milleniumrat | ffe96045b31e677ff1d90f179d774347af6a504753589522163d0822f78f062d

General

Target
WIFI PASSWORD PRO v5.6.0.zip
Size 5.0MB
Sample260723-efh7la1ale
SHA256 ffe96045b31e677ff1d90f179d774347af6a504753589522163d0822f78f062d
MD5 5849c9fd12c4ab4382fce8da5545e23e
SHA1 4dce667dda2097acba02ccc96f9cb756788ab86f
SHA512 57547cde7a225c538a4cc9fcf01eff4aa30ca6527c4bf5614169a21f260d3a8f8b81fdd1626fb4c763b6fae725f62a364df59f91297fc654d46e169b44e0a403
SSDEEP 98304:MTm9/LyKPmXdY7WcihL94ybIkcZCUygmBFfRTDsJBpGxl:P9uXdsWci/+619RMJBp4
TLSH
T1343633D3EEB9C49AD19C678B6D0F0A1CC8C96253EAF577EC13C926D1C87A3A1436446C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  WIFI PASSWORD PRO v5.6.0.exe
- Size 5.2MB
- SHA256 e776305da80df8322247a65092557e7fc8415bb143fb6765b3f19c9df1a83d80
- MD5 de20e4ed9dbf57cd8fba511978ae9eee
- SHA1 7f3a209606b79a769c75b62c5bc5063e3504f265
- SHA512 63517a660e808864340c6d792f9c588b1b559ca1a580dd140e5fab5589661cb793db4ba8485046559f57b9195c9c73a056d7918fe8ee05cb3c81c0de2b1c5f8d
- SSDEEP 98304:06I7g9Pz4qV0XXAjQ0qBTR2wTYeG3eaKgSDLLz5D43j3Gzf:0s9MXXYQ0q/4OT7z63j3Q
- TLSH
  T1C1462355E7F404F9E0AAE578CD474905DBB67C0A57B1E7CF03E469A24E333A08A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  setup.bat
- Size 121B
- SHA256 63e779df2c4821beca329fe9322053a1de1dba4c0e63cb3d569ffc09bbf34267
- MD5 2584017d8cac9d82958d1811e613cb3d
- SHA1 e78aac6cdbb2b882410c92cc04998fbcfd1af2b9
- SHA512 f21f5470b2cd76c0ec47391bcd402874cdba096d958de339c5ee2bea6722233eae16e232b5799bcd352c97df7fcbaa0869a3634995cb99eccd75a30f288f7f3c
- TLSH
  T14AB0220E0083200082A328808A2228003A8E80AB238AE2C23000EE88A0000BEC0E08AA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution milleniumrat persistence rat spyware stealer credential_access
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral3 behavioral4