milleniumrat | b7e206c2b807ceede1153cbbb7070ac2926c2ea9346cc8f85c568e4dad48489e

General

Target
21102026_0558_20102026_FedEx-AWB-Documents-PDF.bat.rar
Size 3.4MB
Sample261021-gpmbqac12j
SHA256 b7e206c2b807ceede1153cbbb7070ac2926c2ea9346cc8f85c568e4dad48489e
MD5 f2b1d4c7e221fab09b256e9600b390ec
SHA1 394d77e2a9b66809bf5a8fe59241839113bc413f
SHA512 fda8042c2b281e1e0eaea912c2cf88f47f03d59f9a940941157cdcca106e09554548209d47431b7ac893d5f2c04a9cd30bd109e332f5576f148774e083293c5d
SSDEEP 98304:IJG45zphetjI6eeYAUr8iUQLx139sxDddGrsdCYJ6NFZBY:IBaIt7AUVrLLa9iQJeNY
TLSH
T135F53362B95FFF01D12F4308A41C826389E2501402FDA92D6A4FF9D1E9C7C978E6ADDD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  FedEx-AWB-Documents-PDF.bat
- Size 3.5MB
- SHA256 680071c8a8e38f1333d1194b56e0dbaeed99cadb4dda22d7060256acebc689d0
- MD5 fdc6df18d47bada5098f8469d712d404
- SHA1 e355409165bd535abed62b8caf75103429c1c04a
- SHA512 c4cca6e5adfcd0e86cd8def7402e2aa43f8160418fea15b4cba336f2af22e583914dc8461e9d4b1a2e469431a1527db79a1ce65ca104c94dda8b7461b071fb20
- SSDEEP 98304:6yGOtH3W9l2dPkW7oEDMts9AKu2HAeBBd:6Wtm9l25kTEYtsGKPH9/
- TLSH
  T1B90623002265D712C9E177B8D661F2F927786DC9F420D24B5EE1BCCBF631B149F0AA86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution milleniumrat persistence rat spyware stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- SmartAssembly .NET packer
  Detects SmartAssembly .NET packer.
- Suspicious use of SetThreadContext
behavioral1 behavioral2