Extracted

• • Target
    MasonClient.exe
  • Size 49KB
  • SHA256 3fb74ab77ce8cb40a47131c94d7ca1de3cfd84dfec663a9fb7fb0d924bd0c7e0
  • MD5 0f4fca83893b4b5eb6d5820220f3be3d
  • SHA1 bb411820b961a175f69278614fa7020ceac9d915
  • SHA512 c82a40aa99309d367b0530d44fd02dbf78a8ad916b6a114a6126935e1e3ae56ef6ca837de264d2dd8ceb658946c137acabafa649dc70b783a5b45cca410cffc0
  • SSDEEP 1536:ibgjs2BW5enV6gqQDV3doU9m1vSuPk9bHmNBewbOQg:isjsWkenV6gqQDV3doU9m1vSEUbHDwbW
  • TLSH
    T13133D69CA3D94131E4BF56B21D67124893B0BAA38462D79F7CC401CE2B27B95CA41EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryneptunerattrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2