milleniumrat | 18c4e94b11721f0d315ebf27a49726fd7df75ad12df6ee4f0636da682d3b5d6c

General

Target
HMC MAIL CHECKER 2.3.zip
Size 158.7MB
Sample261023-2szrfaet71
SHA256 18c4e94b11721f0d315ebf27a49726fd7df75ad12df6ee4f0636da682d3b5d6c
MD5 194d1a88cb25c91f6e349e3f178db996
SHA1 2f9bd6558f0d1701a35cf6c7d2acf10e7903efff
SHA512 a2b806c37a51887eed5cb4afe460834fca9477a293cebe2adf4e31c8c1bf2321529024f3c656179f03812b371cd7caffd332a43f64b694e5fffef436a6187a44
SSDEEP 3145728:ZalDAR2n5DiDfzKIWK+dOC13gmSonZA0JsutVD9RBO+5hSjK:Al2nKPv3EFuRBOGSjK
TLSH
T1FA8833F4FE193D679E8D268629D0E81530DFE0C67F94296D0BCA731CDBC26DA866204D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  HMC MAIL CHECKER 2.3.exe
- Size 158.8MB
- SHA256 10ec538a83d3824eb6e633dd6c5fdcadd94e03ddc9216dc86272957ab873a5f8
- MD5 077b3105e5df964d7e5fc50fd3427821
- SHA1 6f3238ddfa1393ae94757e0e7c5e4ff81c2ce46d
- SHA512 1f8869c861fdc42e89bebf2d6c4cb5e7fe89efd9781978dd95f07f956ec814b29d09143f75571284e2d4229df3dd7de52aca601b90b961b1d25505ef63cc6328
- SSDEEP 3145728:2q3dM14ZTtif/JWkmo4d+kBBwMUAJb0WXuypxhHzvSC57A7Q:b3s5WV3BoxgzvSoA7Q
- TLSH
  T119883398EF683DBADD8A26B419D1D401F0FBB0893F94692F07D9B31D8F836D58A36144
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Password.txt
- Size 52B
- SHA256 941e4026cba2a9785b4aab4bf579294a39d9798c53016a1498b70e2dc8eeb37a
- MD5 2bd02a701df3e98883d089851b50bae6
- SHA1 fc188046e6fe7033db1bc812d72fa64f8e984ff7
- SHA512 3ea304cd5613dd130057dc9218ac2b9d4da69cc409914f863a8bfcff2565e64f91ef04cbefb55e15d4d9309e1b672556eb0929855a3606954d4c43357c02dbde
- TLSH
  T15790029A34064B0C140126564D49584004125369862024F9432004647219A1481F85C7
- MD5 SHA1 SHA512 TLSH
Score

1^/10

ransomware
behavioral3 behavioral4
- Target
  setup.bat
- Size 115B
- SHA256 4813b1bd8c65ec474434e049e69cf01d67ff772be7e1717583d2135f630a9ccb
- MD5 01ad58928bab27a41ce5443df638b0a2
- SHA1 2b9a82176da62f53d75244028eaebb10599aa487
- SHA512 f1e18b1d500614be30b9b55a1d1b82c642439c37d36eccaef5118e3b2165a8ac11cf1dd1bc2f1d5c880ad3d4a16ec4029b1c53979a7912159190571cd3336200
- TLSH
  T1BBB0126E5193755097D324C08B262A513BCF506F478BE3C23104EDC976411BEC1E48AE
- MD5 SHA1 SHA512 TLSH
Score

10^/10

credential_access defense_evasion discovery execution milleniumrat persistence privilege_escalation rat spyware stealer
- Detects MilleniumRAT stealer
- Family: MilleniumRat
  MilleniumRat is a remote access trojan written in C#.
  rat stealer milleniumrat
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Uses browser remote debugging
  Can be used to control the browser and steal sensitive information such as credentials and session cookies.
  credential_access stealer
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6