milleniumrat | 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030

General

Target
2026-07-18_bdc7dc0d39258a4055a24db6eaabb54d_amadey_elex_glassworm_luca-stealer_lynx_njrat
Size 2.6MB
Sample260718-a7ew2aaz6j
SHA256 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030
MD5 bdc7dc0d39258a4055a24db6eaabb54d
SHA1 2a48ac416efc98324f25301a32a03a5786b738f9
SHA512 7090879e2d5527e40425dce2e416a4593b8329fcb431038fd951d3be99dd4bc8c219f8bc200d56056dca1eb965a4c74820a1eba3fb3f755ed7bc371dedc45eee
SSDEEP 49152:j5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUL9KTnUVz:wTrVI4dGOgGpYHCO
TLSH
T15CD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-18_bdc7dc0d39258a4055a24db6eaabb54d_amadey_elex_glassworm_luca-stealer_lynx_njrat
- Size 2.6MB
- SHA256 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030
- MD5 bdc7dc0d39258a4055a24db6eaabb54d
- SHA1 2a48ac416efc98324f25301a32a03a5786b738f9
- SHA512 7090879e2d5527e40425dce2e416a4593b8329fcb431038fd951d3be99dd4bc8c219f8bc200d56056dca1eb965a4c74820a1eba3fb3f755ed7bc371dedc45eee
- SSDEEP 49152:j5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUL9KTnUVz:wTrVI4dGOgGpYHCO
- TLSH
  T15CD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery milleniumrat rat spyware stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2