Extracted

• • Target
    MasonClient.exe
  • Size 48KB
  • SHA256 71ae22232fb000d7477e463e5f0d0c51b697a7338ed78f8e555c856caadc9a50
  • MD5 60f14f43c775c213144030bb3bda3cad
  • SHA1 a4706da56f6612df7d474d719daaabeda50f1f67
  • SHA512 8b6cf4094f8780e00fe0bd28ce5d9ca1ee4435a47500d1e0a26253e92bc3fbb6f993ea7dc8ac2d4d60f37ceea4788843a4771fac96da09376fe64ddce53d049c
  • SSDEEP 1536:+c3NH8Cd/1+zqck7UnGK0FXGlNsWvhBbgmRM3PSqbSTL63LbOxw:+c9H8ud+zqck7UnGK0FXGlNsqhBbq/Sk
  • TLSH
    T15F23B59CA3D94031D4BF66B61E63520893B4BAA38467D79F7CC401CA2726B95CB41EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables RegEdit via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1