neptunerat | 88da33f2df5c7f93087eb95d529546a1e2353874dc481b68ff772ce8a1ae39ef

Sharing

Copy URL Twitter E-mail

General

Target
NeptuneRat V5.0 Cracked By KAKA.rar
Size 73.9MB
Sample261112-qbc1kaff74
SHA256 88da33f2df5c7f93087eb95d529546a1e2353874dc481b68ff772ce8a1ae39ef
MD5 b285294c514c9cc9008e7f83284567ac
SHA1 689e1571050da2781cd7d95e86e85a61da17c98d
SHA512 6a654f9f7900a9db43f431eacc8186d0dbf7c3462c49c6bb84f201926fd62f746e2ec1fb68cc530ce67bee28e2ff0a52fa5186f8d447b9a88d89166598c38b2b
SSDEEP 1572864:A2W3t0INtddP4FNsXg0t+bF3DYSxqzt9UoDbAm48jq4KX5eDx38:A2WGGddKNsXgBbFESUzt93bAmnW4KX5d
TLSH
T13E0833246B8F1F3627A5D81416EDD3FC48185D7523D1E42739DA3249FAB2A24B3E8B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

nsnosi-39204.portmap.host:39204

Mutex

2d0e172638c2c9421956c55c799f0c77

Attributes

reg_key
2d0e172638c2c9421956c55c799f0c77
splitter
|'|'|

Targets

- Target
  NeptuneRat V5.0 Cracked By KAKA/CoreAudioApi.dll
- Size 30KB
- SHA256 774a23dc38b9a7edcb15b4fce2ee24a786af82507b5dfc6aaa23e058fabb7a9c
- MD5 b9ffcd8b7f491d4aa65edbbbcc797ad1
- SHA1 fa476dcf62f96b3f0e3c9428678c2884054deffb
- SHA512 bc79a5840288c5d3898b61d3a51785faf0b815024cc47f7b037ee534fe51ba83b2a77521f946f8debc4d8029405a312b167c28c709ff12ccabc23123a64a06cc
- SSDEEP 384:J14ZUQwsT/RzKuk2J5RfTG86k16WEYJS/o7bGg4r4hTWPhTgIYi4Gjghv:0eQwg5zK2/BG8bErolDhSPhTpYi4Wghv
- TLSH
  T1A3E24B96C6609926CF9E83F878EB0B218770D2467363D3DD235C9078BF5235207A92B3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  NeptuneRat V5.0 Cracked By KAKA/FastColoredTextBox.dll
- Size 333KB
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH
  T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  NeptuneRat V5.0 Cracked By KAKA/GMap.NET.Core.dll
- Size 2.9MB
- SHA256 58c755fcfc65cddea561023d736e8991f0ad69da5e1378dea59e98c5db901b86
- MD5 819352ea9e832d24fc4cebb2757a462b
- SHA1 aba7e1b29bdcd0c5a307087b55c2ec0c7ca81f11
- SHA512 6a5b0e1553616ea29ec72c12072ae05bdd709468a173e8adbdfe391b072c001ecacb3dd879845f8d599c6152eca2530cdaa2c069b1f94294f778158eaaebe45a
- SSDEEP 49152:ot12Gb/hz7ZsK9qY5uyUW57VC4IB1+fXhQ1hyCzMw/22fSg7gjxhUE/nbTC0xemh:oLbteKb57W1+PhQ1HM1gmJ/SZmh
- TLSH
  T152D5234D77FC068BF5BFDBBD7870069A8331F106AA37E30E15A154A91D23B818851BA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  NeptuneRat V5.0 Cracked By KAKA/GMap.NET.WindowsForms.dll
- Size 147KB
- SHA256 741e1a8f05863856a25d101bd35bf97cba0b637f0c04ecb432c1d85a78ef1365
- MD5 32a8742009ffdfd68b46fe8fd4794386
- SHA1 de18190d77ae094b03d357abfa4a465058cd54e3
