milleniumrat | 94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562.exe
Size 2.4MB
Sample260923-rx47lstfrd
SHA256 94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562
MD5 e629a420112f2bcb593f5467a362a91a
SHA1 dd63f54137cd8c2ba7bb43cb6a45db5b2238698c
SHA512 5e8982e68bbb65bdbee8d7477b3c3186c434af2613e1562ff2f44ae2f89b6fcefde531cbbe3215804667f0691693c60fdb4871a60e2f59c0f7ff0906084c1bc0
SSDEEP 49152:UfC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNaMnMznc2:5oLr9DITjJG0boO1fH
TLSH
T1C7C59E22FB8290B2E4D601F062BE6BF75D786234572558CBE3C01D6A59202D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat stealer milleniumrat

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
sample	family_milleniumrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562.exe

File Explorer

94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562.exe

.exe 2.4MB

94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562.exe

IMPHASH ed3c6fe5f2fc90fbaf5b360ba051c76e
SHA256 94ffe61fb9619a00d8c1066dc8728df2af733f0b9ca8783a93ecbe1e52e59562
MD5 e629a420112f2bcb593f5467a362a91a
SHA1 dd63f54137cd8c2ba7bb43cb6a45db5b2238698c
SHA512 5e8982e68bbb65bdbee8d7477b3c3186c434af2613e1562ff2f44ae2f89b6fcefde531cbbe3215804667f0691693c60fdb4871a60e2f59c0f7ff0906084c1bc0
SSDEEP 49152:UfC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNaMnMznc2:5oLr9DITjJG0boO1fH
TLSH
T1C7C59E22FB8290B2E4D601F062BE6BF75D786234572558CBE3C01D6A59202D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MilleniumRAT stealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1878247

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt WSACleanup inet_pton WSAStartup WSAResetEvent closesocket select getaddrinfo send WSAGetLastError socket connect recv freeaddrinfo ioctlsocket setsockopt WSAEventSelect WSAWaitForMultipleEvents WSASetLastError ntohs bind getpeername gethostname sendto recvfrom listen htonl accept getsockname __WSAFDIsSet htons WSAIoctl

wldap32

ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord143 ord217 ord33 ord35 ord79 ord30 ord200 ord46 ord301 ord211

crypt32

CertOpenStore CryptUnprotectData CryptStringToBinaryA CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CertCreateCertificateChainEngine CryptDecodeObjectEx CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCloseStore CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore

advapi32

RevertToSelf GetUserNameW RegOpenKeyExW RegCloseKey DuplicateTokenEx DuplicateToken SetThreadToken OpenProcessToken ImpersonateLoggedOnUser LookupPrivilegeValueA GetTokenInformation RegQueryValueExW SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenThreadToken RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegDeleteValueW AdjustTokenPrivileges

kernel32

EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread ExitProcess SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation IsValidCodePage FormatMessageA MultiByteToWideChar AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA GetACP GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource FindFirstFileW FindNextFileW GetModuleFileNameW InitializeCriticalSectionEx FindResourceA FindClose OpenProcess LockResource LoadResource DecodePointer GetComputerNameW CreateProcessW GetModuleHandleW Process32First TerminateProcess CreateToolhelp32Snapshot Process32Next CreateProcessA GetCurrentProcess K32GetModuleFileNameExW Process32NextW Process32FirstW K32EnumProcesses CreateDirectoryW GetModuleFileNameA RemoveDirectoryW SetFileAttributesW K32GetModuleFileNameExA GetNativeSystemInfo GlobalLock CopyFileW QueryFullProcessImageNameW GlobalUnlock AcquireSRWLockExclusive SetLastError SetEvent CreateEventA QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA GetModuleHandleA SleepEx MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx GetCurrentDirectoryW InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetStringTypeW GetLocaleInfoEx FormatMessageW CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive GetFileInformationByHandleEx FindFirstFileExW GetFileInformationByHandle ReleaseSRWLockExclusive

user32

MessageBoxW ReleaseDC GetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors SendMessageA EmptyClipboard GetDC DestroyWindow GetMonitorInfoW

gdi32

GetDIBits GetObjectA BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCW DeleteDC DeleteObject

shell32

SHGetKnownFolderPath SHGetFolderPathW ShellExecuteExW

ole32

CoInitializeEx CoUninitialize CoTaskMemFree CreateStreamOnHGlobal CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

shlwapi

StrStrIW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptImportKey BCryptDecrypt BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenRandom BCryptDestroyKey

ncrypt

NCryptFreeObject NCryptDecrypt NCryptOpenKey NCryptOpenStorageProvider

gdiplus

GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipDisposeImage GdiplusStartup GdipCreateBitmapFromHBITMAP

avicap32

capCreateCaptureWindowA