Extracted

• • Target
    ll.exe
  • Size 49KB
  • SHA256 679eb536ebb1f9c449027f19aa5a442f4ef6e94bce1f3a94c6c73e45b7ee2e46
  • MD5 2f8031969dd6d7072f9d4e01082dfa79
  • SHA1 3eedcec78cb6ae7305dc5357d3ea44a65bf691ad
  • SHA512 37eed3a34a0d09eabdee5a4eecd8caee5be6ac67319638e619ec7bd8cb9a8c66a2b03049b08e9b0ee05ca1be950173503ff7189a5617b1284dfb3327c2b5f159
  • SSDEEP 768:X/+uYACcvmEl4GSnNGanLDut1MvbuOba1TNI8hJOl28:X/+7Ivr4fMsLbuOYbbOM8
  • TLSH
    T1E733E78DFBE40129D1BE1AB12D73621983B079939507C61FACD402CB3B27B984691EF7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2