Extracted

• • Target
    MasonClient bound.exe
  • Size 758KB
  • SHA256 d21ab9a64e894d162a54f508e45e2a912a893c6463a92c0f0fc4667fb237bd9f
  • MD5 72be3828a893607d25949601a6726176
  • SHA1 3aaeb82bc9aa51d955f5450aa951f8a2a7c321bf
  • SHA512 ef55d9e124dd85a80760005585b04118e828c4efc7cb6851606cdcc0557d85b3f349a91184b69b1ea9c9442615b1c3ac0d28b4c943ea97d03a5ab75a539934df
  • SSDEEP 12288:KzERGDUgLYAV6fIoMbVg8O3Fx9LGoI2g/:KWGD5LZVSIxVg8O3FbXC/
  • TLSH
    T1CBF44A4AF753A1BCD52BC1718BAB6633B932B81C4135797F4A14CB763EA1E500638F26
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutiondonutloaderneptuneratloaderpersistencetrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2