Extracted

• • Target
    2.exe
  • Size 48KB
  • SHA256 ba5f4d0bad88b67619e6e1c687f9e1b5874fc95905f7885a358df4391d86c761
  • MD5 d7c692ecde39fffc4354e769d28a7f01
  • SHA1 0df3faffe1d0080aee4924281baf38a340d4c26d
  • SHA512 34a597b5bf5c67c6c49146d4186ed2729a3fc531eba93979072ae6689b0378b92e4b682727c91a2c63380d9d5013545cf4c105f2314dac39a6b8bf41ea40942e
  • SSDEEP 768:1/7AfQR81kX4AUZTK6bvklJb5biy5ARj6NmhLOGbOYr:1TjR33UZTK6bvklbbiCu1OTYr
  • TLSH
    T10223D58DBBE40129D5BF5AF16D73A209C7B079935507C20FACD402DB2B26B984691EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionneptuneratpersistencetrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Disables automatic submission of suspicious files to Microsoft by Windows Defender

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion

  • Executes dropped EXE

  behavioral1behavioral2