milleniumrat

General

Target
main.exe
Size 36.9MB
Sample240604-2szrfaeh99
SHA256 fccf2be42bab41f3d1f8bb7778765729cdf5ed10a0bd65871ba3bd2b827c2402
MD5 4ce7dec7f0af15277eec727a9e20142e
SHA1 5bae148e9a1865370d25d805439e60f057806a04
SHA512 123fac8db9b2fea104fed3c57e304402bf1c02dbf1f19046f67ecadab67ed95af71ee8661e9d7b7b87a5b0cf092fa65fddc206d3557ada0b876ac00e6b2185b5
SSDEEP 786432:xRaNrdmuVZJW4j1B6O7WfE1StERPeJSu/6jsdbOr4q:xR0rEuTJWSfbyfEItERPeguAsd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  main.exe
- Size 36.9MB
- SHA256 fccf2be42bab41f3d1f8bb7778765729cdf5ed10a0bd65871ba3bd2b827c2402
- MD5 4ce7dec7f0af15277eec727a9e20142e
- SHA1 5bae148e9a1865370d25d805439e60f057806a04
- SHA512 123fac8db9b2fea104fed3c57e304402bf1c02dbf1f19046f67ecadab67ed95af71ee8661e9d7b7b87a5b0cf092fa65fddc206d3557ada0b876ac00e6b2185b5
- SSDEEP 786432:xRaNrdmuVZJW4j1B6O7WfE1StERPeJSu/6jsdbOr4q:xR0rEuTJWSfbyfEItERPeguAsd
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

upx milleniumrat discovery evasion execution persistence pyinstaller rat spyware stealer
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Contacts a large (1177) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2