masonrat | MasonClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MasonClient.exe
Size 58KB
Sample260919-p8fbhs1bph
SHA256 aa47e94b1143ec98c12abe19fdc3878679e89a01c4c90b2118a9a023327b75fe
MD5 6985c91e7eb5f98aec3db38b63c2cea6
SHA1 b37cc58f22660aa806931599d193e3a30f9adfd0
SHA512 977f939f5a382f5453f46b7578079e854dc09d6804312b6e2f4038e6cb4b4e6268b34a94f8629c9a719b5e33b8582231f20fb37366902f1fafc3d6cefc281616
SSDEEP 1536:taYxwbTNjxwjhwY+D72MFNU9kvpbXhM95JS:taYabBscJFe4pTyY
TLSH
T122430A0AF35354ECC51BC6B446EB6673BA31FD6601359F3F1764E6312E10E20AE69B28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat masonrat

Malware Config

Extracted

Family

masonrat

c2.freemasonry.dev:36776

Attributes

account_id
7e336fc5111b9854b8f99c9cf93c2a7d

Signatures

Family: masonrat
MasonRAT is a Windows RAT written in C.
rat masonrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MasonClient.exe

File Explorer

MasonClient.exe

.exe 58KB

MasonClient.exe

IMPHASH e3e92a89e3b5d6dbc17c51049e7f7af8
SHA256 aa47e94b1143ec98c12abe19fdc3878679e89a01c4c90b2118a9a023327b75fe
MD5 6985c91e7eb5f98aec3db38b63c2cea6
SHA1 b37cc58f22660aa806931599d193e3a30f9adfd0
SHA512 977f939f5a382f5453f46b7578079e854dc09d6804312b6e2f4038e6cb4b4e6268b34a94f8629c9a719b5e33b8582231f20fb37366902f1fafc3d6cefc281616
SSDEEP 1536:taYxwbTNjxwjhwY+D72MFNU9kvpbXhM95JS:taYabBscJFe4pTyY
TLSH
T122430A0AF35354ECC51BC6B446EB6673BA31FD6601359F3F1764E6312E10E20AE69B28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext GetUserNameA RegCloseKey RegCreateKeyExA RegSetValueExA

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty

kernel32

CloseHandle CopyFileA CreateFileA CreateMutexA CreatePipe CreateProcessA DeleteCriticalSection EnterCriticalSection ExitProcess ExpandEnvironmentStringsA FreeLibrary GetComputerNameA GetCurrentDirectoryW GetCurrentProcessId GetFileAttributesA GetFileAttributesExA GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoA GetTickCount HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess PeekNamedPipe ReadFile SetFileAttributesA SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _strdup _stricmp abort calloc exit fprintf fputc free fwrite localeconv malloc memcpy realloc signal strerror strlen strncmp strncpy strrchr vfprintf wcslen

ws2_32

WSAIoctl WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send setsockopt socket

Name

.text

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

MasonClient.exe

advapi32

bcrypt

kernel32

msvcrt

ws2_32

generic