General
- Target 239e6dd675f31ef5580663d2b044996a18c779c94db5a736366e677139e705bf.zip
- Size 1.3MB
- Sample260705-teha8shs6p
- SHA256 e297586068ae41d85c0f85056b3e1dfd1ea1745da74beeb9206eee27b6c412b5
Score
10/10
Malware Config
Targets
-
- Target 239e6dd675f31ef5580663d2b044996a18c779c94db5a736366e677139e705bf
- Size 2.7MB
- SHA256 239e6dd675f31ef5580663d2b044996a18c779c94db5a736366e677139e705bf
Score10/10Detects MilleniumRAT stealer
Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Executes dropped EXE
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
- Custom signature
Detect suspicious telegram bot
Detect suspicious telegram bot.