Extracted

• • Target
    dd.exe
  • Size 49KB
  • SHA256 78009293a1089c18fa20be29a60e91501a3add266af89bc8976644c41e8cf8b6
  • MD5 a78e12382ffec16374a44790e121a344
  • SHA1 af6165de55a8a466629bf542f8a3bc3de3213f35
  • SHA512 82bf45b691a5a664d0c805b54480355648f9b00799b0c89c4f06af7a5a7d8025bdea8d9c8223c3fb487a30642169515196a2662113e0e8dc33c6f4ba8b9c237f
  • SSDEEP 768:tS8pIBL47urcEg2XvZu71c+vMRIiLbRLUV3XHWWaA5EuhJOSH1bu3:tS8pItE17Z8lbRLU9HW6bOwu3
  • TLSH
    T16733F888B7A981B1C0FF5AB11E7393099AF076939416D60F7CD445CA2727B988A41FF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptunerattrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral10behavioral11behavioral12behavioral13behavioral14behavioral15behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9