Overview
overview
8Static
static
3skytools.exe
windows10-2004-x64
4skytools.exe
windows11-ltsc_2024-x64
4OpenSteamTool.dll
windows10-2004-x64
1OpenSteamTool.dll
windows11-ltsc_2024-x64
1dwmapi.dll
windows10-2004-x64
1dwmapi.dll
windows11-ltsc_2024-x64
1millennium...64.exe
windows10-2004-x64
1millennium...64.exe
windows11-ltsc_2024-x64
1millennium...64.exe
windows10-2004-x64
1millennium...64.exe
windows11-ltsc_2024-x64
6millennium...um.dll
windows10-2004-x64
1millennium...um.dll
windows11-ltsc_2024-x64
6millennium...64.dll
windows10-2004-x64
1millennium...64.dll
windows11-ltsc_2024-x64
1luatools/....dex.js
windows10-2004-x64
3luatools/....dex.js
windows11-ltsc_2024-x64
3luatools/....kit.js
windows10-2004-x64
3luatools/....kit.js
windows11-ltsc_2024-x64
8luatools/b...st.bat
windows10-2004-x64
1luatools/b...st.bat
windows11-ltsc_2024-x64
8luatools/b...ys.vbs
windows10-2004-x64
1luatools/b...ys.vbs
windows11-ltsc_2024-x64
1luatools/b...ds.bat
windows10-2004-x64
1luatools/b...ds.bat
windows11-ltsc_2024-x64
1luatools/b...am.cmd
windows10-2004-x64
1luatools/b...am.cmd
windows11-ltsc_2024-x64
1luatools/b...er.ps1
windows10-2004-x64
3luatools/b...er.ps1
windows11-ltsc_2024-x64
8luatools/b...der.sh
ubuntu-18.04-amd64
3luatools/b...der.sh
debian-9-armhf
4luatools/b...der.sh
debian-9-mips
3luatools/b...der.sh
debian-9-mipsel
3Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/06/2026, 16:04
Static task
static1
Behavioral task
behavioral1
Sample
skytools.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
skytools.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
OpenSteamTool.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
OpenSteamTool.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
dwmapi.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
dwmapi.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
millennium/bin/millennium.crashhandler64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
millennium/bin/millennium.crashhandler64.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
millennium/bin/millennium.luavm64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
millennium/bin/millennium.luavm64.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
millennium/lib/millennium.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
millennium/lib/millennium.dll
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
millennium/lib/millennium.hhx64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
millennium/lib/millennium.hhx64.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
luatools/.millennium/Dist/index.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
luatools/.millennium/Dist/index.js
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
luatools/.millennium/Dist/webkit.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
luatools/.millennium/Dist/webkit.js
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
luatools/backend/api_manifest.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
luatools/backend/api_manifest.bat
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
luatools/backend/donate_keys.vbs
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
luatools/backend/donate_keys.vbs
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
luatools/backend/downloads.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
luatools/backend/downloads.bat
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
luatools/backend/restart_steam.cmd
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
luatools/backend/restart_steam.cmd
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
luatools/backend/scripts/downloader.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
luatools/backend/scripts/downloader.ps1
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
luatools/backend/scripts/downloader.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral30
Sample
luatools/backend/scripts/downloader.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral31
Sample
luatools/backend/scripts/downloader.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral32
Sample
luatools/backend/scripts/downloader.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
General
- Target skytools.exe
- Size 4.1MB
- Sample260620-th1a8ag17x
- SHA256 8badbf3137eff3ef29b93dc0da985aed4f974fca8c1f681601ab1c87d747b845
- MD5 e0ac877174e33d9a3cf1e2d2b39eb9e9
- SHA1 398de1c207f0d3c6fe5f140890c2e6013a9cd5b8
- SHA512 930ae3245b0910a3d3e31efe15b7364eb90b232e63e719ad306b10bf5876683a3b21d0bada9131ac4d682eb7b7e9c8a659a14517df03743d0351f0f007c61400
- SSDEEP 98304:g6uoe0/jI++/1V9QLZn234MIscUz7rIaebALUjdw24tFCig+wRYM:g6KwjI++/1VSFnG4WjzXM+KdYtFyR
- TLSH T1C21633668BF5D47DD8A4EB792F74480553E84210B2C876DBE3E0631DFCB6191E30ABA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Steam\OpenSteamTool.dll skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\donate_keys.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\da.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\en.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\fr.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\settings\options.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\themes.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\bin\millennium.luavm64.exe skytools.exe File created C:\Program Files (x86)\Steam\millennium\config\quick.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\plugin_utils.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\pt-decria.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\ru.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\original.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\fixes.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\es.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\pt-BR.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\temp_dl\extracted_3959110\3959110.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\forest.css skytools.exe File created C:\Program Files (x86)\Steam\dwmapi.dll skytools.exe File created C:\Program Files (x86)\Steam\millennium\lib\millennium.hhx64.dll skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\no.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\sv.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\ocean.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\purple.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\downloads.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\ar.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\pl.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\tr.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\scripts\downloader.sh skytools.exe File created C:\Program Files (x86)\Steam\xinput1_4.dll skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\.millennium\Dist\index.js skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\paths.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\cs.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\vi.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\zh-CN.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\rosepine.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\nl.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\peakstupid.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\pirate.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\lib\millennium.dll skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools plugin.zip skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\dracula.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\space.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\config\config.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\api.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\http_client.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\th.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\manager.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\zh-TW.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\temp_dl\3959110.zip skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\temp_dl\3959110_state.json skytools.exe File created C:\Program Files (x86)\Steam\wsock32.dll skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\plugin.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\.millennium\Dist\webkit.js skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\de.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\scripts\downloader.ps1 skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\temp_dl\extracted_3959110\228989_3514306556860204959.manifest skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\catppuccin.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\public\themes\dark.css skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\restart_steam.cmd skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\locales\ko.json skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\temp_dl\extracted_3959110\3959111_6230809352819513535.manifest skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\config.lua skytools.exe File created C:\Program Files (x86)\Steam\millennium\plugins\luatools\backend\temp_dl\extracted_3959110\228990_1829726630299308803.manifest skytools.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skytools.exe