Overview

overview

10

Static

static

3

NEAS.61938...d0.exe

windows7-x64

10

NEAS.61938...d0.exe

windows10-1703-x64

10

NEAS.61938...d0.exe

windows11-21h2-x64

10

Resubmissions

01-03-2024 15:48

240301-s8texshf59 10

28-10-2023 08:48

231028-kqhlpshg43 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NEAS.61938cbcbc6783b0bacce20cf948ebd0.exe

  • Size

    5.3MB

  • Sample

    240301-s8texshf59

  • MD5

    61938cbcbc6783b0bacce20cf948ebd0

  • SHA1

    f558733723faedb7b91acb82a31932dad9b880c1

  • SHA256

    9a09207752a0c69c07f5e9025d4be4837e42b92726668586e4d7cd838258327b

  • SHA512

    fd7c276839edeb162f17955f8d6681be0c51ae9577756830105dbd93ba68453cf9d7f23fb8e562e6449fcbce72c739096ebd239ba75d3cb12681d26c9be96ef4

  • SSDEEP

    98304:mYVEl27OuKr+gvhf2Z9Nzm31PMogNuSZTKA0t9FFPEzlkqXf0FKp806Ucn:mOXOuK6mq9NzgMoIbk9fcpkSIKpb6Ucn

Score
10/10
milleniumratpersistenceratspywarestealer

Malware Config

Targets

    • Target

      NEAS.61938cbcbc6783b0bacce20cf948ebd0.exe

    • Size

      5.3MB

    • MD5

      61938cbcbc6783b0bacce20cf948ebd0

    • SHA1

      f558733723faedb7b91acb82a31932dad9b880c1

    • SHA256

      9a09207752a0c69c07f5e9025d4be4837e42b92726668586e4d7cd838258327b

    • SHA512

      fd7c276839edeb162f17955f8d6681be0c51ae9577756830105dbd93ba68453cf9d7f23fb8e562e6449fcbce72c739096ebd239ba75d3cb12681d26c9be96ef4

    • SSDEEP

      98304:mYVEl27OuKr+gvhf2Z9Nzm31PMogNuSZTKA0t9FFPEzlkqXf0FKp806Ucn:mOXOuK6mq9NzgMoIbk9fcpkSIKpb6Ucn

    Score
    10/10
    milleniumratpersistenceratspywarestealer

    • MilleniumRat

      MilleniumRat is a remote access trojan written in C#.

      ratstealermilleniumrat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3

MITRE ATT&CK Enterprise v15

Tasks