Overview

overview

10

Static

static

3

main.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    main.exe

  • Size

    5.6MB

  • Sample

    240528-satb9saf78

  • MD5

    5df3e2c717f267899f37ec6e8fc7f47a

  • SHA1

    5e980079f67215bf69b8c1c16b56f40bf4a29958

  • SHA256

    e3f5c557ece7ec27cb7e4a26482eadf0d9065065d94b2919f9b881bc74800e6e

  • SHA512

    8cef1184120e010421d69fcf271822b3f0b45e34a1565152a3f2decb8f500d0e69de9816d9075683fcfb0f431713f3fbc42ac2d87503cdcdde125aba3fa1635d

  • SSDEEP

    98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR65:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciN

Score
10/10
milleniumratpersistenceratspywarestealer

Malware Config

Targets

    • Target

      main.exe

    • Size

      5.6MB

    • MD5

      5df3e2c717f267899f37ec6e8fc7f47a

    • SHA1

      5e980079f67215bf69b8c1c16b56f40bf4a29958

    • SHA256

      e3f5c557ece7ec27cb7e4a26482eadf0d9065065d94b2919f9b881bc74800e6e

    • SHA512

      8cef1184120e010421d69fcf271822b3f0b45e34a1565152a3f2decb8f500d0e69de9816d9075683fcfb0f431713f3fbc42ac2d87503cdcdde125aba3fa1635d

    • SSDEEP

      98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR65:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciN

    Score
    10/10
    milleniumratpersistenceratspywarestealer

    • MilleniumRat

      MilleniumRat is a remote access trojan written in C#.

      ratstealermilleniumrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks