Extracted

• • Target
    Auto Clicker v1.exe
  • Size 34.3MB
  • SHA256 551a6a5f0c07da8a2ec01febb47a0b381f47c7f9444168e8ee28e984474b859b
  • MD5 2e51d734471f981c4d5d97be882147ee
  • SHA1 ea41ab36159d43f3d58db71f3ded337f6ec50cea
  • SHA512 43f537abc69b7e61755b3e774f2162d24f1df0030be67af51b15323c76de5cfa8f303c45b24ba7b360a4e2c3e31a7001bd15df8b6e6db9b51c78f383b440469c
  • SSDEEP 786432:83GwSEGCoW830A1QtIJ2j6+s7LWB75zuXVgiCuAHsMrwHNeNFRmqhx8:lwSEWWrMiIJ2qHWB75il4ZH5FsV
  • TLSH
    T1B487012439EB101DF3F3AABA5FD4B9AF9D5EF673270A20B9106103468722D81DD91739
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwaredefense_evasionexecutiondonutloaderneptuneratloaderpersistencepyinstallerspywaretrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2