milleniumrat

General

Target

Maple Raider Latest.zip
Size

34.0MB
Sample

240719-ajvycawhkc
MD5

8fe6a73f0343be2e24a13ab1ec9aa88b
SHA1

6b35ef56e44bd1e92da056468b1d6500bdc8933e
SHA256

4b86d94ea8d7d5b71d124fdb17165df75aaee0c89d206384f7653839e696d542
SHA512

2818c65005b35f7cf6765e6afddcd13f1e19e4ed8ee38d8d7deaa804fe777d7b2f6f99928dc810e7cbde2020cf1e574fca8871502f537b9996f9ee6f4bf8003a
SSDEEP

786432:mPe3BTkI2Fkux0SqWSig+4UerqocrqQm8SUxXRZL2hkrZK:mPgBTT2FkO0dWSigPwGQjZik8

Score

10^/10

Malware Config

Targets

- Target
  
  Maple Raider Latest/Maple Raider.exe
- Size
  
  34.1MB
- MD5
  
  ba1d0780f519ee2807e153d51df5916e
- SHA1
  
  03f9b5b21a1911ea068e668b041ff827ca0891d7
- SHA256
  
  aefa057d6fb6507bf21f0243fe2c57a8614fdde589faa78b21929e483ff98a29
- SHA512
  
  d31b05daeb984427c4b5c476169cdab442723c51324938fc3df700f91ecb35b5b5ba5b1b11297c170fcee0bf2c56d9db7b2ef18b289042eb7a7373745faa9d89
- SSDEEP
  
  786432:3p039FS+ab44n6ASQSc6k00CZcKoTMS4uEgbFtNFEtKN:3ps9Fnab4+6DQSc6JUCS1NOK
Score

10^/10

milleniumrat discovery evasion execution persistence privilege_escalation pyinstaller rat spyware stealer upx
- Deletes Windows Defender Definitions
  Uses mpcmdrun utility to delete all AV definitions.
  evasion
- MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts a large (1908) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Stops running service(s)
  evasion execution
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1