neptunerat | fd99a25968ec7a6d1c2fe9b058bd27f20ab08e278ca2cd6f5cd3ed9f5d33646f

General

Target
2026-08-09_55f6943a0e3a484bf5b9cb7b343c6d9b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
Size 757KB
Sample260809-l8dwxawajd
SHA256 fd99a25968ec7a6d1c2fe9b058bd27f20ab08e278ca2cd6f5cd3ed9f5d33646f
MD5 55f6943a0e3a484bf5b9cb7b343c6d9b
SHA1 8da80d265a1372db68babe348f3bfdbaf64f2ec2
SHA512 1ece89595a252e74d431496c6be8374766e7ae7dfdea1b66e894a49ef0a71fba6638e963a14d2f5ead19a6e1355865077bdd42fbd45d57c710ad6fd07327d050
SSDEEP 6144:1Aypg+DmIlwqMP5K9KK+W8eyORdaZ1yGDo/srEYVY0l4vWP87FOLBs/ZPW:F57wqegcvWDLdaLyTCY0mvbELBs/Q
TLSH
T1BAF47D5ADBE405B8E4B79A7489724C06E773BC4A1B70B68F17A079A61F372D08D3D702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

neptunerat trojan

Malware Config

Extracted

Family

neptunerat

Attributes

filename
USB.exe
group
MasonGroup
key
uDsrmJtgkdO7ivpt
localhost
127.0.0.1:8080
rat_name
MasonRAT

Targets

- Target
  2026-08-09_55f6943a0e3a484bf5b9cb7b343c6d9b_cobalt-strike_cryptbot_icedid_luca-stealer_njrat_stealc
- Size 757KB
- SHA256 fd99a25968ec7a6d1c2fe9b058bd27f20ab08e278ca2cd6f5cd3ed9f5d33646f
- MD5 55f6943a0e3a484bf5b9cb7b343c6d9b
- SHA1 8da80d265a1372db68babe348f3bfdbaf64f2ec2
- SHA512 1ece89595a252e74d431496c6be8374766e7ae7dfdea1b66e894a49ef0a71fba6638e963a14d2f5ead19a6e1355865077bdd42fbd45d57c710ad6fd07327d050
- SSDEEP 6144:1Aypg+DmIlwqMP5K9KK+W8eyORdaZ1yGDo/srEYVY0l4vWP87FOLBs/ZPW:F57wqegcvWDLdaLyTCY0mvbELBs/Q
- TLSH
  T1BAF47D5ADBE405B8E4B79A7489724C06E773BC4A1B70B68F17A079A61F372D08D3D702
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

neptunerat trojan
- Detects NeptuneRAT stealer
- Family: NeptuneRAT, MasonRAT
  NeptuneRAT aka MasonRAT is a trojan written in C#.
  trojan neptunerat
- Detects Windows executables referencing non-Windows User-Agents
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects NeptuneRAT stealer

Family: NeptuneRAT, MasonRAT

Detects Windows executables referencing non-Windows User-Agents

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2