Extracted

• • Target
    gfrffrrt.exe
  • Size 49KB
  • SHA256 6b228b6ca53742b5e6e33588605d435eff3a4813127743156a01bc51eb3c0151
  • MD5 fefe01583f6b7864b6f3399489ca3d1a
  • SHA1 2c0a9049f46f69e57c3c5dd6f0a1692801804878
  • SHA512 1767d8b662ae7aa9cf79e42fe54388930074a8cbd2a48559f3ba9bd75a969fbc9b9840430ef0924545879d48e995c974c0d82fff800c693c98b2be12c44bc967
  • SSDEEP 1536:jBBbsH0J/CmQIy8aRbx5HIUy61lsxo/abQSQUUyebOqg:jBBbyyCmQIy8aRbx5HIUy61l8bQSKbOt
  • TLSH
    T17C33E69CA3D94131E0BF56B21D73024893B4BAA38466D79F7CC405CA2B26B95CB41EF3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryneptuneratpersistencetrojan

  • Detects NeptuneRAT stealer

  • Family: NeptuneRAT, MasonRAT

    NeptuneRAT aka MasonRAT is a trojan written in C#.

    trojanneptunerat

  • Disables Task Manager via registry modification

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3behavioral4