Extracted

• • Target
    MasonClient.exe
  • Size 48KB
  • SHA256 35cdc8f649408d536776e76b355b24df27384300001eb3da165dfa83304a1e95
  • MD5 ef49f9ca5ca3b2a05c3e61c3621180cc
  • SHA1 b5539b6d68f8e74a6be398c9f060b563ebcfd3f5
  • SHA512 1c21e15cabcda85e96581ef7e0749513773b437a5cb6f1dc15300244ff28a62fa93a9a6e234bc6413be12895f7b6a989b41b94d81793c9c98dd7f91a228ce131
  • SSDEEP 1536:688IlDtUITzUVU6ilOUCqlBO1XOcyXOc1XOcNXOcIXOcEBuiUOPUk+imV1mlnXOj:688IlDtUITzUVU6COUxlBO1XOcyXOc1a
  • TLSH
    T18323D68DE3E55121D6BF5EB119B31249C3B06AD34916C62F7CD801CB2B2BB988641FE7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1