- SHA512 22418d5e887a6022abe8a7cbb0b6917a7478d468d211eecd03a95b8fb6452fc59db5178573e25d5d449968ead26bb0b2bfbfada7043c9a7a1796baca5235a82b
- SSDEEP 3072:k1GmgYqIY/0YSDBRGlDUqL63budipxj64m8HWYh3vHbFwMhLJSb+:lIO6rGloqL63qW62lJ
- TLSH
  T1DCE3BF6173A58D2FD6BF4BBFA46240C1A371E603F602C38D6D8820ED2897F5587523A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  NeptuneRat V5.0 Cracked By KAKA/Guna.UI2.dll
- Size 2.1MB
- SHA256 e658e8a5616245dbe655e194b59f1bb704aaeafbd0925d6eebbe70555a638cdd
- MD5 c97f23b52087cfa97985f784ea83498f
- SHA1 d364618bec9cd6f8f5d4c24d3cc0f4c1a8e06b89
- SHA512 ecfa83596f99afde9758d1142ff8b510a090cba6f42ba6fda8ca5e0520b658943ad85829a07bf17411e26e58432b74f05356f7eaeb3949a8834faa5de1a4f512
- SSDEEP 49152:cvrqKk8q2gqi2OXCt6kuSw9g8PTNTN/23uxjPHEiCAjFcm:cvrqZr
- TLSH
  T16EA50A197DD4EE27D16ACE33D6D25021E3F1E4932AB2EB0E72D357681842349788637E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  NeptuneRat V5.0 Cracked By KAKA/IconExtractor.dll
- Size 10KB
- SHA256 440912d85d2f98bb4f508ab82847067c18e1e15be0d8ecdcff0cc19327527fc2
- MD5 640d8ffa779c6dd5252a262e440c66c0
- SHA1 3252d8a70a18d5d4e0cc84791d587dd12a394c2a
- SHA512 e12084f87bd46010aded22be30e902c5269a6f6bc88286d3bef17c71d070b17beada0fe9e691a2b2f76202b5f9265329f6444575f89aff8551c486eafe4d5f32
- SSDEEP 192:7f77J4cGYyfQknxLvIgyLY5xJeU5pPpZlEAs:HS2yINgyLYLJR5wl
- TLSH
  T179223809E7EA4B37DEB7873654134656E334BA10994FEF5B05CA50642CA73A00B12FBA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  NeptuneRat V5.0 Cracked By KAKA/Microsoft.Win32.Registry.dll
- Size 22KB
- SHA256 619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
- MD5 da40f3db8b34571684c0cb5bcecd2a79
- SHA1 1c27a41fd84d6bfe99dabae2e59fcf12fccf6213
- SHA512 e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
- SSDEEP 384:z8a6WQCgE7MHVia7Z7aLPQmlJLfbTWnWDxW8QHRN74fZalxA2:AJCp70ViyrmlDt84a
- TLSH
  T18FA22A02EFE8402FFFF70E3519B5D9225D76FAC62902864E1958D2CE5DB2BC4D630629
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  NeptuneRat V5.0 Cracked By KAKA/NAudio.Asio.dll
- Size 33KB
- SHA256 ca03780217139b37f7f5b6921d59defb8d24988315b16b167a77fa88caa7d00f
- MD5 eb254b04d63a9f03b77563243805f68f
- SHA1 b01c83ec51f7a6548d1babb5e5ff8d5b944965a1
- SHA512 af40c8b9753ebd5abdefad82597dcefc3e5272e917657e3cc7d7961ee8e0070c04f964df456eaa92c8ba832b1967f35ac57490fa2adab2164f323e778979ef9c
- SSDEEP 768:gehRrWpB5henf0HTYdpVCYKo9c1e6ttHjB6Ca:gehRr68M47hGtHF4
- TLSH
  T16FF22B71EBE88A27C92E2779B4F2040407B5F190F623E74F9A4C54AA6FE63594790373
