milleniumrat | f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982.zip
Size 1.3MB
Sample260824-sxt73sea68
SHA256 ff0d7256ceb3ca4ca596fae914dc324cfcb344f7e0d05447e3d619dcd7b39245
MD5 ff48a938fa407e03dc589eb205cb1937
SHA1 b09ba21cf6efb055566c07dff7b23e7bb5a4e074
SHA512 9a5ef43632456f52320bd944f8c98266767099105e6a4ba9aa3cc9e4c42962d1ad7c2612af5b3cfcd1bd27e416435cbc9c6eaae47449ff9c4a35b95d86d221f5
SSDEEP 24576:/1fHVWq9vkpqzZoAjLxkCJOSa3Md6ACU/6+IYrXDg/i7Yy41aWGOuqXao2+SI0L:/1tWq7zZN3qz32IGtJHa3buaa/+SIq
TLSH
T16555335627BD9F023FB324AAEC739D0708CB5924197068E3D6DD2F10A4DDA65EF62813
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat stealer milleniumrat

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
static1/unpack001/f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982	family_milleniumrat

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982

File Explorer

f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982.zip

.zip 1.3MB
f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982

.exe 2.6MB

f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982.zip

SHA256 ff0d7256ceb3ca4ca596fae914dc324cfcb344f7e0d05447e3d619dcd7b39245
MD5 ff48a938fa407e03dc589eb205cb1937
SHA1 b09ba21cf6efb055566c07dff7b23e7bb5a4e074
SHA512 9a5ef43632456f52320bd944f8c98266767099105e6a4ba9aa3cc9e4c42962d1ad7c2612af5b3cfcd1bd27e416435cbc9c6eaae47449ff9c4a35b95d86d221f5
SSDEEP 24576:/1fHVWq9vkpqzZoAjLxkCJOSa3Md6ACU/6+IYrXDg/i7Yy41aWGOuqXao2+SI0L:/1tWq7zZN3qz32IGtJHa3buaa/+SIq
TLSH
T16555335627BD9F023FB324AAEC739D0708CB5924197068E3D6DD2F10A4DDA65EF62813
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982

IMPHASH e036611c05048ce1b230596686eabd36
SHA256 f88331e4dc23f33c0c049048df8ac696645b4f0f2f530a564bf52de9f16f9982
MD5 885ad4ae2e27aff33a17c9a3200297ca
SHA1 e519dfb09d527cc694d7a77f9aef2e5772b3eeec
SHA512 341b8f8d45969312ce66151798c80663f9c2fcece47ab01df6e736376a86b5a6560a1941010ff5e7fe291237769e509c3318fbd86d995ec952719098d535d6b0
SSDEEP 49152:/5uXUoriRSoHz8szAXNGOXwGRbRKq5vguk6cLHMvJ9XUn9KTnUVz:ETrVI4dGOgGpYHCO
TLSH
T170D59D62F782D0B2E4D201B151BEABF75D787635537584CBE3C01E6A49206C2B63AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MilleniumRAT stealer
Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

2025898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAWaitForMultipleEvents WSAGetLastError ntohs WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt closesocket select getaddrinfo send socket connect recv freeaddrinfo ioctlsocket setsockopt WSASetLastError WSAStartup WSACleanup bind getpeername getsockname htons WSAIoctl __WSAFDIsSet accept gethostname sendto recvfrom listen WSAResetEvent htonl

wldap32

ord46 ord26 ord217 ord143 ord22 ord41 ord50 ord45 ord27 ord211 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord60

crypt32

CertEnumCertificatesInStore CertCloseStore CertOpenStore CryptUnprotectData CryptStringToBinaryA CertFreeCertificateContext PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFreeCertificateChainEngine CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertFindCertificateInStore CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA

advapi32

GetTokenInformation RegEnumValueW GetUserNameW RegOpenKeyExW RegCloseKey DuplicateTokenEx DuplicateToken SetThreadToken OpenProcessToken ImpersonateLoggedOnUser LookupPrivilegeValueA RevertToSelf RegQueryValueExW SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenThreadToken RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegDeleteValueW AdjustTokenPrivileges

kernel32

EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteConsoleW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation FormatMessageA MultiByteToWideChar AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW IsValidCodePage FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource FindFirstFileW FindNextFileW GetModuleFileNameW GetSystemPowerStatus InitializeCriticalSectionEx FindResourceA FindClose OpenProcess K32GetModuleBaseNameW LockResource LoadResource DecodePointer GetComputerNameW CreateProcessW SetThreadExecutionState GetModuleHandleW Process32First TerminateProcess CreateToolhelp32Snapshot Process32Next CreateProcessA GetCurrentProcess K32GetModuleFileNameExW Process32NextW Process32FirstW K32EnumProcesses CreateDirectoryW GetModuleFileNameA SetHandleInformation RemoveDirectoryW CreatePipe SetFileAttributesW K32GetModuleFileNameExA GetNativeSystemInfo CopyFileW QueryFullProcessImageNameW MoveFileW ReleaseSRWLockExclusive AcquireSRWLockExclusive SetLastError SetEvent CreateEventA QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA GetModuleHandleA SleepEx MoveFileExA GetEnvironmentVariableA GetLocaleInfoEx GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive GetFileInformationByHandleEx GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW OutputDebugStringW GetFileInformationByHandle FindFirstFileExW GetCurrentDirectoryW GetStdHandle

user32

SendMessageW keybd_event MessageBoxW ChangeDisplaySettingsExW GetWindowThreadProcessId GetKeyNameTextW SetWindowsHookExW TranslateMessage ToUnicodeEx EnumDisplaySettingsExW GetKeyboardState CallNextHookEx FindWindowW GetKeyState GetMessageW ReleaseDC GetMonitorInfoW EnumDisplayMonitors SendMessageA GetClipboardData VkKeyScanW DispatchMessageW EmptyClipboard CloseClipboard OpenClipboard GetDC DestroyWindow GetKeyboardLayout SystemParametersInfoW GetWindowTextW GetForegroundWindow MapVirtualKeyW

gdi32

GetDIBits GetObjectA BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCW DeleteDC DeleteObject

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW SHGetFolderPathW

ole32

CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

shlwapi

StrStrIW

bcrypt

BCryptImportKey BCryptGetProperty BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenRandom

ncrypt

NCryptDecrypt NCryptFreeObject NCryptOpenKey NCryptOpenStorageProvider

gdiplus

GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdiplusStartup

avicap32

capCreateCaptureWindowA

winmm

waveInUnprepareHeader waveInPrepareHeader waveInOpen waveInAddBuffer waveInStop waveInClose waveInStart