Extracted

• • Target
    MasonClient1.exe
  • Size 48KB
  • SHA256 957cb4ba16d6f78b11099e4175ebf7556a8992ab96994de978dcb0d1f1c8e044
  • MD5 bd479bd1594cc562d372c74776ddcbaa
  • SHA1 c9e8a755203a6d9d5fdc25943d2ed697d7a909fa
  • SHA512 16a9acb0656b3a754e30b0ea1e5d3bba42ac34e713a4127f77b5ef2de67084e3c928769f7dd2e83addb3e7b9508c58b8a9a1918b87b38a21d893463b1565cb41
  • SSDEEP 1536:31wbftU2/OU9Ueu2UqmNetmTXOcAXOcbXOcBXOcgXOcWVSOUOfUk+6m9DmdXOc4I:31wbftU2/OU9Ueu2U50tmTXOcAXOcbXn
  • TLSH
    T12623D58DE7E55121D6BF9EF119B31209C3B06AD34916C62F7CD801CB2B27B988641BE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1