Extracted

• • Target
    MasonClient.exe
  • Size 48KB
  • SHA256 a51e00c83d8f08d17ed55c14e14c81259a0f63bc644030ec7d1c4c71787cb3e6
  • MD5 baa6e1afa94cc37c6b65ae289a099aae
  • SHA1 c586298d31779440a87d58391057834670bb1a3d
  • SHA512 26c7b9959d6aff0d812e6a9437a72f2053ef622cb0a863b73bc64998c8fa4259d95a6244be4e761e1b0044a4f8ad99cb42cdc39e04f8805aea7342468c8d35be
  • SSDEEP 768:fWFKfqlmeypcHHn8SI2a/OsygHi8b4njonwqxMLbExel7aRAQhLOzbMJ:fMKfqlmtCnn8SI2a/Oso8b4njglobExN
  • TLSH
    T13F23C59CA3D80131E4BF66B21E77524893B0AA938467D79F7CC401DA2B16B95CB41EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebootkitcollectiondefense_evasiondiscoveryexecutionneptuneratpersistenceprivilege_escalationspywaretrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Manipulates Digital Signatures

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Modifies system executable filetype association

    persistence

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1