Extracted

• • Target
    MasonClient.exe
  • Size 50KB
  • SHA256 79d94605086bb82f31ce24ec0bf6bae92865031bc2539269b2b39c4628c7b30f
  • MD5 1bf5e049a47c09d77acb53011ea9dc56
  • SHA1 d5079a77a290e130f60a69fe21de3e779ebffb2a
  • SHA512 74308da5b5b9aa57b97a040d59822257f942942c950cd4fd4eeb2933bd4351b2f987daead4036d08d6025b2329ebf84637a74767fd0e978d6de3b06214d68ce8
  • SSDEEP 768:/pGqA0gpdFxXBVnYmyeHtErb9NgXSgDN3hBObyJsl:/pFCFYmyeHwb9NbMDOVl
  • TLSH
    T13933E68DBBE44129D5BE6AB12D73A20983B079934517C60F7CD402CB3B6B7884691EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2