Extracted

• • Target
    22.exe
  • Size 49KB
  • SHA256 ec39a58b6637e6b7cddc91357c8be4e3d67db797f2c57dc975107f48e9e60744
  • MD5 a1c90a9e5ed0b617a321c5b5aa829e8f
  • SHA1 045f147d0ff96487d53c1c336c406719a5e4660d
  • SHA512 367693c624e8347f22aa1d67e8bcb8a02530f787708b3a6062e30c28c5d9eb7e548fa2e5ea69a4b8161c5fe7b5dc4e48dec466a9c6ed6412f34bfdfe6a53540f
  • SSDEEP 768:RxxRIp4F+Tjsce4uXG44YvQkQKbkzwqXqAFA7hJOtubub:RxxRIpVsWX44YvQkZbkzQbOCub
  • TLSH
    T1303309C8B7A981A1C0FF1AB20EB393095AF176939416D70F7CD445CA2727B988640EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptunerattrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2