Extracted

• • Target
    dwm.bat
  • Size 100KB
  • SHA256 bd2cc2f1f25b5f520a87068475247dd5611ab9f199ed3264983d720e016acf66
  • MD5 e418687e6ec9aeb05ede6bf976a658f3
  • SHA1 e0d6ec7cfe1882589507132d7b50669710534034
  • SHA512 0352c54a6fb73a4665786b819f043409b0e9d076522220b14152d969894134c86d15f51c6b21bf39f7e88f9621cb0bb28ea2d2336f7585fb8ebd34671cf871ac
  • SSDEEP 1536:NX2wyL+0enfRru/nOsxdArmEwiq9mXD6j8vk6r8pJO6oO6GD5ZpnVtLDptKpch7k:NX2wkonZruPOsMYmTFVqRo9K3VROeQtN
  • TLSH
    T148A3937ECFB5BCC8476BB499D94C2705B02E46C3D1A10BAEF88019934D08576DFBDA68
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptunerattrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Drops startup file

  behavioral1behavioral2