milleniumrat | 186a8988fa934ade6620d9b8d0d8486b0f343a3980c20376cee6d6ad9986d0ed

General

Target
2026-07-18_6a9dd82bf43e2e52e409333904c41a3e_amadey_elex_glassworm_luca-stealer_lynx_njrat
Size 2.6MB
Sample260718-bda7esez9v
SHA256 186a8988fa934ade6620d9b8d0d8486b0f343a3980c20376cee6d6ad9986d0ed
MD5 6a9dd82bf43e2e52e409333904c41a3e
SHA1 c4683cf9abedcefcd4f9935b52979db987b0e7a4
SHA512 3967d0a2e8a5dc8db077a7cae8418cb6875a37be3c83f47c83fc103956e8b0281fed330c218efb84a96bf13d7fc40ff5d18081bb509c3f9be08d22ba65246988
SSDEEP 49152:y5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUs9KTnUVz:fTrVI4dGOgGpYHCx
TLSH
T12ED59D62F782D0B2E4D201B156BEABF74D787535537584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-18_6a9dd82bf43e2e52e409333904c41a3e_amadey_elex_glassworm_luca-stealer_lynx_njrat
- Size 2.6MB
- SHA256 186a8988fa934ade6620d9b8d0d8486b0f343a3980c20376cee6d6ad9986d0ed
- MD5 6a9dd82bf43e2e52e409333904c41a3e
- SHA1 c4683cf9abedcefcd4f9935b52979db987b0e7a4
- SHA512 3967d0a2e8a5dc8db077a7cae8418cb6875a37be3c83f47c83fc103956e8b0281fed330c218efb84a96bf13d7fc40ff5d18081bb509c3f9be08d22ba65246988
- SSDEEP 49152:y5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUs9KTnUVz:fTrVI4dGOgGpYHCx
- TLSH
  T12ED59D62F782D0B2E4D201B156BEABF74D787535537584CBE3C01E6A49206C2B63AF1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery milleniumrat rat spyware stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers
- Detects executables containing URLs to raw contents of a Github gist
- Detects executables containing possible sandbox analysis VM names
- Detects executables containing possible sandbox analysis VM usernames
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Deletes itself
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
behavioral1 behavioral2