milleniumrat | 46e8a5891cbca151b7a68aff94fcbbf27517926881fb44afa4824dcbeb8ae066

General

Target
btc-hack-v2_1.zip
Size 2.8MB
Sample260808-z35pbsfd98
SHA256 46e8a5891cbca151b7a68aff94fcbbf27517926881fb44afa4824dcbeb8ae066
MD5 2b6edc6719c535302e701762bf2a195d
SHA1 d055ec8991931ed22856c29db68550fc1492112f
SHA512 626291f2ee708f5c9e43c33d331603a33f563e48d8f7eb66592b4b881ea86441f9538b8e697c8d88b58efad607db343206204ad698f6d6678caa3cc77f3634c3
SSDEEP 49152:yQ1hOa2Ks74rZsZpfnymGBAVARqDJjkY31R2gX/UOzzSC1LiaEhePvEzjlqGRIxn:RmKkjyLAqijtHXDzT9YUdVpmMUV5o
TLSH
T1BED5330991193A48BAD4EC4DDCC63F8CCBD7B6821DBA9A8D43A507B2F1D670847DCB49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  btc-hack-v2_1.zip
- Size 2.8MB
- SHA256 46e8a5891cbca151b7a68aff94fcbbf27517926881fb44afa4824dcbeb8ae066
- MD5 2b6edc6719c535302e701762bf2a195d
- SHA1 d055ec8991931ed22856c29db68550fc1492112f
- SHA512 626291f2ee708f5c9e43c33d331603a33f563e48d8f7eb66592b4b881ea86441f9538b8e697c8d88b58efad607db343206204ad698f6d6678caa3cc77f3634c3
- SSDEEP 49152:yQ1hOa2Ks74rZsZpfnymGBAVARqDJjkY31R2gX/UOzzSC1LiaEhePvEzjlqGRIxn:RmKkjyLAqijtHXDzT9YUdVpmMUV5o
- TLSH
  T1BED5330991193A48BAD4EC4DDCC63F8CCBD7B6821DBA9A8D43A507B2F1D670847DCB49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  btc-hack-v2.exe
- Size 3.0MB
- SHA256 f48cad62452499c26fa024b1185a1e19a75130f752339def62c9726b25e126d8
- MD5 efb0c933586cd2b2eb38ad4200970c66
- SHA1 67d04438859c6aed0d874e5c3347801a196ebdba
- SHA512 d8938b16d0b42b2423feda748b1de94c41bdf4a5df53425d35ed265e1957ade5b8f1ac007e2f1cd9ae196ac8493bd64f82cbe9e6ff69d3519de952a165c029a8
- SSDEEP 49152:06xcx0yWESzmSe0cTsnZAbx37a60loVypalJPo031jeETdUgzTS8zL2qEzIXvE7K:06ISzi0YLanoUiP95TNzFbg61T3SiU9g
- TLSH
  T120E51219D7A415F8E1B6E978CD834E46EB72BC490771E68F03A469B61F233908E3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  setup.bat
- Size 115B
- SHA256 4813b1bd8c65ec474434e049e69cf01d67ff772be7e1717583d2135f630a9ccb
- MD5 01ad58928bab27a41ce5443df638b0a2
- SHA1 2b9a82176da62f53d75244028eaebb10599aa487
- SHA512 f1e18b1d500614be30b9b55a1d1b82c642439c37d36eccaef5118e3b2165a8ac11cf1dd1bc2f1d5c880ad3d4a16ec4029b1c53979a7912159190571cd3336200
- TLSH
  T1BBB0126E5193755097D324C08B262A513BCF506F478BE3C23104EDC976411BEC1E48AE
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution milleniumrat persistence privilege_escalation rat spyware stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral5 behavioral6