813627329ddd21cfa3419470318fbb490734c5682cff073770d13e1cd681a0c6

Sharing

Copy URL Twitter E-mail

General

Target
NeptuneRAT 5.0 (2).zip
Size 1.2MB
Sample260717-ramdaagw8v
SHA256 813627329ddd21cfa3419470318fbb490734c5682cff073770d13e1cd681a0c6
MD5 1c0e7d293e0a14834a605c5dc5799ce8
SHA1 747dc63498f1082fef894d0a37a21ee702b48ac4
SHA512 32b08cda37609aede059739736aab31134e45fe3f008831744d35016024bd2d1079294136cbef8de6631acdc512e967fc2d13c7d22cdaf5f6844f756d272e248
SSDEEP 24576:UE1zoqL5K/8DiFCPr/XnCKUituyj5j0XXaLEDOqZm1Xeyl:vMqM/8DiFQrNfjaXqLEDDw9eyl
TLSH
T1A6453363BB8E5DB0ED773175108E368C7CFED15568035C0E960B7A242179DB3A2BB642
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Targets

- Target
  NeptuneRAT 5.0 (2).zip
- Size 1.2MB
- SHA256 813627329ddd21cfa3419470318fbb490734c5682cff073770d13e1cd681a0c6
- MD5 1c0e7d293e0a14834a605c5dc5799ce8
- SHA1 747dc63498f1082fef894d0a37a21ee702b48ac4
- SHA512 32b08cda37609aede059739736aab31134e45fe3f008831744d35016024bd2d1079294136cbef8de6631acdc512e967fc2d13c7d22cdaf5f6844f756d272e248
- SSDEEP 24576:UE1zoqL5K/8DiFCPr/XnCKUituyj5j0XXaLEDOqZm1Xeyl:vMqM/8DiFQrNfjaXqLEDDw9eyl
- TLSH
  T1A6453363BB8E5DB0ED773175108E368C7CFED15568035C0E960B7A242179DB3A2BB642
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  NeptuneRAT 5.0/NeptuneRAT.5.0.exe
- Size 304KB
- SHA256 f13bd5b1b415ea7c3ab97c18d4f509a7af2122727fc64a61b3b7bd661eb1bdc9
- MD5 0be424b78ff76c24c9d63956f74c041d
- SHA1 df61ef338d82e45cb63229b952bd6df5ce0d1d51
- SHA512 6fcda4e02ca23c9e97bb049cc620f2fb85ef0d46a7f81cf1032a7764a19a5d076234c99f9eb292e68c8ed5ce908350a0e83112583542750bd949f55f830625dc
- SSDEEP 6144:R1WYcygEBwZYI0V84nbJ3oGQ4QsBcqcxYbcPGbUPI:Rh0EoYI6/nF3jcs+qzIew
- TLSH
  T10E64D0217AD0C5B1D4B7043148F4EAB94A7DF8750B119DEF2388277E4A243D19A36AEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral3 behavioral4
- Target
  NeptuneRAT 5.0/Plugins/ACTWindows.dll
- Size 10KB
- SHA256 2eb4052edbb4ab611e3ba9d8bca13c16ecf2f15735c067f6166b72405941aa27
- MD5 e868c10d267e8f5daa0b22e6976f072f
- SHA1 e9b542466b950132e53f43db1a451d19e43e4cb5
- SHA512 4e4d35beb5cbdcda55072e22c7784d47f19e97be24c022e2d1802d4b2117f033b4f133cd0ee1bb8cb00519e5e60bec4f97afb4705c04285b95a7f7e0c58ebc3c
- SSDEEP 192:V29alCi98OgSwNxyPlaMrp5O+Rx71tvTkIW1PnZLFzSTSQMLuOF:V/lCi987HyNHrpw+5tvTunZxzMSQOF
- TLSH
  T10222096957E08335CDFB0AB3585397510774CA08D913FB6F18D8B046EDA326987E2729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  NeptuneRAT 5.0/Plugins/Install.dll
- Size 10KB
- SHA256 6cb5a6c1e0fda7f764de99f62cf58d26b514523a339d1b26ca7fbead7eb0435f
- MD5 207b83beb3e1fa8579ebac63dace1731
- SHA1 83ad53b7f24f1aa55ea66e559e20c985ba5416ec
- SHA512 3651dbd8e948ffbdccd3e3d54c0f4fc2fdd207769ca4823d441bd36ba0f1dbd742edbd53f8666a9aa6806b306d42ca147d6459cc629283688409752780e4f415
