milleniumrat

General

Target

DarkRATBuilder.exe
Size

35.2MB
Sample

240529-dbne3sgd82
MD5

ab30bdd94d86e5546b02d5bdb62f238b
SHA1

03b20cc376db4af83c74e8f51eb83aaa6a26a904
SHA256

44f36dc1c320aa66475542842ee04f9e8e22841071c7ae0b25563bd2c3b78d5d
SHA512

18876c581903e95f45cf8d59fc6a2de865d074a2a9e641c5ce242413b093e50a77fcd37e3d95adb37de2c17242732df27b9c7656423491f72d4e1d4f2f6ee21f
SSDEEP

786432:lRaNrV2IXxHOueDcZdDPbp1m7Uwai+lkWppvlqKtKN:lR0rV5uuFp1cDai+2WfIKtK

Score

10^/10

Malware Config

Targets

- Target
  
  DarkRATBuilder.exe
- Size
  
  35.2MB
- MD5
  
  ab30bdd94d86e5546b02d5bdb62f238b
- SHA1
  
  03b20cc376db4af83c74e8f51eb83aaa6a26a904
- SHA256
  
  44f36dc1c320aa66475542842ee04f9e8e22841071c7ae0b25563bd2c3b78d5d
- SHA512
  
  18876c581903e95f45cf8d59fc6a2de865d074a2a9e641c5ce242413b093e50a77fcd37e3d95adb37de2c17242732df27b9c7656423491f72d4e1d4f2f6ee21f
- SSDEEP
  
  786432:lRaNrV2IXxHOueDcZdDPbp1m7Uwai+lkWppvlqKtKN:lR0rV5uuFp1cDai+2WfIKtK
Score

10^/10

upx milleniumrat discovery evasion execution persistence pyinstaller rat spyware stealer
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Contacts a large (1228) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  main.pyc
- Size
  
  437B
- MD5
  
  e3a83cc96bc468e8ed5e99b61ab1b08c
- SHA1
  
  fc094fba9141e8ace98cce0309e1472b2471b631
- SHA256
  
  893f6af6a7c380817dd8a1e5f63e72225b82c9775dc8ca40a449ed86c0427932
- SHA512
  
  6d629486b39cef47bd2ce9b79ff792eebee83e4bdcbb30a756aabcbce75473a732ce2f3e89f0d200a4f9dc98765ce07538a9737cd428b2b372a6d36f4e78630d
Score

3^/10
behavioral3 behavioral4