Extracted

• • Target
    MasonClient.exe
  • Size 49KB
  • SHA256 7e2ffef9f04c4ac9c712661c93ddab73eada10fbcce8eb464293b3b91cea53d2
  • MD5 560e4a8b4e1aaa7c013bdaaed5d1730a
  • SHA1 456a80029028a4f1c9bfff0fb86651a4dacff144
  • SHA512 29e0fdc8c37bd066c04080c2402c2dd2e55c98a9b9bb5a18263c87a1d497394be84a42ecc2374610c01cfc0da66b26ea2e1b04258f20f9ec4cfc5697e4e3ec4e
  • SSDEEP 1536:F0ta4TKbc7702Qa4SBtsNQUNK1P1WpObPRZbOKB:F0tay2c7702Qa4SBtsNQUNK1PiObPvbN
  • TLSH
    T12F33D69CA3E84131E4BF56B21D77124893B4AAA38467D75F7CC400CE2B26B95CA41EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2