Extracted

• • Target
    MasonClient.exe
  • Size 48KB
  • SHA256 84054e6d693aa9355ec23e01fe58f4ccfe44cfa61010cd5b4f069997122ad835
  • MD5 46ada4eaff4635ba5c48545ef181b305
  • SHA1 91ff8e567bd94c834bb077aaf49792f2dd8c1161
  • SHA512 3292a165db4d784bd16ffd51970c9bc5b75ba2be7eefad1765ad8b1e0450fc5f64b50e6c4b8b60803110682e8eddde2f7d0d5effff3b0338def17ca6b7537556
  • SSDEEP 768:R5zmUtNG0SsyKu445t39iByijMbbupxbnYvhVaNehLOy19mKw:RJm8wXKu39SZSbu7mhf1OY9mKw
  • TLSH
    T18B231989FBB69020C8BF5AF118B70349D2B27A936816C61E7DD841CA1727FC59250EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionneptuneratpersistencetrojanbootkitdiscoveryransomwarespywarestealer

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3