milleniumrat | update1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
update1.exe
Size 2.6MB
Sample260722-pl343a1why
SHA256 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030
MD5 bdc7dc0d39258a4055a24db6eaabb54d
SHA1 2a48ac416efc98324f25301a32a03a5786b738f9
SHA512 7090879e2d5527e40425dce2e416a4593b8329fcb431038fd951d3be99dd4bc8c219f8bc200d56056dca1eb965a4c74820a1eba3fb3f755ed7bc371dedc45eee
SSDEEP 49152:j5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUL9KTnUVz:wTrVI4dGOgGpYHCO
TLSH
T15CD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat stealer milleniumrat

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
sample	family_milleniumrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
update1.exe

File Explorer

update1.exe

.exe 2.6MB

update1.exe

IMPHASH e036611c05048ce1b230596686eabd36
SHA256 748a02784c8a04459884778a66b2dbb5156b01b324c7b73f06c8058596d1a030
MD5 bdc7dc0d39258a4055a24db6eaabb54d
SHA1 2a48ac416efc98324f25301a32a03a5786b738f9
SHA512 7090879e2d5527e40425dce2e416a4593b8329fcb431038fd951d3be99dd4bc8c219f8bc200d56056dca1eb965a4c74820a1eba3fb3f755ed7bc371dedc45eee
SSDEEP 49152:j5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUL9KTnUVz:wTrVI4dGOgGpYHCO
TLSH
T15CD59D62F782D0B2E4D201B152BEABF74D787535537584CBE3C01E6A49206D2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MilleniumRAT stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2025898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAWaitForMultipleEvents WSAGetLastError ntohs WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt closesocket select getaddrinfo send socket connect recv freeaddrinfo ioctlsocket setsockopt WSASetLastError WSAStartup WSACleanup bind getpeername getsockname htons WSAIoctl __WSAFDIsSet accept gethostname sendto recvfrom listen WSAResetEvent htonl

wldap32

ord46 ord26 ord217 ord143 ord22 ord41 ord50 ord45 ord27 ord211 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord60

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptUnprotectData CryptStringToBinaryA CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateChainEngine CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertFindCertificateInStore CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA

advapi32

GetTokenInformation RegEnumValueW GetUserNameW RegOpenKeyExW RegCloseKey DuplicateTokenEx DuplicateToken SetThreadToken OpenProcessToken ImpersonateLoggedOnUser LookupPrivilegeValueA RevertToSelf RegQueryValueExW SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenThreadToken RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegDeleteValueW AdjustTokenPrivileges

kernel32

EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation FormatMessageA MultiByteToWideChar AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW IsValidCodePage FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource FindFirstFileW FindNextFileW GetModuleFileNameW GetSystemPowerStatus InitializeCriticalSectionEx FindResourceA FindClose OpenProcess K32GetModuleBaseNameW LockResource LoadResource DecodePointer GetComputerNameW CreateProcessW SetThreadExecutionState GetModuleHandleW Process32First TerminateProcess CreateToolhelp32Snapshot Process32Next CreateProcessA GetCurrentProcess K32GetModuleFileNameExW Process32NextW Process32FirstW K32EnumProcesses CreateDirectoryW GetModuleFileNameA SetHandleInformation RemoveDirectoryW CreatePipe SetFileAttributesW K32GetModuleFileNameExA GetNativeSystemInfo CopyFileW QueryFullProcessImageNameW MoveFileW ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError SetEvent CreateEventA QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA GetModuleHandleA SleepEx MoveFileExA GetEnvironmentVariableA GetLocaleInfoEx GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive GetFileInformationByHandleEx GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW GetFileInformationByHandle FindFirstFileExW GetCurrentDirectoryW GetStdHandle

user32

SendMessageW keybd_event MessageBoxW ChangeDisplaySettingsExW GetWindowThreadProcessId GetKeyNameTextW SetWindowsHookExW TranslateMessage ToUnicodeEx EnumDisplaySettingsExW GetKeyboardState CallNextHookEx FindWindowW GetKeyState GetMessageW ReleaseDC GetMonitorInfoW EnumDisplayMonitors SendMessageA GetClipboardData VkKeyScanW DispatchMessageW EmptyClipboard CloseClipboard OpenClipboard GetDC DestroyWindow GetKeyboardLayout SystemParametersInfoW GetWindowTextW GetForegroundWindow MapVirtualKeyW

gdi32

GetDIBits GetObjectA BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCW DeleteDC DeleteObject

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW SHGetFolderPathW

ole32

CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

shlwapi

StrStrIW

bcrypt

BCryptImportKey BCryptGetProperty BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenRandom

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider

gdiplus

GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdiplusStartup

avicap32

capCreateCaptureWindowA

winmm

waveInUnprepareHeader waveInPrepareHeader waveInOpen waveInAddBuffer waveInStop waveInClose waveInStart