Extracted

• • Target
    xwormExploit.exe
  • Size 213KB
  • SHA256 554b930e81f252ff6b23d84fa654514d141acf0a5382a5ca5c329347a9eb5b1c
  • MD5 fbd756912a412ad43b06058a99bcad85
  • SHA1 12636e42c77420b2fb9d6025d0675f6550c4ac25
  • SHA512 e85f3c0e4ca8957dd88420a3300dd044ee3eeeaf42ee07582492d56f48fea9c97a4b32f966a23f2695ab395984102784b66b6e189bee8d8b469e8ab698df299a
  • SSDEEP 3072:XO9F6KpaVEM5tKFmbsS31Kl5WZEF31+6ONoybTjYSSrbih3eeFthE0ekRtcNs3P/:XLKpm5sF4tfKFMrCejYX+VFtLH13l
  • TLSH
    T18624124AFAEEAD42C99B09F0A572024063B5FA26170ED6DB39E04DE67CCB7700151BCC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  neptunerattrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2behavioral3behavioral4