Extracted

• • Target
    1a6575851bea34926857ca0e582fc92b171ff6858e0f56b0e15c1fd17def182d
  • Size 11.5MB
  • SHA256 1a6575851bea34926857ca0e582fc92b171ff6858e0f56b0e15c1fd17def182d
  • MD5 0a1c2cd66584cfa7ef168ae7f7e2cb01
  • SHA1 5a8a17f868a36af72656bbe729c86455fb92bfc5
  • SHA512 c54176823abac0c70a6901a4062339f337af1085b9eeca0eca0c7054103770ccfea301ca50c6818a6b2ab897c75aa8e87838374072dad7cbfe55ff8649f7f3d9
  • SSDEEP 196608:Zl6TkxrypePQVuLccvWh9Z/WtnGDae6iW6TINwcdpXkMwKAXWO0Kquc/0fo07ZwS:SiOpeP8uLfvu90EeeJP0NRdJkzXX0K0c
  • TLSH
    T1D8C633231BC49A7FF7ADC2E0FB1934FC17D51681BA9155F215848AE7B189CC4B280DBA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryneptuneratinstallertrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2