Extracted

• • Target
    MasonClient.exe
  • Size 91KB
  • SHA256 6692c7c89786abee2e282eb91ae66d2f01097ac7c78f1c506594eeb7ccd54012
  • MD5 d14c3361f874b4e0e6215c121ecd1dc2
  • SHA1 42a5985671efe04f9f033f34d1a39eda6081d5e7
  • SHA512 b1e7da495fb99f1ab2e1aa912f0b7df5d6c9c6de07681985173b0a31b630a9bfcd689f79733925f4d275ea09157fcfe71f96cc9e6150f630f74f406dda5505d6
  • SSDEEP 1536:nBsuei8APJvGO7nuDhMPku8ouWrIQuaE/nQmLWUJWvT9K5n39vJIGmeUcUn:BsuewJeKPku8ArLuasnKmWvT9OnNvJIp
  • TLSH
    T11B93F142A63C965CFC52B0732082413498A465AE3FFC639B5B68DF0407EDAA94F5CDDC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutiondonutloaderneptuneratloaderpersistencetrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2behavioral3behavioral4