neptunerat | MasonClient[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
MasonClient.exe
Size 49KB
Sample260922-rn3messs9j
SHA256 7a7281ec920f9cec2db04b711d268cb3a1f56c559ccda8affabdec2aa6c1af86
MD5 563a063f62dcd942fda5cfc3171b925f
SHA1 a0a64d4573b076f29f5aafbace22d651fa632202
SHA512 11a660a23dd4a78865ad4d87789fa09e04520255266aae12da1650687f0c35fdaf973d3a309424988876acd5a81528e83e3f98aad79c26540fefa3bce8bdc7fd
SSDEEP 1536:EGM8+xvc3SPZtTYCMqhPhw4UTK1Heo3xxb1/rYKbOVKI:EQ+xvSiZtTYCMqhPhw4UTK1Heovb1/Zi
TLSH
T15F33C79CA7D94131E0BF56B21D77424893B0BAA38466D79F7CC401CA2727B958B41EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan neptunerat

Malware Config

Extracted

Family

neptunerat

fduhgnduhgd-42552.portmap.host:42552

Attributes

filename
USB.exe
group
MasonGroup
key
g4iwvBAV8XRPb7ng
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
sample	family_neptunerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MasonClient.exe

File Explorer

MasonClient.exe

.exe 49KB

MasonClient.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7a7281ec920f9cec2db04b711d268cb3a1f56c559ccda8affabdec2aa6c1af86
MD5 563a063f62dcd942fda5cfc3171b925f
SHA1 a0a64d4573b076f29f5aafbace22d651fa632202
SHA512 11a660a23dd4a78865ad4d87789fa09e04520255266aae12da1650687f0c35fdaf973d3a309424988876acd5a81528e83e3f98aad79c26540fefa3bce8bdc7fd
SSDEEP 1536:EGM8+xvc3SPZtTYCMqhPhw4UTK1Heo3xxb1/rYKbOVKI:EQ+xvSiZtTYCMqhPhw4UTK1Heovb1/Zi
TLSH
T15F33C79CA7D94131E0BF56B21D77424893B0BAA38466D79F7CC401CA2727B958B41EF3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects NeptuneRAT stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55390

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MasonClient.exe

mscoree

dotnet