Extracted

• • Target
    MasonClient.exe
  • Size 51KB
  • SHA256 57121edc0cb4a878574d8a2983a7bbf7b594cf55378a3c7b031a2b0e26f538b1
  • MD5 52c7d6e5c417126f0e29b89c5306e3ae
  • SHA1 c03215097e0867ab785e678d2870692bab87f139
  • SHA512 541c1756be1d7ef975bfe69a5adfc32e79340d4d4a530da46957a00453f53a2e179958d951acec06107b2ef5be5d1d6201f39614c9eef38bced8be5e630c3961
  • SSDEEP 768:iYo7v7Hl8NoS1sLPeNRDpRL20bcMx7QZRjwWN8hJOTb6Y:iYo7v58NL/dfL20bcMloGTbOP6Y
  • TLSH
    T19733E789F7E54230C0BF5AB11AF3120A8776A9976402CB0F7DD445CE2777B889593AE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2