milleniumrat

General

Target

setup.exe
Size

34.0MB
Sample

240619-mmpxqatapp
MD5

e06e0cb58af7fbb8df8412cca867f8b5
SHA1

edd23b2208b48de244f1ed11f33f6e3ecc2410b1
SHA256

61697b802f3d7906805f4563f41c6aaa5c0164dcccb6530f7997babca529bf2d
SHA512

09c6ca848a8aec6a224089478c19b7e34f3157d075fe42cb2cc0cfe2413b7520b6d236ca99b9f7927de77368ee683d987d3e44fbcc09dc8b794bd32510b5b074
SSDEEP

786432:4RQBr9FRIY2ZzwwIiJmQZNKCIEHG3KSUpzxAR8smu8XRiH:4ROrbRIY2DvJmQZNKXEzpzxK83uKY

Score

10^/10

Malware Config

Targets

- Target
  
  setup.exe
- Size
  
  34.0MB
- MD5
  
  e06e0cb58af7fbb8df8412cca867f8b5
- SHA1
  
  edd23b2208b48de244f1ed11f33f6e3ecc2410b1
- SHA256
  
  61697b802f3d7906805f4563f41c6aaa5c0164dcccb6530f7997babca529bf2d
- SHA512
  
  09c6ca848a8aec6a224089478c19b7e34f3157d075fe42cb2cc0cfe2413b7520b6d236ca99b9f7927de77368ee683d987d3e44fbcc09dc8b794bd32510b5b074
- SSDEEP
  
  786432:4RQBr9FRIY2ZzwwIiJmQZNKCIEHG3KSUpzxAR8smu8XRiH:4ROrbRIY2DvJmQZNKXEzpzxK83uKY
Score

10^/10

milleniumrat discovery evasion execution persistence privilege_escalation pyinstaller rat spyware stealer upx
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Contacts a large (1181) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1