General
- Target skytools.exe
- Size 4.1MB
- Sample260620-th1a8ag17x
- SHA256 8badbf3137eff3ef29b93dc0da985aed4f974fca8c1f681601ab1c87d747b845
Malware Config
Targets
-
- Target skytools.exe
- Size 4.1MB
- SHA256 8badbf3137eff3ef29b93dc0da985aed4f974fca8c1f681601ab1c87d747b845
Score4/10 -
- Target OpenSteamTool.dll
- Size 1.4MB
- SHA256 ed935ab85bf5c099322b473fdde9113ba64aaf67ddb37bf7cb2799e0df11af24
Score1/10 -
- Target dwmapi.dll
- Size 107KB
- SHA256 2195eabe75406c1acb2b241aaee9506114c7a421feb268880e1744d202b7c7e3
Score1/10 -
- Target millennium/bin/millennium.crashhandler64.exe
- Size 647KB
- SHA256 6cd3b1ccf19072b5ccfa77b4fb6cd452cec46c43b52eb41dfeeaff6b1451457f
Score1/10 -
- Target millennium/bin/millennium.luavm64.exe
- Size 2.5MB
- SHA256 5f887e74812c3a89be1da5c199b05cea115b1cadb8e5055bc9aad898d11d9329
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target millennium/lib/millennium.dll
- Size 3.5MB
- SHA256 edf6b6020094722cdca668624e20bf3a605c28f61a4eecb9b07826e5d268ae3a
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target millennium/lib/millennium.hhx64.dll
- Size 505KB
- SHA256 6b6149faa14f23ae2a008d33899179e76b1d94b8afe121463ac7c6c204f67e64
Score1/10 -
- Target luatools/.millennium/Dist/index.js
- Size 8KB
- SHA256 0c86e9362f6eaed7eeaa183ca818a6f389824ab1f249a5f47f15dd3238d75dba
Score3/10 -
- Target luatools/.millennium/Dist/webkit.js
- Size 21KB
- SHA256 5d2db00ba73c9503b707679ccb9167af4b859c83181471e973f537a678ad9102
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target luatools/backend/api_manifest.lua
- Size 12KB
- SHA256 5c3eb6af56381720814599a52f5acf54793d647846b87aaadd6e358a1730faa9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target luatools/backend/donate_keys.lua
- Size 6KB
- SHA256 085c67121538a6aaffe27a3dd5b8ff48f183baee1bf8367d72d589146107dc5a
Score1/10 -
- Target luatools/backend/downloads.lua
- Size 12KB
- SHA256 3daee7b417e2c7091607da921f8db8fa9c1c666abe8c82b9bdb7da3613d29d13
Score1/10 -
- Target luatools/backend/restart_steam.cmd
- Size 532B
- SHA256 0b17eeec8d2e0e72c5a896a1d9558ac06928e3e2edcf7af23428afe571aa790e
Score1/10 -
- Target luatools/backend/scripts/downloader.ps1
- Size 3KB
- SHA256 80b38e5f195ee246ff6e3e5503d3505fafa849f57a44284c5ed1d1a76861e8b4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target luatools/backend/scripts/downloader.sh
- Size 802B
- SHA256 8f68002b55fcb79a3c53e3ac662b5c01e23819e8426a69cedc668fe36d151235
Score4/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
2Virtualization/Sandbox Evasion
1System Checks
1