Extracted

• • Target
    Host Ptocess for Wimdows Tasks.exe
  • Size 50KB
  • SHA256 43f2fa217be0267c2651706bec4b61be930274fbeb32053e2ebe275b7c9ee989
  • MD5 c93f4cf4d0366b00befb97ac767427dc
  • SHA1 e0590d1a9a6430a16c9f198c550c9d3c57e17321
  • SHA512 6db4d9c66f129f81651e699b8f903e21d538e8fa9a6f1564b17ec3b678cefe47db68366d933710a344c28b269c0b25ffdd12b8dfef67d0e9927e5efe8e4acf2f
  • SSDEEP 768:fWeBFU3taPJbLAmr8bje0huMb+oHwlN6K2MNKhJOEkzuE:fWeBF+aP/8GCb+oHwlN6XbOEeuE
  • TLSH
    T18133FA49B7964132C8FF57B118B31219A3F569E38D12CA1F7CD941CA2B27BC48684BE3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2behavioral3behavioral4