Extracted

• • Target
    MasonClient.exe
  • Size 48KB
  • SHA256 5d8fae478eff7164a85415b030a758cf623d9a64c7725ea10419933780e2273b
  • MD5 c9518b770e62d4158aa1484ca547ef55
  • SHA1 6f9f0fa9af80ab2e8c114aa09455f065074609fe
  • SHA512 8623aa67fb8d1a27bbdc0b2e468b4859b3f595ec3f53536ea6786939b782271b529291b3df16442f11d14dc3fcf2c138cbcab2c55c6dddc45b08dc44020aeb44
  • SSDEEP 1536:HQIcwHftUSnHU9U2+uUiGS9GfXOcMXOcXXOcBXOcgXOcutCmUOnUk+Hm9nmdXOch:wIcwHftUSnHU9U2+uUxS9GfXOcMXOcXa
  • TLSH
    T19323C68DE7D50121D6BF9EF119B31209C3B06AD34856C66F7CD801CB2B2AB994681FE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • UAC bypass

    defense_evasiontrojan

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1