Extracted

• • Target
    MasonClient.exe
  • Size 49KB
  • SHA256 3a6bd9692d767d01f3e9bc544a83049b3557e3ff2d0c52b34f11cf2a134329bb
  • MD5 09f2aa65f3ddb4d6879a34117fb93d25
  • SHA1 08521816451c4563adde90fefe87b4c4ef29228e
  • SHA512 a8194ea308c3724afafc9ee74d33fd5d96f873a2408e911609e1e7c4e1bf25fedf85a991e384f82cda973dd1815cdd1a1ac20e61f08628e9652f50c53366ae34
  • SSDEEP 1536:duaIoDKLcLBOgKjt2+F96P2TmN+nbOiaHvDOaB:duaISGcLBOgKjt2+F96P2TmNcbOfvDOI
  • TLSH
    T10733D69CA3D84131E4BF66B61D67024893B4BA938466D79F7CC401CA2B17B99CB41EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdiscoveryneptuneratpersistenceprivilege_escalationransomwarespywarestealertrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1