milleniumrat

General

Target

hacn.exe
Size

24.0MB
Sample

240512-eykhdagc6v
MD5

b9f3e6e06f33ee7078f514d41be5faad
SHA1

e2d35bc333ec6ff0f6ae60e55daca44a433fc279
SHA256

a7c3208cf3067d1da12542cab16516c9085620959deb60dd000e190f15c74758
SHA512

212a6540082a20de6798d53e2c6f7f5705e5e4164620aa7f08a366e747f240c59c4c70ce0b8dd00625a0a960d1615073b4e48b2707abe767b422f732c5927bed
SSDEEP

393216:IDfDoc6/4m7/VBPt2XP8b/B+6M+8TIZ/iy1K4yoJq1HmnlOUyv5fkpHwsX:Ib7QvBt2XP8DB+DlSJ1K4y5PhSQ

Score

10^/10

Malware Config

Targets

- Target
  
  hacn.exe
- Size
  
  24.0MB
- MD5
  
  b9f3e6e06f33ee7078f514d41be5faad
- SHA1
  
  e2d35bc333ec6ff0f6ae60e55daca44a433fc279
- SHA256
  
  a7c3208cf3067d1da12542cab16516c9085620959deb60dd000e190f15c74758
- SHA512
  
  212a6540082a20de6798d53e2c6f7f5705e5e4164620aa7f08a366e747f240c59c4c70ce0b8dd00625a0a960d1615073b4e48b2707abe767b422f732c5927bed
- SSDEEP
  
  393216:IDfDoc6/4m7/VBPt2XP8b/B+6M+8TIZ/iy1K4yoJq1HmnlOUyv5fkpHwsX:Ib7QvBt2XP8DB+DlSJ1K4y5PhSQ
Score

10^/10

milleniumrat evasion execution persistence pyinstaller rat spyware stealer
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1