milleniumrat

General

Target

Build.exe
Size

31.6MB
Sample

240716-qy28zayalg
MD5

28f7e77090b0fe1bcb891d09676e7ff0
SHA1

bfeaab2f17b342cbd884204cb6cc6be7c527f292
SHA256

0b6bab94b09244db88f470c10372a7e6d6d1286d6a10b63d9617f19415a3c2e1
SHA512

6341b08998cab66e07de36e08125819badcff9671d8c775a86a9b8808e3f1dca25e2f56c5bcddb57067e3936b9e641555eb6ea47b0fdbda2c2103d0e5a586504
SSDEEP

786432:SeMRQqeCr6EBCuQF2eBjQvhVElf1J+Xx64cFxBW:SePqfOEbwBjQvYpg6bxBW

Score

10^/10

Malware Config

Targets

- Target
  
  Build.exe
- Size
  
  31.6MB
- MD5
  
  28f7e77090b0fe1bcb891d09676e7ff0
- SHA1
  
  bfeaab2f17b342cbd884204cb6cc6be7c527f292
- SHA256
  
  0b6bab94b09244db88f470c10372a7e6d6d1286d6a10b63d9617f19415a3c2e1
- SHA512
  
  6341b08998cab66e07de36e08125819badcff9671d8c775a86a9b8808e3f1dca25e2f56c5bcddb57067e3936b9e641555eb6ea47b0fdbda2c2103d0e5a586504
- SSDEEP
  
  786432:SeMRQqeCr6EBCuQF2eBjQvhVElf1J+Xx64cFxBW:SePqfOEbwBjQvYpg6bxBW
Score

10^/10

milleniumrat discovery evasion execution motw persistence phishing privilege_escalation pyinstaller rat spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Contacts a large (69566) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Stops running service(s)
  evasion execution
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1