neptunerat | 50527f9525e4f73cd37104d22096e67aaca8d5cd061cdf094ddef74e02579de6

General

Target
virus.exe
Size 142KB
Sample260901-2qxt3aszbs
SHA256 50527f9525e4f73cd37104d22096e67aaca8d5cd061cdf094ddef74e02579de6
MD5 b675885eb8fde6562f2b1cf9540f5148
SHA1 d4b85aab9139f8666c30d81d98f87479e790fb76
SHA512 0442f5e75f9fff81ae5a44e306c5086e9c0dbaf59c0f0f098c96456ec870249783ab46d9c464a1811f4d1e5a5c68786bc27d94a77c34e41a6725b8bd0c9542af
SSDEEP 768:9vsMai2io9kbgYh4ypm9qAGsQhIOBLWQbUfueqGzJbQQAU9JJxff9o7KJZOzjq7P:VaDIm9qlCOFWQ4fSBrq7a+H
TLSH
T13BE35CF4FE834125CFEE8EBCA976C6131C71AC9A7956B1CA06C6738A27321C0444D5AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  virus.exe
- Size 142KB
- SHA256 50527f9525e4f73cd37104d22096e67aaca8d5cd061cdf094ddef74e02579de6
- MD5 b675885eb8fde6562f2b1cf9540f5148
- SHA1 d4b85aab9139f8666c30d81d98f87479e790fb76
- SHA512 0442f5e75f9fff81ae5a44e306c5086e9c0dbaf59c0f0f098c96456ec870249783ab46d9c464a1811f4d1e5a5c68786bc27d94a77c34e41a6725b8bd0c9542af
- SSDEEP 768:9vsMai2io9kbgYh4ypm9qAGsQhIOBLWQbUfueqGzJbQQAU9JJxff9o7KJZOzjq7P:VaDIm9qlCOFWQ4fSBrq7a+H
- TLSH
  T13BE35CF4FE834125CFEE8EBCA976C6131C71AC9A7956B1CA06C6738A27321C0444D5AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution neptunerat xworm persistence privilege_escalation ransomware rat trojan upx adware spyware
- Detect Xworm Payload
- Detects NeptuneRAT stealer
- Family: NeptuneRAT, MasonRAT
  NeptuneRAT aka MasonRAT is a trojan written in C#.
  trojan neptunerat
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2