milleniumrat | 4f6994cecd3217d539b791710f0988e0c69c5d05f0ddd2c034b373383e2c1d43

General

Target
update1.exe
Size 2.7MB
Sample260626-phb66sbs6t
SHA256 4f6994cecd3217d539b791710f0988e0c69c5d05f0ddd2c034b373383e2c1d43
MD5 9fa99a4b6cf974e7e1055c4d838a1272
SHA1 0f314e2631cd4eb52b1950c4b2884cd739087730
SHA512 56102b178301ec7f428c3b9deadbe2b870d3ecb39d7e220cf6241cc0dab0bfa1c053f0c28645a7f6bf86b60e54f63ada3e0bcb2136fad7bcc3359edd4a4d1225
SSDEEP 49152:w5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUh9KTnUVz:dTrVI4dGOgGpYHCs
TLSH
T1ADD59D62F782D0B2E4D201B156BEABF75D787535533584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  update1.exe
- Size 2.7MB
- SHA256 4f6994cecd3217d539b791710f0988e0c69c5d05f0ddd2c034b373383e2c1d43
- MD5 9fa99a4b6cf974e7e1055c4d838a1272
- SHA1 0f314e2631cd4eb52b1950c4b2884cd739087730
- SHA512 56102b178301ec7f428c3b9deadbe2b870d3ecb39d7e220cf6241cc0dab0bfa1c053f0c28645a7f6bf86b60e54f63ada3e0bcb2136fad7bcc3359edd4a4d1225
- SSDEEP 49152:w5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUh9KTnUVz:dTrVI4dGOgGpYHCs
- TLSH
  T1ADD59D62F782D0B2E4D201B156BEABF75D787535533584CBE3C01E6A49206C2B63AF1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution milleniumrat rat spyware stealer trojan adware xmrig miner persistence
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- XMRig Miner payload
  miner
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2