- SSDEEP 192:mJklM7hSMO340nynmQbKGOibaz1hbBIW1UM/uUOa9nxJwLWM:mJsMhOLnyZ3XbOhbYM/19nxJM
- TLSH
  T144222B15ABD042B5C8BE0F769C63160147B2E705CD23FB3E69E4A2194CA33658BB1AB1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  NeptuneRAT 5.0/Plugins/KillCPU.dll
- Size 11KB
- SHA256 0e3e6d4e0b7e0590737c1c807903810dd352951543a91e3cc4c2942b8c1b9d2d
- MD5 9b1164bd19a288b3cab77469a8978703
- SHA1 cebfa54ea39d0589f622ff171e8f047ea7e33182
- SHA512 b2106a1e3aeb686b580f8b5692c3bf1ccec62f450cf7ffd3b5758a2111eee35e286070848d9c30a33b6ab29f712883c5941d3f70164639176421eeaf9a2e7ef1
- SSDEEP 192:OX82FapXzhMh1NmEgAEGNwfOjLKJ1iqSIW1Un/KxT+ubdjTlHLW2N:OsN9Mh1LgpUw48iq7n/GquZjY2N
- TLSH
  T12C321A26A3D44379C8ED0AF64C3373434731D7088913FB7E68D4A9251EBB25856E2FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  NeptuneRAT 5.0/Plugins/KillProcess.dll
- Size 14KB
- SHA256 bfefe85ead82555fd68a53eaba9d1604810212b2a4435a8dc309038e7e3a692e
- MD5 0eb00d04c332e45c6952470362c80d1a
- SHA1 8b0325077d13535344637acfbb0791184cc941fd
- SHA512 be554ef76382967907ca075a6d0c24f546f4b648be4bbfbbec64b3fe1aedf74ff1f42c5a306d6a164328d2672cdcbbf4e74e76bc1cedf06800d5d87e44803149
- SSDEEP 384:91ksD8g86Fx5XYydeLojb8kWMGdpAxs5ezuyWkt:5zLPXYsGPezug
- TLSH
  T11762F99853E04535E27E6FB51972A20047B3FE069C52FA5D4980F18E5EB3358CBE1A3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  NeptuneRAT 5.0/Plugins/LockApplications.dll
- Size 10KB
- SHA256 20a28a50e694f840461a2b7a089114d6356af61a097fefc36727a9c2d395ba4b
- MD5 8183c705b0b6161270cbf9156be74d73
- SHA1 1332b8b5c54d2ba20cd2dc713f6abd4b9562bdac
- SHA512 725530e11a33a7503826d7660cbb258ca429f06c6684b4f7abe7b96cfedef93b38fd946fd1e6f1aead9e0133506fecca14df8509638e67f297a0eace4ff55905
- SSDEEP 192:R7QHqDQqpMrGO5ib1EiTxIW1Pn/+kMpC0ewL2H:RWqH+qqwFTbn/+kMpC0iH
- TLSH
  T1AA22E925E7E44275DDFB1B726CA362410775FD088D23B72F1DC4B0661CA36958BA2B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  NeptuneRAT 5.0/Plugins/Maps.dll
- Size 15KB
- SHA256 06a1d45ff28850115c36fbc110d361bbb0ac224958de86c09cbb0c4826d4f045
- MD5 db403de3e2cd0cfe89112684e34b278e
- SHA1 c9cd8326a6fed612a9143e296b951a86021ad8b5
- SHA512 4a28f6c4873ddf2ec35dfa8e45a4157a0a37b7d8aca953690cffeecddc53e84cb3affef72dab14c48047ce0b7ea5744ca32c492380f801020d21495ef9ecdf9c
- SSDEEP 192:O4/n3oEIh6xL40Xhzpa0hZWB1jxjX7kNN56gGte31HCKM6IW14X/b8YIF3tAJLur:VngcV40X/l4jcPyteFiKsX/bSt9o2
- TLSH
  T1A6621955B7E4C272C6FE1FB64C72A20047B6E605CD07FF2EA5C860694A63792CE60727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  NeptuneRAT 5.0/Plugins/Microphone.dll
- Size 539KB
- SHA256 4492aecda17cd5a31be59a3fba0ccd06c63f0a0b7773a8a83e6831c2ebe06001
- MD5 b7134dfd9e5dbe9e36740c9114f66c79
- SHA1 bd0fefadd74aff707db640638d66cae2f26ca03c
