milleniumrat

General

Target

https://cdn.discordapp.com/attachments/1250327383010181161/1258646575874441356/jet.zip?ex=669207f8&is=6690b678&hm=d5e2c78322d5e564f7ce36782ec9e5b5ca4235455e3f20c5b52e52c43433931f&
Sample

240712-q1x22awckj

Score

10^/10

Malware Config

Targets

- Target
  
  https://cdn.discordapp.com/attachments/1250327383010181161/1258646575874441356/jet.zip?ex=669207f8&is=6690b678&hm=d5e2c78322d5e564f7ce36782ec9e5b5ca4235455e3f20c5b52e52c43433931f&
Score

10^/10

milleniumrat discovery evasion execution persistence pyinstaller rat spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Contacts a large (1045) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1