milleniumrat

General

Target

dMFze0m (1).txt
Size

8KB
Sample

240508-ryzcrabf22
MD5

1acf7d95a7bdc26f705ac2d28c639c86
SHA1

13a3b861784ae514db234117aaa218cf89d34cd3
SHA256

4f9518ccfafdbbf51fd0eb53be9aadf072de8107b80a917f5d4be9bc04baffec
SHA512

4a89a7626f7a4dd52b5fcf1dc88a19d21dc1880b8ccef999964216d6520f5c3a3ad1e02e0d18673d92e69a0496567637468cdd1c4be72a125e88af4426d97471
SSDEEP

96:x6Sdnr71M1PQb4XuS77sboE9VBT5/0O2FS+jvd1p9ERQUWdPG7L9HiIdrQ/U75WS:xDnHdjXite4g7Zv5Ol6t

Score

10^/10

Malware Config

Targets

- Target
  
  dMFze0m (1).txt
- Size
  
  8KB
- MD5
  
  1acf7d95a7bdc26f705ac2d28c639c86
- SHA1
  
  13a3b861784ae514db234117aaa218cf89d34cd3
- SHA256
  
  4f9518ccfafdbbf51fd0eb53be9aadf072de8107b80a917f5d4be9bc04baffec
- SHA512
  
  4a89a7626f7a4dd52b5fcf1dc88a19d21dc1880b8ccef999964216d6520f5c3a3ad1e02e0d18673d92e69a0496567637468cdd1c4be72a125e88af4426d97471
- SSDEEP
  
  96:x6Sdnr71M1PQb4XuS77sboE9VBT5/0O2FS+jvd1p9ERQUWdPG7L9HiIdrQ/U75WS:xDnHdjXite4g7Zv5Ol6t
Score

10^/10

milleniumrat discovery evasion execution persistence pyinstaller rat spyware stealer
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Contacts a large (19960) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Blocklisted process makes network request
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1