- SHA512 80aa15f717e915082dfefc3dcb02c1bcb400bc60a9cee991172b5ff5415da27b861ce9b1da113e172492b0bd7bb7ad13a8bf46eac2795913a4ee0b16bd419fe2
- SSDEEP 12288:ocHij8LgXvwMZEvBFbgBqDvoNvfv3FSu:jHipXvF2vDbgBSvoK
- TLSH
  T155C46C15BBD49527E06F3772E0E20F2E57B4E48AB316EB8F449097E85E937464C40BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  NeptuneRAT 5.0/Plugins/NAudio.dll
- Size 502KB
- SHA256 81b3f1dc3f1eac9762b8a292751a44b64b87d0d4c3982debfdd2621012186451
- MD5 3b87d1363a45ce9368e9baec32c69466
- SHA1 70a9f4df01d17060ec17df9528fca7026cc42935
- SHA512 1f07d3b041763b4bc31f6bd7b181deb8d34ff66ec666193932ffc460371adbcd4451483a99009b9b0b71f3864ed5c15c6c3b3777fabeb76f9918c726c35eb7d7
- SSDEEP 6144:96/i10SZtfzWctj98vZcE0wmLlaIZs5eku2sX2hrjAzvgmXa6W9FwsT9idwktQZG:9yrSKMJR9aGs55T1X9Fwspi2tGpmS
- TLSH
  T156B45C2237E4962BD1AF5775E4E1191B8BB1F8423237D78F8684BB6E1D837924C407A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  NeptuneRAT 5.0/SimpleObfuscator.dll
- Size 1.3MB
- SHA256 7caa6b9ff04aac89bcd324f73d96be3153a7456a0aad282d19f225e6473f5790
- MD5 a6314905fef88e334b24951c87d5fa64
- SHA1 8ec7aaf6a8e350099b62a8d2510b81f1e0882e2c
- SHA512 ea4b7ee050a218ed4fc411c2147eac9d219a9f274676ceb59868bc6d74f26a60f1c92cee8ba415dc24792c5261526750dd821ffc470035432363255c998589ed
- SSDEEP 24576:OB4F9bgtOr7iZVrnLuKYT9g+16hRrfh/v7fYm:OB4F9bIVZVrnLuKYT9g+0lT
- TLSH
  T1A2554A50B7ECDE37D16E0B75A4B005241BF5D406B323EB8F1A68A6F86D53B016C492BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  NeptuneRAT 5.0/System.Security.AccessControl.dll
- Size 30KB
- SHA256 aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
- MD5 2d3e0b4ddf8628b41057b2aceef296eb
- SHA1 8a3b1bd9df5d052c24de2304a2928fad86927f6d
- SHA512 faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
- SSDEEP 384:3RFGaTHrxhDRtGP/Ksmvt4kyvaMAdB+w3G5h9M9ZV3Mfpcrqmf9wEJqIxVRvFNgp:hAajzDRtGUl4kdWBkyHp98I
- TLSH
  T1FCD2C501ABF81159FAFB4B707AB99E121DBBFAD53D22C50C0514A19E59A2F90CA31733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  NeptuneRAT 5.0/System.Security.Principal.Windows.dll
- Size 14KB
- SHA256 c3ae599b5218516915f6542779ef577d5ad5de3d84a116e671c09e15e4591285
- MD5 b40bda63658a012d46f930c243b77056
- SHA1 2aed74577f5f623f7e910adda8ef74a11eea0437
- SHA512 6c60d39858788775e265476b309a04bd8ab6054b30aa37199f199f19907aa103a68fe28cad4db22b2d7091f31448b0d1ab1f54ea7db78735af9a8b5356961734
- SSDEEP 192:oQqIMZJxX3x4YjjEHxj7ligqWFLpW0W65FdQHnhWgN7aJeWyDM0884LfqnajOdoG:3qIAh4YvUqWFLpWGQHRN7WbJlqdo1sl
- TLSH
  T1C56239A1CBE84113EDB32E7056B6C6833C3DE3E7295246671AD1F1492CA33C5CB1022E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

.NET Reactor proctector

Looks up external IP address via web service

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26