neptunerat | Xworm V5[.]6[.][.]exe

General

Target
Xworm V5.6..exe
Size 15.3MB
Sample261110-1s3bwsbf53
SHA256 179d395ea7005e31ebb1bfd18104658dcd335578c7df2e8bf48e17f28330f181
MD5 8615b9abc8e74e1ac39293160b3ac71a
SHA1 b48d1723f86047798d65a638a8f6cd53383c99cb
SHA512 aedd972e7c100b4c3e0bb731ac7ef3749719175450d1e87ce97b4841093f67319869e6f29f637415c413ee1898ca9e81c946a16003ee0e9364212510f16b0c72
SSDEEP 196608:bZ4/BAe1d4ihvy85JhhYc3BSL1kehn4injeN:tuyIhhkRka4is
TLSH
T1B3F69D107BD68006E47269B00A946BE199BEBEAB2B15D8AD30C4331C17F65C8F953FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan neptunerat

Malware Config

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
sample	family_neptunerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Xworm V5.6..exe

File Explorer

Xworm V5.6..exe

.exe 15.3MB

Xworm V5.6..exe

IMPHASH 73e62e7893257c48b66d8317b9abd117
SHA256 179d395ea7005e31ebb1bfd18104658dcd335578c7df2e8bf48e17f28330f181
MD5 8615b9abc8e74e1ac39293160b3ac71a
SHA1 b48d1723f86047798d65a638a8f6cd53383c99cb
SHA512 aedd972e7c100b4c3e0bb731ac7ef3749719175450d1e87ce97b4841093f67319869e6f29f637415c413ee1898ca9e81c946a16003ee0e9364212510f16b0c72
SSDEEP 196608:bZ4/BAe1d4ihvy85JhhYc3BSL1kehn4injeN:tuyIhhkRka4is
TLSH
T1B3F69D107BD68006E47269B00A946BE199BEBEAB2B15D8AD30C4331C17F65C8F953FF5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects NeptuneRAT stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFilePointer WriteFile CloseHandle WaitForSingleObject SetFileAttributesA GetCurrentProcessId CreateProcessA GetModuleFileNameA CopyFileA CreateFileW ReadFile GetFileSize FlushFileBuffers CreateFileA Sleep ExpandEnvironmentStringsA DecodePointer GetConsoleMode QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc GetConsoleOutputCP WriteConsoleW

advapi32

RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA

shell32

ShellExecuteExA SHCreateDirectoryExA

Sharing