Detects MilleniumRAT stealer

Family: MilleniumRat

MilleniumRat is a remote access trojan written in C#.

Family: xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

Modifies Windows Defender DisableAntiSpyware settings

Modifies Windows Defender Real-time Protection settings

Modifies Windows Defender notification settings

XMRig Miner payload

Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: PowerShell

Powershell Invoke Web Request.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Disables one or more Microsoft Defender components

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Downloads MZ/PE file

Uses browser remote debugging

Can be used control the browser and steal sensitive information such as credentials and session cookies.