Extracted

• • Target
    wadas.exe
  • Size 49KB
  • SHA256 8a9a691a58a7dd5a6e36c4119e3a09749e7bc24f25922f2fdf206380e4f82b49
  • MD5 89a934cb488bc58ee70833cf69d9c31a
  • SHA1 5a40654f43fbfe6cb09f73b389f03bbf62568188
  • SHA512 cfefdb50e2c52a8492c63ee6bb922f9f8135e14226056aa896dac7614220220d009a1af17c429bb00a2a807bfeb4b94695f6ff57cf4bcde6fefdfa85bb0ee91d
  • SSDEEP 1536:XC93PvgjKrOVbEkpCdbuRco+kYyUIUl21rcFVKYwSbohOypBbOes5:XC93PvamOVbEGAno+9xIUl21r4gYdbo+
  • TLSH
    T11933D79DA3E84131E4BF66B21D67520893B0BEA34467D79F7CC400CA2B16B95CA41EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2