milleniumrat

General

Target

main.exe
Size

37.2MB
Sample

240612-hc2fjsshql
MD5

31125c6581ea8f49e9e42c6d9d6b8240
SHA1

a18eb575c3a1b8fa27de21603008c4e204eecd81
SHA256

aa5f1188b6ee04b295860df6da0ee047395bd566508aa570249a07919cdf0db8
SHA512

9a4c84d6ad4c547f614df3521e2fb0f4ad2b5c885b31aa0cd14d43abb48ef3f8c935e3b498c26e5f6a4262d6d37e867f5a4a3f41e32aa09477b61e64fb80ea75
SSDEEP

786432:8RQBrRSY+R46huYqwAO4YoMGD6Oafw2827HokWhSnuvluwhNnlxM:8ROrRR+R4WurwAO49QY2LtW0nuDhNnnM

Score

10^/10

Malware Config

Targets

- Target
  
  main.exe
- Size
  
  37.2MB
- MD5
  
  31125c6581ea8f49e9e42c6d9d6b8240
- SHA1
  
  a18eb575c3a1b8fa27de21603008c4e204eecd81
- SHA256
  
  aa5f1188b6ee04b295860df6da0ee047395bd566508aa570249a07919cdf0db8
- SHA512
  
  9a4c84d6ad4c547f614df3521e2fb0f4ad2b5c885b31aa0cd14d43abb48ef3f8c935e3b498c26e5f6a4262d6d37e867f5a4a3f41e32aa09477b61e64fb80ea75
- SSDEEP
  
  786432:8RQBrRSY+R46huYqwAO4YoMGD6Oafw2827HokWhSnuvluwhNnlxM:8ROrRR+R4WurwAO49QY2LtW0nuDhNnnM
Score

10^/10

milleniumrat discovery evasion execution persistence pyinstaller rat spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Contacts a large (1203) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2