Extracted

• • Target
    EntropyVisual.exe
  • Size 174KB
  • SHA256 98949a7ab21c8981302f801e635a90dac71b6d64f15cbe5a321cc27fa402bd9b
  • MD5 7c76b18b9e72b12d6ab87feaa86d101a
  • SHA1 e62ea51cf6e50114f408977eac42d3591b5712e4
  • SHA512 8beca51ba748f2f12efaa2fad3c9afae1932b9b2188388b47ff1d89a6b42bf68b84266ea9049a4aa4fa067e933a87f244abed5872e9d0a0e4976f4151564b321
  • SSDEEP 3072:93ix/Yps7EZEHqRBLGjTCpXVvinh+emJoe80y0XWbTFjp/yjgf6yFOBE:t+QnEKnCyHqY+0BWbTLqm6ysBE
  • TLSH
    T172040213F6B540D5EB92D9B9DC28971BFB74799983109EEB33748A120A435E0FB2439C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderneptuneratloaderpersistencetrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • ConfuserEx .NET packer

    Detects ConfuserEx .NET packer.

  behavioral1