Extracted

• • Target
    MasonClient.exe
  • Size 48KB
  • SHA256 0868ade302ddc24703049e4274d51c6f0295e4007ed4de11c910ee5a40f44ec0
  • MD5 c69d483b5b57136159447f8e998417d1
  • SHA1 f9c58a07086d9789acc66eca17e271fc8bf23b4c
  • SHA512 ffbcea56a18b078a8674ee0725ea92f9312ab6c3409aff7d4d6460d60ec5c1c9cfffe1d0d71dd8dff6fe60e093fad216d7294eb00ca3ce2139085c61e9b0fc82
  • SSDEEP 1536:9bk9niyiiwRejSyAy/FXyK5EijqkPJWemOrCkmrCkqrCkhrCkgrCkFDGEl1bya9C:9bkZiyiiwRejSyAy/FXyK5EijqkPJWe3
  • TLSH
    T15B23F99DA7E54111DAEF9EF01CB3C201D3B1AAA78926C52F6CD801CB2757B9886017F3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptuneratxwormpersistencerattrojan

  • Detect Xworm Payload

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8