milleniumrat | 5d66d19e7429cd359f0312d9747c23dc14deb88175a698c1a4d77f8f4c73082d

General

Target
2026-05-11_eee060302ae2dbe1d7502cff7fb7074a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
Size 2.6MB
Sample260511-tqdgeset2w
SHA256 5d66d19e7429cd359f0312d9747c23dc14deb88175a698c1a4d77f8f4c73082d
MD5 eee060302ae2dbe1d7502cff7fb7074a
SHA1 019ab7d465585638a218b52a7ced9287c8bcb1ab
SHA512 febe7f3f6e27183f7fccfabe97f6645e66b7883e9458436d44ae49ddb9b49f018b7b04c7bea65896bb054340357c781d9c2119ae55e4eec7a1ef27e47b7e1165
SSDEEP 49152:TsUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrUdDU63XYWVCT3e:labwR0b5R2EoVUQB3G+VUkJ8g6
TLSH
T19ED59E21F68290B2E4E701B056BFABF64D787631173594CBF3C01E6959206C27B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-05-11_eee060302ae2dbe1d7502cff7fb7074a_amadey_darkgate_elex_glassworm_luca-stealer_njrat_smoke-loader
- Size 2.6MB
- SHA256 5d66d19e7429cd359f0312d9747c23dc14deb88175a698c1a4d77f8f4c73082d
- MD5 eee060302ae2dbe1d7502cff7fb7074a
- SHA1 019ab7d465585638a218b52a7ced9287c8bcb1ab
- SHA512 febe7f3f6e27183f7fccfabe97f6645e66b7883e9458436d44ae49ddb9b49f018b7b04c7bea65896bb054340357c781d9c2119ae55e4eec7a1ef27e47b7e1165
- SSDEEP 49152:TsUtl5PgbwRocdFGwitnRyjEoxLUQV+i3G+nYE6bW1rAkJKGrUdDU63XYWVCT3e:labwR0b5R2EoVUQB3G+VUkJ8g6
- TLSH
  T19ED59E21F68290B2E4E701B056BFABF64D787631173594CBF3C01E6959206C27B3AB5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution milleniumrat rat spyware stealer credential_access
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Custom signature
  
  Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Custom signature
  
  Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Custom signature
  
  Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Custom signature
  
  Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Custom signature
  
  Detects executables containing possible sandbox analysis VM names
- Custom signature
  
  Detects executables containing possible sandbox analysis VM usernames
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2