milleniumrat

General

Target

e4897ef7419e128b1f7473119ce0bd07.bin
Size

44.1MB
Sample

240511-d7gmeaea42
MD5

4a58d641266350d5157ed7de025e6c18
SHA1

e06a224bcf722cca63f1c2616f39d041c3fc4b80
SHA256

f4409a46a0cca24cb547a077191891f8837a3aa91ad53ef77b59c97c2cf4ca15
SHA512

e08c27fe5155280ebde89ad3efb1d91e081110fbb90b6c0df55c2cfc81b0cc4213456fb4fd64e47535113590a5c66e80c42c074285729cf979b54fcfad36ad4c
SSDEEP

786432:n7pCdSJi3MZYT9kl0xMzYAxwer9kOLhHpGrvOaNn6IxV+oEG2/YR33Lpw26yo1wg:nVpw3ca9kl0xg9t9kyhJGFnuoJ2O3iWq

Score

10^/10

Malware Config

Targets

- Target
  
  6d5ba38a5e9bde7939ac5dcb8fdcb970701168064d30abcf518cf8d272a0f581.exe
- Size
  
  44.1MB
- MD5
  
  e4897ef7419e128b1f7473119ce0bd07
- SHA1
  
  5aad252412a5923438f30cb9c397731a9b020121
- SHA256
  
  6d5ba38a5e9bde7939ac5dcb8fdcb970701168064d30abcf518cf8d272a0f581
- SHA512
  
  db66ea2cb3f5f30934ab071e1dd2e7b41f6dc5c4be125f1d2d6aab627b3be8b6cf8fcbed517a414cdf037a068414b178176edba2e28de6419b65269e0abb162c
- SSDEEP
  
  786432:NCZkrrfdktmLX8t8lBBvUPlZIOPuOI64zlNWtVMoOIsuXzfVib4a9BWN:N4GlkcLMtUzilKUINzmtVkMfWo
Score

10^/10

pyinstaller upx milleniumrat discovery evasion execution persistence rat spyware stealer
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts a large (1167) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Stops running service(s)
  evasion execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2