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  NeptuneRat V5.0 Cracked By KAKA/NAudio.Core.dll
- Size 183KB
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
- MD5 48867f392b8e77dc06c062638c6fbd36
- SHA1 ccc0931e2cf3d6d79e24c1f28d9c96b40c131af6
- SHA512 b536e18c482dcf810ec30b9a943ec06e0ca4f6f2bd8f187b807a9a9fd90d28c4c2fb69bada4766c72e0b7942f5e7d40dd94b193ab01e68f666838698bbb473bc
- SSDEEP 3072:n5nFpdQWUY6GwfIGsnLRp2qr2eeY0nVuEtEVEOUkk6uSYsM+S76t:jpdQJY6GwfIGyRp2qI/VZtEVETtHG
- TLSH
  T1CE046D2963E84256E5AFABB1F0F208175BF1F4463037DB0E5D806AE92A07B11C562F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  NeptuneRat V5.0 Cracked By KAKA/NAudio.Midi.dll
- Size 45KB
- SHA256 f246e29921797b173b54229685e997a11f9cc388fa1e589c212328abd7a94ebe
- MD5 3f5c79100f4f7902114c3fcba275c606
- SHA1 cb874b2a2561239b5b1c30a49574229716f5f62d
- SHA512 e435b839a769572a251cb07238020f2496bef97949a3b3159e85c12327e4399a2adca67bb5b2a0606318ca9b5c7ea99bf013a431c72034ce51f9224721a4cf79
- SSDEEP 768:lwuDUaOqgwjYpA2kn+sbS+O/RXgQPODHM0Mx7YlEmmSFyaetiWvmYRMUQ6LUOu5+:lwuDU7fwT2k+sbRMZgQP6HM0Mx7cPXeN
- TLSH
  T103232915A3F8861AE2BF7B79FC7056100BB2B9867A32D74F0AD8686D1D237844C61773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  NeptuneRat V5.0 Cracked By KAKA/NAudio.Wasapi.dll
- Size 175KB
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
- MD5 278ebb79da14ecf8e0559530c2fda076
- SHA1 8a45f0400f6bc46d254120345fd5e39b6c9b71a1
- SHA512 f789600a820ff4286cb323c4f9dfb6b44001be9295bb24973308363a2668761055e807c7ebcb53900293f4be71c6b5ca328075c230b1ea8270f0d76e3ec477bc
- SSDEEP 3072:ZTo4k5xAt4T6awobjXGUHVUbLuh9aaWIiEKILT9rPr/duoSabKj5BIfgmFyjaKv9:ZTxk5xc4W+VU69aaWfIFzDoI44
- TLSH
  T121046C3537E88967C1EF97B4F8F2294787B1E0463A13AF8D15C45F256D13BA24804BAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  NeptuneRat V5.0 Cracked By KAKA/NAudio.WinForms.dll
- Size 40KB
- SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
- MD5 be8205f435b2afbfd178960c46310c17
- SHA1 6cf807daa6ab142ead6619addf8fc11c56dd51f9
- SHA512 c0cb8ed1381c932a222814084bb50788f51d863b306ba41bfd5b548930ba6939fb0cea8a39f1f171247c461e4d67a1f0aef4207216bdcbfe770e6715d8f5e522
- SSDEEP 768:ZNMJ4j7TupqLq+VHDvtiT8dDDOCPRtbQDmZ1RST+WjQ2fPj9N2fq:fuiqP8d3OMzbQDmjM
- TLSH
  T165033B25935CC37BCA2F1A7E48651105037AEA84B441EFEA7DCC729D9D83B421720BE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  NeptuneRat V5.0 Cracked By KAKA/NAudio.WinMM.dll
- Size 56KB
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
- MD5 faf1ba532964984a34d60674fbc7a5a7
- SHA1 0999178949de510a47d87de3b8a117a003c572ee
- SHA512 d23b783bfd55a09c726ba09d627dfcc6c22a6e7bed8a53dff72c349bbe6fb190afb574cc267b7bebed1540b0bf834f259b5d03b50e023881b3ec42a8b2b57f1f
- SSDEEP 768:cQFu51JOtZ+Wr3CJBTNoNfDhPrDVSvxu1tEMgGd8GbpDrXa8Rcer+7Ul:cQ8zvWr3CJZNYDhP9Svxu1tEufpDuil
- TLSH
  T12A434B013BD8427AD2FE1B3EA1F30A524731A8D6796BFB4F1598F1DA9853B8049017B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  NeptuneRat V5.0 Cracked By KAKA/NAudio.dll
- Size 7KB
- SHA256 8bf0f2e8dadf3967757191c2212c269333ccd9d7e59839eea968212c64787be9
- MD5 c583aa3819b16ae53859f728f59ea9a0
- SHA1 b699e8e2cfc52bc3cfba182fdabfc7f6ff8f82de
- SHA512 580fa002b890c6c36dd907b40a121153eb12192721e67b7209c9bffedf8e18128b75ed454d813b67c67040fe5869816ac10e624cd8dce68917a85dd5426a490b
- SSDEEP 96:GBFskeJHn4jZkcLqEm5Nj7AVUhkon1MrtrRGD5pkQa1LrjSd2V:G7kHn4kcLaj7zSon1MRlvQa1fjSm
- TLSH
  T14AF1D729A398C676CA674BF1A42703400339EB40EA57CB2D0D9CA59FFD133185AB27D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  NeptuneRat V5.0 Cracked By KAKA/NeptuneRATv5.0ERSHION.exe
- Size 45.4MB
- SHA256 94ec4411f516d5a00dcf9caa22a2f3ebb8ae772de2d53d74747538635c64320e
- MD5 25977079a2cd6dbac69a5ea78e22d656
- SHA1 242e15097c9f0f8370cd2aa72c57883dc1102574
- SHA512 4ab79f37d3c6020f13c63982192ef1cecc21fccce87cb57ac949330395c3274065958dd080b69b69e96fa9caba74c8496aeee9e67733652209d46e9ff62e7bb8
- SSDEEP 786432:YmidkDguXbH2D2s0ak6aEhle5q9rnmEcLjHgN1jbnUfeWsKHawhZ+oFC23T6npc6:YmxDjXbHE2s0v6aGeXX8jbUOaFgKYy
- TLSH
  T10DA733AA20CE60CD40F8953EFC5935ABEE86E5A2FDDD13ADD9DE1915C32913001279BC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

hacked defense_evasion discovery neptunerat njrat persistence privilege_escalation trojan
- Detects NeptuneRAT stealer
- Family: NeptuneRAT, MasonRAT
  NeptuneRAT aka MasonRAT is a trojan written in C#.
  trojan neptunerat
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral29 behavioral30
- Target
  NeptuneRat V5.0 Cracked By KAKA/Plugins/7zip.dll
- Size 1.3MB
- SHA256 2562825c7a40f36791e81906f7a3e77e41e5225cf1c8feaf2dbbb1fe0f767609
- MD5 ec5917afced382500686a1df74cb1dff
- SHA1 d69886bc5faae9fcec25e5c3ee6b8a0cf4850287
- SHA512 e6b3de065e542c14be07336d8134a282e956aee22b962b822a3340bf68157258997333f329cf9214475bd07369da729b014a616fad3582a29800cecff2b7879a
- SSDEEP 24576:m0/LsiV9P+XbiDmHzsvTK6BN2TBQLge+ErnuIAr24sNhHXZ:mcLsk9Pk6gAK6BN2NQUe+ErnuVqjNhHX
- TLSH
  T14F558D15BBF1C078CA8A46318A2DABB550F9E71FCE1058C727C0AE6E6F31CD5D225A4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32