Extracted

Extracted

• • Target
    MasonClient.exe
  • Size 49KB
  • SHA256 dd8b68a78ac59247e75988a6fbc98214b57c04a2a5cb02f7673f66725b5dca2e
  • MD5 f5f2fb5151b524078de8d5bc36986691
  • SHA1 553311e07aa71d65cd488c05b1f0f4e38ba2009d
  • SHA512 033b29ae524670863931af198483c8b547c02fc5005b4a38e68ba0c8d536b5b5898967380961bd01dede7a99e6f5f4abb20fa9cf365e4edfc669e4b0395ab8f7
  • SSDEEP 768:zfRCs8WPCZoPSJbIcNi29yVTgbKtkBpQ38Idot/X60E4ZhJOgOlTbuUA:rh8WrebIJehbKeBM0/zbOgOlvuUA
  • TLSH
    T1BB332B8927E88661C5FF5BF02C73D25196B67A139526D30F28D815CE2727B988B40BF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  neptuneratxwormrattrojanbootkitexecutionpersistence

  • Detect Xworm Payload

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2