milleniumrat | 23e14a639007759118615370449af845b11fb8ce15c79e3712e3b9ab6461b50b

Sharing

General

Target
CryptoCurrencies V1.1 Wallet Stealer by Blackwolf.rar
Size 2.9MB
Sample260921-b2evhswwfz
SHA256 23e14a639007759118615370449af845b11fb8ce15c79e3712e3b9ab6461b50b
MD5 332ac1e0e4f13a9a7ad216416373e55b
SHA1 20de133c4746b17f13dd3babd86c65015479a74b
SHA512 6b5ba0be72faac40678e6d96a2dc93fe81058f06fb89be80b49311a55d8558e62624bcb7e64e0c409bee3bfbec26310b82e4a073741c775c550bc7e3153ce657
SSDEEP 49152:MgZvwMxo4mTOMqo5ggY2HjcppnuTu+MsXdQzRQoxztcOVB8nzKPk3:M2dy4vs9DcfA8sXdQdfncGanmc3
TLSH
T114D533F4DFE3967C8E141705525B29A9ECCB6B0BA20D7533718317535DC9BA82C648F4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  CryptoCurrencies V1.1 Wallet Stealer by Blackwolf.rar
- Size 2.9MB
- SHA256 23e14a639007759118615370449af845b11fb8ce15c79e3712e3b9ab6461b50b
- MD5 332ac1e0e4f13a9a7ad216416373e55b
- SHA1 20de133c4746b17f13dd3babd86c65015479a74b
- SHA512 6b5ba0be72faac40678e6d96a2dc93fe81058f06fb89be80b49311a55d8558e62624bcb7e64e0c409bee3bfbec26310b82e4a073741c775c550bc7e3153ce657
- SSDEEP 49152:MgZvwMxo4mTOMqo5ggY2HjcppnuTu+MsXdQzRQoxztcOVB8nzKPk3:M2dy4vs9DcfA8sXdQdfncGanmc3
- TLSH
  T114D533F4DFE3967C8E141705525B29A9ECCB6B0BA20D7533718317535DC9BA82C648F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution milleniumrat persistence privilege_escalation rat spyware stealer trojan
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  All Hacking Tools.html
- Size 122KB
- SHA256 2c9a4e16819cef25992801ca97e9599956730b3aab0bc840dcfc9ac15a6ebec3
- MD5 d390ceeca9ea9531c82a5f7b19f1e828
- SHA1 12e8ed5603d4b4bc1d35da7f092b6ace1a3663ce
- SHA512 f62da993c9ba7096b54bb0a13cbac8460133c3403bc62097efce3febca732c12c1652531fc218dc9ab38f3586482e0f3c8835407b7ff24f9fb8cd708bec9ca26
- SSDEEP 1536:7Zfbsd7ypRneqw5f/IQ7bxojWlUTTMqxZ9T9TVP:pbQGuxoqKTPxZ9T9TVP
- TLSH
  T18FC318B7D2E810BE322343F9E2547B7C74AB8519EB0441B0F6EC5A1403F9DF299A6758
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  CryptoCurrencies V1.1 Wallet Stealer.exe
- Size 3.1MB
- SHA256 cac0ce449b32b325ded7a1e7f8a4a1527b1c86ecf4ffb69f66234096297c82ac
- MD5 f32a589bf3dd077abf0421a6a0c64070
- SHA1 60bdd433e40f1cdf77ac98a32a5be14dba996936
- SHA512 d6f23ad7e7b58cf21ba7792a6a7dcdc52bf68ccfbee0d1ab8291ac648229a8fb2eb3134a63b8c5ad536d603be42e5cfd139aab71dfa5ceec39c5fcbaf6cf8a08
- SSDEEP 98304:U2ghx1lg4EEwZxFIevIrIh2c/5tXU/EEp5P:MxPYEwZgeg+Dm
- TLSH
  T127E51215D3F401FDE0A7E5748E438916EB76BC4943A1EBCF03A4A9661F277908E3A712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  setup.bat
- Size 121B
- SHA256 63e779df2c4821beca329fe9322053a1de1dba4c0e63cb3d569ffc09bbf34267
- MD5 2584017d8cac9d82958d1811e613cb3d
- SHA1 e78aac6cdbb2b882410c92cc04998fbcfd1af2b9
- SHA512 f21f5470b2cd76c0ec47391bcd402874cdba096d958de339c5ee2bea6722233eae16e232b5799bcd352c97df7fcbaa0869a3634995cb99eccd75a30f288f7f3c
- TLSH
  T14AB0220E0083200082A328808A2228003A8E80AB238AE2C23000EE88A0000BEC0E08AA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution milleniumrat persistence privilege_escalation rat spyware stealer trojan
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral7 behavioral8