRiophq3zok1gIxP:EPjkPQRkcaNka6l+HT9
  • TLSH
    T13F24BE5573A50CFAE9B78239C8205A46E6727C154BA0EBDF03A44766EF232D14D3FB21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Detects Windows executables referencing non-Windows User-Agents

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2