neptunerat | 7a7281ec920f9cec2db04b711d268cb3a1f56c559ccda8affabdec2aa6c1af86

Sharing

Copy URL Twitter E-mail

General

Target
MasonClient.exe
Size 49KB
Sample260922-rn3messs9j
SHA256 7a7281ec920f9cec2db04b711d268cb3a1f56c559ccda8affabdec2aa6c1af86
MD5 563a063f62dcd942fda5cfc3171b925f
SHA1 a0a64d4573b076f29f5aafbace22d651fa632202
SHA512 11a660a23dd4a78865ad4d87789fa09e04520255266aae12da1650687f0c35fdaf973d3a309424988876acd5a81528e83e3f98aad79c26540fefa3bce8bdc7fd
SSDEEP 1536:EGM8+xvc3SPZtTYCMqhPhw4UTK1Heo3xxb1/rYKbOVKI:EQ+xvSiZtTYCMqhPhw4UTK1Heovb1/Zi
TLSH
T15F33C79CA7D94131E0BF56B21D77424893B0BAA38466D79F7CC401CA2727B958B41EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

neptunerat

fduhgnduhgd-42552.portmap.host:42552

Attributes

filename
USB.exe
group
MasonGroup
key
g4iwvBAV8XRPb7ng
rat_name
MasonRAT

Targets

- Target
  MasonClient.exe
- Size 49KB
- SHA256 7a7281ec920f9cec2db04b711d268cb3a1f56c559ccda8affabdec2aa6c1af86
- MD5 563a063f62dcd942fda5cfc3171b925f
- SHA1 a0a64d4573b076f29f5aafbace22d651fa632202
- SHA512 11a660a23dd4a78865ad4d87789fa09e04520255266aae12da1650687f0c35fdaf973d3a309424988876acd5a81528e83e3f98aad79c26540fefa3bce8bdc7fd
- SSDEEP 1536:EGM8+xvc3SPZtTYCMqhPhw4UTK1Heo3xxb1/rYKbOVKI:EQ+xvSiZtTYCMqhPhw4UTK1Heovb1/Zi
- TLSH
  T15F33C79CA7D94131E0BF56B21D77424893B0BAA38466D79F7CC401CA2727B958B41EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

neptunerat trojan
- Detects NeptuneRAT stealer
- Family: NeptuneRAT, MasonRAT
  NeptuneRAT aka MasonRAT is a trojan written in C#.
  trojan neptunerat
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral10 behavioral11 behavioral12 behavioral13 behavioral14 behavioral15 behavioral16 behavioral17 behavioral18 behavioral19 behavioral2 behavioral20 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects NeptuneRAT stealer

Family: NeptuneRAT, MasonRAT

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20