milleniumrat | update1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
update1.exe
Size 2.6MB
Sample260626-phbweabs6s
SHA256 32e167e167c82f04b203c220b56edb95bbc3869254c7b792521a490c97e9507a
MD5 bbf485d00380a0585f75315aceb2dc2e
SHA1 5f6a727c0caa2a8af1cbf40a3902edd2426758b8
SHA512 b8f601f7d3ddd65c9189df6b4df472e087279661b573e48ce52f51a6e6fc557204ae0fa44fd568089db6f6018f24cd417edc966d2852ba1e2aa7a73145b7f1fc
SSDEEP 49152:R5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUU9KTnUVz:OTrVI4dGOgGpYHCV
TLSH
T13FD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat stealer milleniumrat

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
sample	family_milleniumrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
update1.exe

File Explorer

update1.exe

.exe 2.6MB

update1.exe

IMPHASH e036611c05048ce1b230596686eabd36
SHA256 32e167e167c82f04b203c220b56edb95bbc3869254c7b792521a490c97e9507a
MD5 bbf485d00380a0585f75315aceb2dc2e
SHA1 5f6a727c0caa2a8af1cbf40a3902edd2426758b8
SHA512 b8f601f7d3ddd65c9189df6b4df472e087279661b573e48ce52f51a6e6fc557204ae0fa44fd568089db6f6018f24cd417edc966d2852ba1e2aa7a73145b7f1fc
SSDEEP 49152:R5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUU9KTnUVz:OTrVI4dGOgGpYHCV
TLSH
T13FD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MilleniumRAT stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2025898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAWaitForMultipleEvents WSAGetLastError ntohs WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt closesocket select getaddrinfo send socket connect recv freeaddrinfo ioctlsocket setsockopt WSASetLastError WSAStartup WSACleanup bind getpeername getsockname htons WSAIoctl __WSAFDIsSet accept gethostname sendto recvfrom listen WSAResetEvent htonl

wldap32

ord46 ord26 ord217 ord143 ord22 ord41 ord50 ord45 ord27 ord211 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord60

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptUnprotectData CryptStringToBinaryA CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateChainEngine CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertFindCertificateInStore CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA

advapi32

GetTokenInformation RegEnumValueW GetUserNameW RegOpenKeyExW RegCloseKey DuplicateTokenEx DuplicateToken SetThreadToken OpenProcessToken ImpersonateLoggedOnUser LookupPrivilegeValueA RevertToSelf RegQueryValueExW SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenThreadToken RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegDeleteValueW AdjustTokenPrivileges

kernel32

EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation FormatMessageA MultiByteToWideChar AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW IsValidCodePage FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource FindFirstFileW FindNextFileW GetModuleFileNameW GetSystemPowerStatus InitializeCriticalSectionEx FindResourceA FindClose OpenProcess K32GetModuleBaseNameW LockResource LoadResource DecodePointer GetComputerNameW CreateProcessW SetThreadExecutionState GetModuleHandleW Process32First TerminateProcess CreateToolhelp32Snapshot Process32Next CreateProcessA GetCurrentProcess K32GetModuleFileNameExW Process32NextW Process32FirstW K32EnumProcesses CreateDirectoryW GetModuleFileNameA SetHandleInformation RemoveDirectoryW CreatePipe SetFileAttributesW K32GetModuleFileNameExA GetNativeSystemInfo CopyFileW QueryFullProcessImageNameW MoveFileW ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError SetEvent CreateEventA QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA GetModuleHandleA SleepEx MoveFileExA GetEnvironmentVariableA GetLocaleInfoEx GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive GetFileInformationByHandleEx GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW GetFileInformationByHandle FindFirstFileExW GetCurrentDirectoryW GetStdHandle

user32

SendMessageW keybd_event MessageBoxW ChangeDisplaySettingsExW GetWindowThreadProcessId GetKeyNameTextW SetWindowsHookExW TranslateMessage ToUnicodeEx EnumDisplaySettingsExW GetKeyboardState CallNextHookEx FindWindowW GetKeyState GetMessageW ReleaseDC GetMonitorInfoW EnumDisplayMonitors SendMessageA GetClipboardData VkKeyScanW DispatchMessageW EmptyClipboard CloseClipboard OpenClipboard GetDC DestroyWindow GetKeyboardLayout SystemParametersInfoW GetWindowTextW GetForegroundWindow MapVirtualKeyW

gdi32

GetDIBits GetObjectA BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCW DeleteDC DeleteObject

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW SHGetFolderPathW

ole32

CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

shlwapi

StrStrIW

bcrypt

BCryptImportKey BCryptGetProperty BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenRandom

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider

gdiplus

GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdiplusStartup

avicap32

capCreateCaptureWindowA

winmm

waveInUnprepareHeader waveInPrepareHeader waveInOpen waveInAddBuffer waveInStop waveInClose waveInStart