milleniumrat | 65c296315ca4aeea67bd8ef4d0af8ae0561178d5f48538265260aa322ed231fa

General

Target
BTC-ProTrader.zip
Size 2.9MB
Sample260817-clsbca1glc
SHA256 65c296315ca4aeea67bd8ef4d0af8ae0561178d5f48538265260aa322ed231fa
MD5 1332bcfe069da4cf9319dd9f4c718a84
SHA1 bbb03fc5204898782578d275d6f786fc3dbe8dae
SHA512 bf41e731a60a982f2c740decfd40d308ae1d85e5859dd51ab7e0da6c439e91c985c0df31102a3727404d90424e8f0d192d91dbba3c2ffcc19fc6927d1fcf6b27
SSDEEP 49152:/Q1+i9KC0XxOg5CkxMQkQL6rkbngn3EVqlC43abQnlXEvGjOB1Z+1/oSvwlau8ia:8ohdVlf6rkbnqEVqlC4KU0GjOqLey4JW
TLSH
T10DE5336EB47609FF7A01910904472FAF17653CB446A76E5F251F2AE9384FB02ABD013B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  BTC-ProTrader.zip
- Size 2.9MB
- SHA256 65c296315ca4aeea67bd8ef4d0af8ae0561178d5f48538265260aa322ed231fa
- MD5 1332bcfe069da4cf9319dd9f4c718a84
- SHA1 bbb03fc5204898782578d275d6f786fc3dbe8dae
- SHA512 bf41e731a60a982f2c740decfd40d308ae1d85e5859dd51ab7e0da6c439e91c985c0df31102a3727404d90424e8f0d192d91dbba3c2ffcc19fc6927d1fcf6b27
- SSDEEP 49152:/Q1+i9KC0XxOg5CkxMQkQL6rkbngn3EVqlC43abQnlXEvGjOB1Z+1/oSvwlau8ia:8ohdVlf6rkbnqEVqlC4KU0GjOqLey4JW
- TLSH
  T10DE5336EB47609FF7A01910904472FAF17653CB446A76E5F251F2AE9384FB02ABD013B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  BTC-ProTrader.exe
- Size 2.1MB
- SHA256 826ccc658287a1341ca069426e956daf7103e4e1f45be3040607f919379fc16e
- MD5 3665c268b29593a070f9c143a0677dc9
- SHA1 ea39f9e4adedcdc3a23ddd0493cd23168f73c28f
- SHA512 0b92d4f5ad8859a608d65feeaf76a015dd684275e00dde517467c8937a50ba4064dc44376d2e2850f3c5b61f98d6000f1a291f93a9b1dafc48cb7a7ed5c0cfcb
- SSDEEP 49152:06xcx0yW5DUSoX/gSPCifMeyEzoNKfn+D3+9Ol4U7Z:06IMMvJxlRoNKfn++9Ol4U1
- TLSH
  T190A51219E7F405FDE1B7E178CD834912EB757C490762EACF03A469A61F272908E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  crack.exe
- Size 1.1MB
- SHA256 3b35d3233e08d7c7a43a0bc0a899ce14cd6797949e96af0c6b3c32f690ab4815
- MD5 7f47a50117bac7569e6b4de42926636e
- SHA1 877622dda7d578058ebdddbb8be578c68dae74d9
- SHA512 3c076c537d164e348d9192b8cd8f22fea47bc11e1f29849f1a64b9a77653c79a4759c35f0d237e83f8f0f7a4082d216c84cf26645aaea4ed2432c24f5603557a
- SSDEEP 24576:nFXxPjGhJLBX4lY5/RA3GzNOR8SZG+XL8tTxhCww9c6zI:FXxP0BXU3SNOR1ZG+b6Txhzf
- TLSH
  T15E450144335BCC02D4920B7109B0D3791669AF5CA526C7178FEFFDEBF926786AD90282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery execution milleniumrat persistence privilege_escalation rat spyware stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral3
- Target
  setup.bat
- Size 115B
- SHA256 4813b1bd8c65ec474434e049e69cf01d67ff772be7e1717583d2135f630a9ccb
- MD5 01ad58928bab27a41ce5443df638b0a2
- SHA1 2b9a82176da62f53d75244028eaebb10599aa487
- SHA512 f1e18b1d500614be30b9b55a1d1b82c642439c37d36eccaef5118e3b2165a8ac11cf1dd1bc2f1d5c880ad3d4a16ec4029b1c53979a7912159190571cd3336200
- TLSH
  T1BBB0126E5193755097D324C08B262A513BCF506F478BE3C23104EDC976411BEC1E48AE
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution milleniumrat persistence privilege_escalation rat spyware stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral4