neptunerat | 93480865fd4c0ce2f5ebeec8d5ca75a60c6e93cee64a8eee9fc87971ce8cc924

Sharing

Copy URL Twitter E-mail

General

Target
Mussolini Grabber By Vapo Group.rar
Size 3.8MB
Sample260925-mbmcfszsas
SHA256 93480865fd4c0ce2f5ebeec8d5ca75a60c6e93cee64a8eee9fc87971ce8cc924
MD5 4932b05d1a0a1c5ba4d81c4b665c28b2
SHA1 b7c563ba54d5cbb52a6663163383258aad0b92e2
SHA512 e8465bba9283eb7be463b23c7eb11a6caf70d725855704a80b4518c43e80570042727736e4552f7a7379ecf1b2f7639c77ec6df844b049ede630e5881873dcf9
SSDEEP 98304:mGm9eTkOv61Wk8do/cqsCqRKTfRdWlFweLZA0WHV0:mvkTDGWkAqsCqe5dWl72vC
TLSH
T15C0633C57112366D024089C17E9F669BABB570DF52F0B60AC58494F1BE0BB5EA62C3F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.Lic.dll
- Size 51KB
- SHA256 bedf7004c639d4c848bbdc4a12b7c04fc90bdde9eb55ae1155cdfe42b88e27b2
- MD5 a90a670b20c7b9e5e58f4d6866ecdd2d
- SHA1 5116b6f21c4769e2493a1ef9cd9e4e4f08a2b3ce
- SHA512 a4a686bb32a08f4590d5a9d0c85e46252c464b299159a8bb12b1c97e9bdddd3bdac33f34eae1a7dd49c43c09c92d15096d4f804cf26ad6d39ad5a5bd0d8131c3
- SSDEEP 768:CLMcpRoQLR8T6a2TBnSWbMatjFPu0NBhBO9QA+w:CAcT3LMalVbMIltDOj+w
- TLSH
  T1B233E7CCE39A4221D4FF77B905635200E37569A74C12C61F68C581DA6B6BFC886A4BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution neptunerat persistence trojan
- Detects NeptuneRAT stealer
- Family: NeptuneRAT, MasonRAT
  NeptuneRAT aka MasonRAT is a trojan written in C#.
  trojan neptunerat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.Licensing.dll
- Size 1.3MB
- SHA256 a9be91cae167702885a5ca74273db779e3e391e2e604cc03779ed403c53ebe43
- MD5 2b2740e0c34a46de31cf9da8a75d77cf
- SHA1 242324f1112e6387cda41686291b6e9a415eeb8c
- SHA512 605eb300b159e6ed2ee872b6ee378eed7dde6541000221fcd94d52057be91cb3c7dd65c7203f05e0718303b157b6fb941498b5e653501f97f0417d459da6bc40
- SSDEEP 24576:ebkurkdR5uuMeiPUf2lHmdpjrcbYdwcqMw5LTvBrq/WGs1xGUfGUCco:a1roD9MeiUDDjrW4bqD5LDBrqWG0GUfX
- TLSH
  T16155F150B3FA6F16E1BEB7F56971120807F0BD979835C30C9EDA01EE1B62B848494B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.1.5.3.dll
- Size 342KB
- SHA256 012d717b4ac00c3686a772757f49c1908e223624e3974314cdb9fc9291073305
- MD5 41c216d27c71a227774e680e95e99f31
- SHA1 0a2a93d4ecbf4bbec2faf110066c6b4472b0dbf5
- SHA512 e355ba11e41b668e4459f709e87c3e212c8986ea894791d9155791ea9d7315372fb51531eb69204ed2ee38e242de7629e4a2f090c05bf9deeea9ea965ffaf651
- SSDEEP 6144:3e5XJsDZGUbIf5kqw23B1Q8g2iYcHIc6uWXMIFidNw:qMZGUbIf5T37Q8ncHNAMhNw
- TLSH
  T1C5742DD15AA5ADE1C7D747BAE7103143D77888A07ADAE70BDB8401FC49A2F9BC84D087
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuButton.dll
- Size 107KB
- SHA256 2a62c78f1f0db2e3258135b50f7885e6734c31c74a8f2f5782f285aa268c2f71
- MD5 21f999e5ac72a16077511d41590822de
- SHA1 d8bb1a8a291f73cdf2b5658b2b65736c87db19dd
- SHA512 e04fe31870f266d772829053a6bb210a9513ff5c8c0f9a3a267ddbe1875125496caa602baf44a4e241ef84d933bd55b79af43d5871ed10c81711adecee78b8e3
- SSDEEP 3072:tgiMibnDED3/7f2ih0xdGzFpzUHgmCFKHUUZP0tTwmnkyY:xDDED3/7f2ih0xdGzFpzUHgmCFKHvF0e
- TLSH
  T15EB3083F61A45E71C34AF73EB008514247B2EE90FD76C736BD9842D92A837A74C1A297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuCheckBox.dll
- Size 102KB
- SHA256 390252aeb6fd76a954a03853c3d883e0360dc8b3f2cf8cfed5ba94e4e5a24da4
- MD5 ef11f59a9381df17d7ab94434f79f260
- SHA1 ec11e46a636fe3927fd5fa7c30be65b958853ef0
- SHA512 612b1b0f9204c605ff5e9b91816e674cdaea71fa69f81a5a7f475bf1cc8d5e12687deb1b0118b07b3d7e4764adede0576f8fc799f8155a65a70e5dafff50f73d
- SSDEEP 1536:JiQsfF22IDMxiQ9MOWnce1Cua4JfhwuKeWbZ6YlX52o3tWQFeOvTT:JifF22IoxChnv1CuhW1xCwdeOvX
- TLSH
  T132A31B7F62E59F60D38E633F65B061005770F450BD3AD77EAEC848884D9375A0BCA29A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuCircleProgress.dll
- Size 77KB
- SHA256 d5ed95667aa44a80278b80a90413c0de9d85eeb3ca1fa24a40ae71c3ad88d837
- MD5 bc930a050ca23ea75dbd9deade4189bb
- SHA1 e6878d381ac1c37c331fd01a25b2ec508e1c1a21
- SHA512 20e2bb3661d2817082c2aa01381b5aee8582fea5fc54be486de5b1e48f302a15779ebe5670221774a5a4d031248b342f3c86084de4f023c197cd210857fb3ff3
- SSDEEP 768:A8ioretsy7GQLZvAQFe1zbnprSBaqII0OsWjc1B5Nl4WfWQAz6uJi8B4dgUp2hQf:JixnZYQFe722Wj8l4oL+6uJ/BZ4ZTz
- TLSH
  T1E7733A5670B5CAB1CB1E2B3E238061400BB2FAD2395EEF177E6C879946833FE5195187
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuColorTransition.dll
- Size 38KB
- SHA256 500adece1fba76dfb2fa628de9886a2661ed1a4e58a7717a5fee607206bb1d81
- MD5 539d803013c0b1592d0e17a740d72687
- SHA1 b0ce15e0f096d027b1d1482afa9d93bafd160f7a
- SHA512 77d8ab7a949db41a79371cf2ebd5d67bd4a38dd040de0073c878f50b2a6409fae2dc5db7cbf375fbc1bc571838b0a6d4848bdecc1420d91633b878585c94b9dd
- SSDEEP 768:2SfWaEnnh2U2DaRIx0qVuQ/90iAzNIewCqyU659bTTvtM/3JhQTifZs:cs0qVb/95+6ewCqyZ9bfvk0TWZs
- TLSH
  T10A033AD266901E63C39706F934A093165BB4F5E379B1E35BEC1C80815AD33FA5CE92CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuDataGridView.dll
- Size 83KB
- SHA256 9e61bd6dbcc8d5866bf3a139ea12f453ef4ca8bab28c08329cbc5f0bf13950df
- MD5 53765ad5b31fd87986a569bbb79f402c
- SHA1 75c7ec63458c79ded533d1d4175de4117036adae
- SHA512 ea129aab13b09e817be6210bc423bcf4e024c83a5a0340941e7658d4dd0ef6f3b40077527f7d168849ad947650a00d360fa6a5f64c4a8f14dfe72cd4d34469d3
- SSDEEP 1536:YNBBIrOTrgVCuiPwacJigM8H+duT0R0xSJQ9FTiIb8EtTG:YNBoGgsPiJfedkvu/IFtC
- TLSH
  T132832C8672D95F71CA760ABE90F002112BF1E1832A45E31ADEEDF5CA0562FE1D146BC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuDatePicker.dll
- Size 50KB
- SHA256 3c1ac3e39665e49327b64887131a53c63379de884b3a6f9a0ab96a36e882ceb7
- MD5 a05882bac172c61b5b1bd3f4a56b4320
- SHA1 9a725973aa498472c253382ff8d766a5d3a41697
- SHA512 a503f5cd0211b123618ecaff83a7930a6b547a1afaad1b93cc5e60bc859e255585a8a94832747422de139f2fe6451b2fcf46b31bac20e12ce60f97983e1af493
- SSDEEP 768:KMzEetGON+bjRFOchYvP0pbwk4LAzn21AXrpKXyvcgq8/i7l5THL8ZFxIZYzUebj:HsONqjRFO2ZxXpHraUNaT0
- TLSH
  T101333BE232AC9E73C39B8B392050E301B678FB527EA2C7566D5C428C16E3BDE11D549D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuDropdown.dll
- Size 50KB
- SHA256 f746eef49caaf23939999a89c86787e6d1f4e4c16f667bcfebcaeacb5276e0c8
- MD5 5bc3c478e3c44caf765c6e998dc621f0
- SHA1 8cd06d3ec991ae3d5c0d935ea03fd7c06d504d53
- SHA512 3990c0a716e2e0619cd969d75666cacf695b6d40a118ead8a810997a594b558250e4a661e303f383f58bc52cac90e84a2049a50a1295f762b2bdbdb8661c33f0
- SSDEEP 768:WxidV98e5TsEQgzWC/Vzv/8vWvLMFZhjd5hQTi7q:Y3ehsEQAWQHgW4Zhx0TN
- TLSH
  T13B331B72B3E01BB7C75BCF3E34504046AA38B622693FD3567C9C126CD6A3BDD0690296
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuFormDock.dll
- Size 102KB
- SHA256 f8052b4641fea785ef643bc06d0e5383555c0845bbe695099bc41ab09a180ef6
- MD5 fff8d46f94011c5bfa4bc1d1fbde3eaa
- SHA1 c5e978eb89e9646423c3b2a1d7d2651cdbee90f0
- SHA512 61af0253c05bd33d43d34799eb74d97ae9e3e700281273895026d690f39e3de97034ee51511284a4b6a4150d31977f7ac6fbf4047aa19825564a15eae8be079a
- SSDEEP 3072:wVypYUOJdOb8UD8m1PxGFXflE2BHjvZKDq6CN:wVypYUSXdbBjvZKDq1N
- TLSH
  T10EA34B3EB1E96EA1C34A377A509183113F7BDB507E72D70B989C40D9AC82BD60C562DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuGauge.dll
- Size 74KB
- SHA256 0edc3396eb94c33fca4889c5a379e29aed354469957ee55893f565d8f824cacc
- MD5 161768e00f22118c66a84d22e658b008
- SHA1 7645e52d1aeac19169c8cd1b411200ee808295b8
- SHA512 cfcbc3e642f6f9cf904b993a6112e2304055cd88e9bbe2d818842d4e93a5f71ff6a09f8d36c6a64de8701435cabbddbff765307f8c110dcb5bb14d805aeb3422
- SSDEEP 768:POPW1cKm3/WnwISrek0JCPRjNEp5lW1T31fNEDqz6Zi6EgmaFLGiLjyQXAhQTiQb:PUZewEQRSXlEaDA6w3g7wi3yWLTbb
- TLSH
  T1F6733A3171E92DA1CE4E0F35A140A2022F34A7C3393BDB65ADBD83A647937EB46D5193
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuGradientPanel.dll
- Size 60KB
- SHA256 6811dc0f98d2ce9816475207badd010564b7be460f48b8480664f9184824ce5f
- MD5 58be3fb2879bf2614b7854b0e184521a
- SHA1 fbdce08394b1d11a961c0684d5c0013507dff9e5
- SHA512 a5635f09a943e0dd969b648ab7d929ba16d734ebc13f96ebde95d1a5cd91e14ba1b2e105c7414816f3d535bbe2be4ad861a16e25d84c2d12dd025898f3743b0d
- SSDEEP 1536:FpoDvSiiUiiJiiJiiYiKbfbD7v055J6O5v2wunCT6:aSiiUiiJiiJiiYiKbz+bB0Ce
- TLSH
  T112532A62F7D40DE1CF8F053A645092025B38F6F3B85ADB4B7D9C41A68B837E611C935A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuGroupBox.dll
- Size 46KB
- SHA256 637b5cac86e245c53af91e41e6479de42df1b5fa5a524f931e034f5b5ee1f259
- MD5 e86aafa7c25a2f1654cf95657cacc39c
- SHA1 c9ab7d835b24b294309abed83efff4cdf102906b
- SHA512 8b043a2434681773c6e3d8e73fde70fbb666f57a30f5e3514634ccf5c714979fa89769fc54e3e01fba91c5ac916db44054fdd2a65b4a6c35869b695b8696d96a
- SSDEEP 768:jODM3ey49Uo613D9ddld3LTeBNsRfMzIz6FzHGptXZEchQTits:jODM3eySWd3/jRam6FzHG2HT6s
- TLSH
  T16A231C54BFE83F71CF8F4339A5804201EB38A5DA7C52D79BAD4C828917827E6429536F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuImageButton.dll
- Size 155KB
- SHA256 32b8eb2fae4a14e8319448cd173b73a8e63234b3816d6407ef95be204cec226d
- MD5 7d68b8af58c87ee29eca74fe8ef2f093
- SHA1 16e8d2004d2c3a71a8dcb6983b72537079ccfd3b
- SHA512 6c3f90e7596e0a73cc5da77b92b2d4ed248e49aba2c0c299be4400b8841782415820a44bcca1635a224edc90444559ed14de7dc23fbb7133c0bd86fe93ecd236
- SSDEEP 3072:28cu9fbsLqRKynlLWwUGR3BKRqbpqtqzh4E6jt/:zfbsFulLASYqddzcZ/
- TLSH
  T1C8F35C3EF2B5FDB1C38AF23A3824D1004B35DC94FD66E34FB544C26B4A81B5A095A967
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Mussolini Grabber By Vapo Group/Mussolini Grabber/Bunifu.UI.WinForms.BunifuLabel.dll
- Size 420KB
- SHA256 a505193910f7b8fd6123c00bb437bff3d2a4f28c970e24207d395554765e6ad4
- MD5 73ca0338c9c3b7901d3621b346c76a7a
- SHA1 79d26ee6e1bf0beb2ee0593562592de8ff01935b
- SHA512 53e0b84dffbec8e465955bc91f1207ba56a55543ba3c00c66997b3ee3d4cb904e027915a12f7a9dc79ffef4cde633c9b7543436c4ab97785ca2169bc3d4aeede
- SSDEEP 6144:IMiEH8iZBKX+7haZYjw1MLZRD0fxrmfD4DJL5f:IMNhZjwKLDCVf5f
- TLSH
  T161943A58A1FD38E4E27B07BAB15219C2C7ACD8D37DF5C75E888B64EC3662F49C414262
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detects NeptuneRAT stealer

Family: NeptuneRAT, MasonRAT

Checks computer location settings

Executes dropped EXE

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32