milleniumrat | cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.zip
Size 1.2MB
Sample261016-rrmelsvxev
SHA256 ca44d4b160adad59dd02e3f4723bff298a8e2f6b317988345a8474235a29530b
MD5 954197b352116f84e69ae3bda59b571b
SHA1 46c1590e72160c474dfb4d881416a1ee6841c086
SHA512 1b7368b8bfd89a03abcadf753a36af1078ace162f8a178dfdb3fc827fa54dbe1483ba972a7a4d608eebcbb209690828cca8d3938741099956d3c5d4e85e2c611
SSDEEP 24576:aD/VSl5IWWoPTerDPFcifQ52SEZ46wgf+MdCX8IBGw26mRCsA6G672KGMzo1I:abVg5IWWEC3OifQ52HdtIBGwS0l67RG+
TLSH
T14855331144856E84B6A12BD62BEBF29A3F6D880DE9D75B8C44FD201EFA64404F3CDD36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat stealer milleniumrat

Malware Config

Signatures

Family: MilleniumRat
MilleniumRat is a remote access trojan written in C#.
rat stealer milleniumrat

Detects MilleniumRAT stealer 1 IoCs

resource	yara_rule
static1/unpack001/cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448	family_milleniumrat

Detect suspicious telegram bot 1 IoCs

Detect suspicious telegram bot.

resource	yara_rule
static1/unpack001/cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448	suspicious_telegram_bot

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448

File Explorer

cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.zip

.zip 1.2MB
cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448

.exe 2.4MB

cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448.zip

SHA256 ca44d4b160adad59dd02e3f4723bff298a8e2f6b317988345a8474235a29530b
MD5 954197b352116f84e69ae3bda59b571b
SHA1 46c1590e72160c474dfb4d881416a1ee6841c086
SHA512 1b7368b8bfd89a03abcadf753a36af1078ace162f8a178dfdb3fc827fa54dbe1483ba972a7a4d608eebcbb209690828cca8d3938741099956d3c5d4e85e2c611
SSDEEP 24576:aD/VSl5IWWoPTerDPFcifQ52SEZ46wgf+MdCX8IBGw26mRCsA6G672KGMzo1I:abVg5IWWEC3OifQ52HdtIBGwS0l67RG+
TLSH
T14855331144856E84B6A12BD62BEBF29A3F6D880DE9D75B8C44FD201EFA64404F3CDD36
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448

IMPHASH ed3c6fe5f2fc90fbaf5b360ba051c76e
SHA256 cfdee02d88afe419a86ab4d93900ffb4774a1c77d0fbf0bb5f015138a475d448
MD5 2a13c82baacd5251b47a15255217d0a2
SHA1 77413ad0948a40d31d826e42f294d80f9df8ca11
SHA512 ebf06d692a54549280fdc9caf8d80b0636a2769b1d30d7d3115fbbe37a3c2cc44142b882f603f0756f087580057a7f3d15efcb25463c221ad0faf0b60b16c36b
SSDEEP 49152:5fC7+hLkJiLw/KtbDITXjJG0zvq8ulcdhhtosT1MNMMnMznc2F:SoLr9DITjJG0boO1BHb
TLSH
T1CCC59E22FB8290B2E4D601B062BE6BF75D797234132558CBE3C01D6A59206D3763AF5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MilleniumRAT stealer
Detect suspicious telegram bot

Detect suspicious telegram bot.
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1878247

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAEnumNetworkEvents WSACreateEvent WSACloseEvent getsockopt WSACleanup inet_pton WSAStartup WSAResetEvent closesocket select getaddrinfo send WSAGetLastError socket connect recv freeaddrinfo ioctlsocket setsockopt WSAEventSelect WSAWaitForMultipleEvents WSASetLastError ntohs bind getpeername gethostname sendto recvfrom listen htonl accept getsockname __WSAFDIsSet htons WSAIoctl

wldap32

ord60 ord45 ord50 ord41 ord22 ord26 ord27 ord32 ord143 ord217 ord33 ord35 ord79 ord30 ord200 ord46 ord301 ord211

crypt32

CertOpenStore CryptUnprotectData CryptStringToBinaryA CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext PFXImportCertStore CertCreateCertificateChainEngine CryptDecodeObjectEx CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCloseStore CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore

advapi32

RevertToSelf GetUserNameW RegOpenKeyExW RegCloseKey DuplicateTokenEx DuplicateToken SetThreadToken OpenProcessToken ImpersonateLoggedOnUser LookupPrivilegeValueA GetTokenInformation RegQueryValueExW SystemFunction036 CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA OpenThreadToken RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegDeleteValueW AdjustTokenPrivileges

kernel32

EncodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread ExitProcess SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation IsValidCodePage FormatMessageA MultiByteToWideChar AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize Sleep GetTempPathA GetACP GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers SizeofResource FindFirstFileW FindNextFileW GetModuleFileNameW InitializeCriticalSectionEx FindResourceA FindClose OpenProcess LockResource LoadResource DecodePointer GetComputerNameW CreateProcessW GetModuleHandleW Process32First TerminateProcess CreateToolhelp32Snapshot Process32Next CreateProcessA GetCurrentProcess K32GetModuleFileNameExW Process32NextW Process32FirstW K32EnumProcesses CreateDirectoryW GetModuleFileNameA RemoveDirectoryW SetFileAttributesW K32GetModuleFileNameExA GetNativeSystemInfo GlobalLock CopyFileW QueryFullProcessImageNameW GlobalUnlock AcquireSRWLockExclusive SetLastError SetEvent CreateEventA QueryPerformanceFrequency GetCurrentThread GetSystemDirectoryA GetModuleHandleA SleepEx MoveFileExA GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW GetFileSizeEx GetCurrentDirectoryW InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetStringTypeW GetLocaleInfoEx FormatMessageW CreateThreadpoolWork FreeLibraryWhenCallbackReturns IsProcessorFeaturePresent SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryAcquireSRWLockExclusive GetFileInformationByHandleEx FindFirstFileExW GetFileInformationByHandle ReleaseSRWLockExclusive

user32

MessageBoxW ReleaseDC GetClipboardData CloseClipboard OpenClipboard EnumDisplayMonitors SendMessageA EmptyClipboard GetDC DestroyWindow GetMonitorInfoW

gdi32

GetDIBits GetObjectA BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCW DeleteDC DeleteObject

shell32

SHGetKnownFolderPath SHGetFolderPathW ShellExecuteExW

ole32

CoInitializeEx CoUninitialize CoTaskMemFree CreateStreamOnHGlobal CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

shlwapi

StrStrIW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptImportKey BCryptDecrypt BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenRandom BCryptDestroyKey

ncrypt

NCryptFreeObject NCryptDecrypt NCryptOpenKey NCryptOpenStorageProvider

gdiplus

GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipDisposeImage GdiplusStartup GdipCreateBitmapFromHBITMAP

avicap32

capCreateCaptureWindowA