Extracted

• • Target
    NeptuneRAT.exe
  • Size 38.7MB
  • SHA256 1dc951e6c3424e0d1f7264c0b8d1804657d3c2f46cb1a33a111759f72510e434
  • MD5 8796b280f245b60eea54ac969374c538
  • SHA1 4a756836829f2bb96b9d7ec94c3b7c23750c0fec
  • SHA512 24a4f046073560fa0c09cb8c9cb5f32033bafe73ad2efc4176e20e4e7360a29ed6ab425ac399504a0b36862d7ad654b1ba86bb487939de9d57d5bf570fb742b4
  • SSDEEP 786432:omidkDguXbHOeoFLvX0cUcujpcYYwYi11H/fUo8/GSd1DFCbzCdr:omxDjXbH6rYcuJ3TffUjGg
  • TLSH
    T14F97333844EE31CCF5A6E13BCCC4356AFF2F4C96E5852399029EBE19CD9E05460B2A75
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderneptuneratloaderpersistencetrojan

  • Detects DonutLoader

    loader

  • Detects NeptuneRAT stealer

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1