Extracted

• • Target
    MasonClient.exe
  • Size 84KB
  • SHA256 0f334c5f01b11906f55d1868d226c9ef186b956c8993f66567a0467eb8c934ac
  • MD5 66692d5792d39aa66ba44bed52568b04
  • SHA1 6239fd069ac533cb2c883e1a1b2389e8dd66367c
  • SHA512 5d26313ccee745d708be5dafe737e2faafaf0b99a1cc62cf7973e1095cb0fbcfbf177d12fde8df4c5852ccd8f3f128c03ee3f676dc281bf7905643cb0f21f5c4
  • SSDEEP 1536:NrZAJlAioUBdFw5uxcoB0A2zFM1iv1ePC9mKT1sR6mYAvJQzXICrDrbD:NrZALAitOoSmnaT1s3YKQj3r/
  • TLSH
    T12C83F19736AE218AC4BAFBBA464C160719DB7FC1C77590573CC5C9C2A84C1D04B9B9B3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executiondonutloaderneptuneratloaderpersistencetrojanbootkitdefense_evasiondiscovery

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4