milleniumrat | 98cd74b6a9575c90ed9df8868b498c50675f6594b032ee8592b7ad45e9eaa1b5

General

Target
seeds.txt
Size 78B
Sample260921-ca5sasfe98
SHA256 98cd74b6a9575c90ed9df8868b498c50675f6594b032ee8592b7ad45e9eaa1b5
MD5 9e4ae27c3ccf86d0919e588ffb7bc3d7
SHA1 5431bc92e944dbc707537faf4be0e69837a12aa7
SHA512 fd426b9d028bb5efeb73cfae8f4a45a3a36ba0a4e583614a0b6cd0faae655ad61bb374cddd8f71d0ed42277fde4fa3794c7535d6e1a7d01c3dee7dd09a819db2
TLSH
T1D1A022BBC0C8E0C32BF088833032EB3C3002F888C88BC380030800038882C2000C3E2F
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Targets

- Target
  seeds.txt
- Size 78B
- SHA256 98cd74b6a9575c90ed9df8868b498c50675f6594b032ee8592b7ad45e9eaa1b5
- MD5 9e4ae27c3ccf86d0919e588ffb7bc3d7
- SHA1 5431bc92e944dbc707537faf4be0e69837a12aa7
- SHA512 fd426b9d028bb5efeb73cfae8f4a45a3a36ba0a4e583614a0b6cd0faae655ad61bb374cddd8f71d0ed42277fde4fa3794c7535d6e1a7d01c3dee7dd09a819db2
- TLSH
  T1D1A022BBC0C8E0C32BF088833032EB3C3002F888C88BC380030800038882C2000C3E2F
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery evasion execution milleniumrat persistence privilege_escalation ransomware rat spyware stealer trojan
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Downloads MZ/PE file
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
- Suspicious use of SetThreadContext
behavioral1