Extracted

• • Target
    jkjkjkjkjkjkjk.exe
  • Size 49KB
  • SHA256 eb5ef0026d3daf3f76486c299d3e6fc147929baa36f048c27f71b65b3e29b9bc
  • MD5 b13a78a38f5994a37ac0fdd99592f06c
  • SHA1 1f1068c28c0d5dcfdaad5a7feb2697cb94c4ee4b
  • SHA512 5501dfed918f38c04bc197543cca31c146a185259502af71bcddb068ef8cc5c6a04a993630b5efe20f244b7b8567b2c270de0db2fa3f7e46f7c0deea05507aff
  • SSDEEP 1536:rzzMGRbaJuGVlw6Azand4iU0a1FZS+nbB2sesbOP0:rzzM2bYuGVlw6AzanmiU0a1FdbBgsbOs
  • TLSH
    T17433E88CE3E94131E4BF56B61D77424893B0BAA38466D79F7CC401CA2B26B95C641EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionneptuneratpersistenceprivilege_escalationtrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables Task Manager via registry modification

    defense_evasion

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1