milleniumrat | f0ee9cdb6dca966abe8a522af3a89cba9fbc62019da6c8c5de9dd72d7119eed2

General

Target
SilverBullet.zip
Size 145.3MB
Sample260808-y533vaysaz
SHA256 f0ee9cdb6dca966abe8a522af3a89cba9fbc62019da6c8c5de9dd72d7119eed2
MD5 cd764aef9f2ae5d8d67ed9c43d12f1c5
SHA1 4e9f45781e4c3aaaf3a6dcbf4abf3eed3a0dd6bd
SHA512 6fe88fe977b8880412e199e2a4cb789f7fcc7573fff88ed21dd83b266b539e46db3ea45df90f52ec26e1c2cd77dc9970155a09d9127c309d400cf9c2e135f355
SSDEEP 3145728:Nw5gM1a67FDi53VsXpehoO2COTCetvpmrZDDXBcpZPORqHeZOc7tlR:Nw5B1vg3VcO2xj8Z1Rq+b7tD
TLSH
T1E4783355A72D7BE7FA10122B55331C83EBB9E696913EE318C116C78F6080309D4FD9AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  SilverBullet.zip
- Size 145.3MB
- SHA256 f0ee9cdb6dca966abe8a522af3a89cba9fbc62019da6c8c5de9dd72d7119eed2
- MD5 cd764aef9f2ae5d8d67ed9c43d12f1c5
- SHA1 4e9f45781e4c3aaaf3a6dcbf4abf3eed3a0dd6bd
- SHA512 6fe88fe977b8880412e199e2a4cb789f7fcc7573fff88ed21dd83b266b539e46db3ea45df90f52ec26e1c2cd77dc9970155a09d9127c309d400cf9c2e135f355
- SSDEEP 3145728:Nw5gM1a67FDi53VsXpehoO2COTCetvpmrZDDXBcpZPORqHeZOc7tlR:Nw5B1vg3VcO2xj8Z1Rq+b7tD
- TLSH
  T1E4783355A72D7BE7FA10122B55331C83EBB9E696913EE318C116C78F6080309D4FD9AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Password.txt
- Size 3B
- SHA256 a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3
- MD5 202cb962ac59075b964b07152d234b70
- SHA1 40bd001563085fc35165329ea1ff5c5ecbdbbeef
- SHA512 3c9909afec25354d551dae21590bb26e38d53f2173b8d3dc3eee4c047e7ab1c1eb8b85103e3be7ba613b31bb5c9c36214dc9f14a42fd7a2fdb84856bca5c44c2
- MD5 SHA1 SHA512
Score

1^/10

ransomware
behavioral2
- Target
  SilverBullet.exe
- Size 144.5MB
- SHA256 2d307d1c36f6f430650fb283e7a813deb6fa6b9ea6fc5217d892ce05ad1b987f
- MD5 cc613a33962319399aaf6071a414a604
- SHA1 b0c61b668e75abfab6721c2303e8d7520f777f64
- SHA512 d8aeda7e9bb3a4675583b315a7c9d11454720d9c4f9a895e0ae0f657587577106c360a412628b7c865a65e690163e672d978bf169845125274e67d1731dffa22
- SSDEEP 3145728:HWUxaAbRf6ln1o3tSR2OogwxiMXRDSLlF5bhYFX/2Hw7ci+fZgoF:H3xHIn1OyoVPAl/HwwDZgA
- TLSH
  T1D9783305D72C26FBFA61527F88330883EB76F91A5239E319C264C78F1592314D8BEB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  patch.exe
- Size 1.1MB
- SHA256 3b35d3233e08d7c7a43a0bc0a899ce14cd6797949e96af0c6b3c32f690ab4815
- MD5 7f47a50117bac7569e6b4de42926636e
- SHA1 877622dda7d578058ebdddbb8be578c68dae74d9
- SHA512 3c076c537d164e348d9192b8cd8f22fea47bc11e1f29849f1a64b9a77653c79a4759c35f0d237e83f8f0f7a4082d216c84cf26645aaea4ed2432c24f5603557a
- SSDEEP 24576:nFXxPjGhJLBX4lY5/RA3GzNOR8SZG+XL8tTxhCww9c6zI:FXxP0BXU3SNOR1ZG+b6Txhzf
- TLSH
  T15E450144335BCC02D4920B7109B0D3791669AF5CA526C7178FEFFDEBF926786AD90282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution milleniumrat persistence privilege_escalation rat stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral4
- Target
  setup.bat
- Size 115B
- SHA256 4813b1bd8c65ec474434e049e69cf01d67ff772be7e1717583d2135f630a9ccb
- MD5 01ad58928bab27a41ce5443df638b0a2
- SHA1 2b9a82176da62f53d75244028eaebb10599aa487
- SHA512 f1e18b1d500614be30b9b55a1d1b82c642439c37d36eccaef5118e3b2165a8ac11cf1dd1bc2f1d5c880ad3d4a16ec4029b1c53979a7912159190571cd3336200
- TLSH
  T1BBB0126E5193755097D324C08B262A513BCF506F478BE3C23104EDC976411BEC1E48AE
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery execution milleniumrat persistence privilege_escalation rat stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral5