Extracted

• • Target
    607626fde0a0263edd41db4721523682cb343600ef083fc78f23f04ca8be04b1
  • Size 2.3MB
  • SHA256 607626fde0a0263edd41db4721523682cb343600ef083fc78f23f04ca8be04b1
  • MD5 120b148606efb6400aa3aeb9ce44a668
  • SHA1 e7488d6d0893c4d074f69718c8ee32da42d98207
  • SHA512 6a5888c08f9378805978f53fd01a93dcc7f202198c12e57376c794e3f60d04c1b67dd6f51156c2ded32ae318cf73baa2b9f811fe1e99de4ddc86ac35bc2a2a43
  • SSDEEP 49152:W1vr8uwYtUeKFj/c2e4r7XplKVZo0juLx1hZf18E2yujq3:W1freFj/c2e4rinaj8E2hg
  • TLSH
    T1CCB5235270D08072C463193629F8F7389E7EBD201F62A9CBA3C41B3B5F716D18769B5A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionneptuneratxmrigxwormminerpersistencerattrojan

  • Detect Xworm Payload

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2