Extracted

• • Target
    MasoonRAT.exe
  • Size 84KB
  • SHA256 f5882c56e709a486aaf3805ba94bad504dab808d122cff0447f0302139cb309b
  • MD5 4b236853d4d4597b87541acc59dc5180
  • SHA1 095a46a662c3c336fb40dd2f3adea72141c454cf
  • SHA512 b2561a8e5001bf54353183460c6d76e3027da5891a5cd8aabe1de512c0d5c93d680340b980a52e18694b9b4a8f5bf22e6dcc1cb72f68e7ab97a158757a10dddb
  • SSDEEP 1536:iaSR8Eu/y0NAAev/8eZo0spHwNxSRFdR1ybK77vQCTfONBWGXJ2sSEXa0QCWcWap:ijR8E+A//XoJQNwFyK/B2NoGXJhKM
  • TLSH
    T1EF83E095371F2E20E16842BA15950C3F237BE63CFCDE817FC9A2EB749E513629129324
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  donutloaderneptuneratloadertrojandiscoverypersistenceprivilege_escalationspywarestealer

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2