milleniumrat | 125e35e830539cfcbb289da48e9fd4f85851df28755081bffd5db2d836f27972

General

Target
Crypto Balance Checker.zip
Size 2.9MB
Sample260921-b5636sfd85
SHA256 125e35e830539cfcbb289da48e9fd4f85851df28755081bffd5db2d836f27972
MD5 861f72e53268f40a965764b0ac3443a8
SHA1 50bed61dcb655e3ed8b42c79893d6e381b74ddd2
SHA512 3d325ba180b3796e190982cb2f54fc6f7ad326af5dcd78cdba5a6d80a5601b9fa52b8034d93acb1ca11043e8653ec706bf8a9906c9ccf84af426babdee492d42
SSDEEP 49152:5Q1Q3q47AHgDsLlah1MNzYJcNz0/81f3HT2Xh7oFY3rIMCgHDNClhpUEohMp6Lgy:r3uHgDuI1CzGNOj2K63rIMCyIH52Mp63
TLSH
T13AD5334534164CF18D78FA02DB360CC39919F2C2584B8F598C5E3564BA3B69AFB64CAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Crypto Balance Checker.zip
- Size 2.9MB
- SHA256 125e35e830539cfcbb289da48e9fd4f85851df28755081bffd5db2d836f27972
- MD5 861f72e53268f40a965764b0ac3443a8
- SHA1 50bed61dcb655e3ed8b42c79893d6e381b74ddd2
- SHA512 3d325ba180b3796e190982cb2f54fc6f7ad326af5dcd78cdba5a6d80a5601b9fa52b8034d93acb1ca11043e8653ec706bf8a9906c9ccf84af426babdee492d42
- SSDEEP 49152:5Q1Q3q47AHgDsLlah1MNzYJcNz0/81f3HT2Xh7oFY3rIMCgHDNClhpUEohMp6Lgy:r3uHgDuI1CzGNOj2K63rIMCyIH52Mp63
- TLSH
  T13AD5334534164CF18D78FA02DB360CC39919F2C2584B8F598C5E3564BA3B69AFB64CAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Drops desktop.ini file(s)
behavioral1 behavioral2
- Target
  Crypto Balance Checker.exe
- Size 3.1MB
- SHA256 b1f82c35dbff42fe9570c9950f6cf75253ec39dd49723b3d6255a174b6bf5649
- MD5 02bd43eba62e6271c3bbebd23fdbb51f
- SHA1 4a86d5eab17a2545c0e5160bbeceba94d6e1932e
- SHA512 81f7ec38427d3ed334d28639668b440fe6d6deb288c14e3bc4f38060d01691b3dca52c5b4cf72f168182f601a248d1e018c6bae8f3c79f78a70663f725933281
- SSDEEP 98304:06InYbipge56xRKBIl2oCn5sm+OWj3+aTo/Wz:0SiB66IlK2HPbzN
- TLSH
  T151E52209E7E404F9E1B6E574CE534D42EB36BC490761D68F07A8A9661F33290DE39B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  setup.bat
- Size 121B
- SHA256 63e779df2c4821beca329fe9322053a1de1dba4c0e63cb3d569ffc09bbf34267
- MD5 2584017d8cac9d82958d1811e613cb3d
- SHA1 e78aac6cdbb2b882410c92cc04998fbcfd1af2b9
- SHA512 f21f5470b2cd76c0ec47391bcd402874cdba096d958de339c5ee2bea6722233eae16e232b5799bcd352c97df7fcbaa0869a3634995cb99eccd75a30f288f7f3c
- TLSH
  T14AB0220E0083200082A328808A2228003A8E80AB238AE2C23000EE88A0000BEC0E08AA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution milleniumrat persistence privilege_escalation rat spyware stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral5 behavioral6