Extracted

• • Target
    MasosnClient.exe
  • Size 49KB
  • SHA256 f6fc76f47e5ac1ea1abd9ba9b8f826e54ab2ee402b7d4f2a87eb779b5984d9b2
  • MD5 c6f372194be6157cb39d5cdb7e3d1f4e
  • SHA1 157384ccfc1085c64be788d6e97b8b4d99cbb5f8
  • SHA512 1a32d6f4274a2db7a1052997e1ed50dbb06a3c070ef6898ebdda316014e656686ec4d6fe9b55f7f355f4edbb8157d77729941cbc3971963a442800a1a07da7ba
  • SSDEEP 1536:wTlDDWhWZV1HaAKwGRXlVtYPUx217dSn/39Mab1GvgbOEU:wRDDWEV1HaAKwGRXDtYPUx217dkNb1vq
  • TLSH
    T13F33E79DA3D84131E4BF56B25D77424883B0BAA38466D79F7CC405CA2723B95CA42EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdiscoveryexecutionneptuneratpersistenceprivilege_escalationransomwaretrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1