milleniumrat | 5f45be41943b7fd34a8871f75417e93d497e65a2be0a317c0d9e81f9c7cb8b84

General

Target
update1.exe
Size 2.7MB
Sample260724-dlssjszzdy
SHA256 5f45be41943b7fd34a8871f75417e93d497e65a2be0a317c0d9e81f9c7cb8b84
MD5 58be447a7f2bb8478d5f3a659dd3bcd2
SHA1 4adedf05918c85d8c9e7880d2fbbb396060518e2
SHA512 1b152aefec93294f52c5441e2b2c352e7e4405e8cabbbcb74dda368b346745658a3233bc1b64f16a5ae3b9950a473c8c18d7c9ad0d8228dd5d8f0021d754994f
SSDEEP 49152:s5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XU/9KTnUVz:hTrVI4dGOgGpYHCW
TLSH
T1E0D59D62F782D0B2E4D201B156BEABF74D787535537584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  update1.exe
- Size 2.7MB
- SHA256 5f45be41943b7fd34a8871f75417e93d497e65a2be0a317c0d9e81f9c7cb8b84
- MD5 58be447a7f2bb8478d5f3a659dd3bcd2
- SHA1 4adedf05918c85d8c9e7880d2fbbb396060518e2
- SHA512 1b152aefec93294f52c5441e2b2c352e7e4405e8cabbbcb74dda368b346745658a3233bc1b64f16a5ae3b9950a473c8c18d7c9ad0d8228dd5d8f0021d754994f
- SSDEEP 49152:s5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XU/9KTnUVz:hTrVI4dGOgGpYHCW
- TLSH
  T1E0D59D62F782D0B2E4D201B156BEABF74D787535537584CBE3C01E6A49206C2B63AF1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery execution milleniumrat rat spyware stealer defense_evasion evasion xmrig miner persistence trojan
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Family: xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- XMRig Miner payload
  miner
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2