MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MilleniumRAT

Vendor detections: 15

Intelligence 15 IOCs YARA 16 File information Comments

SHA256 hash:	da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee
SHA3-384 hash:	96df769d570e87cd9b6b7eba72cabf932616c22f251697ca32f60c51afd2f57be783e7ca62797c0bdb1978705865df29
SHA1 hash:	e7acd1a840e8a892d80334f336f3df6b5c08fa65
MD5 hash:	d511e371982a234c5ef727bcbfd627a8
humanhash:	beer-butter-video-oven
File name:	file
Download:	download sample
Signature	MilleniumRAT Create hunting rule
File size:	2'917'888 bytes
First seen:	2025-10-08 04:03:41 UTC
Last seen:	2025-10-08 04:03:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep	49152:Lef3r51gEdTJ+7a3fDkbET/u6IhNwFpYbLpcF9NbC/14yksFr7MxSjcC/8Tg2:Cf3rPP91m6IzwFpSNcHNetCsdqk2
TLSH	T10FD533164E0AC743C4366873DCCA96C7DEEEEF4989793929114E91FECB1911FCAA0E11
TrID	32.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 28.9% (.EXE) Win32 Executable (generic) (4504/4/1) 13.0% (.EXE) OS/2 Executable (generic) (2029/13) 12.8% (.EXE) Generic Win/DOS Executable (2002/3) 12.8% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe MilleniumRAT

Bitsight

url: http://178.16.55.189/files/7269512085/abMMGV5.exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

amadey

ID:

File name:

random.exe

Verdict:

Malicious activity

Analysis date:

2025-10-07 23:15:03 UTC

Tags:

amadey botnet stealer themida rdp auto loader golang generic github telegram evasion arcstealer gcleaner netsupport rmm-tool arch-exec anti-evasion autoit remote xworm miner pastebin darkvision winring0-sys vuln-driver stealc vidar rustystealer purecrypter arch-doc rat socks5systemz proxybot websocket phishing

Link:

https://app.any.run/tasks/318beed9-a767-4da8-bfe2-3b8963013b8e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/31076/

Detection(s):

SecuriteInfo.com.Trojan.Lumma-1.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68e506c7277c2bd8bc5d64fc

Tags:

spawn virus sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Searching for analyzing tools

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Connection attempt

Sending a custom TCP request

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Creating a window

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypt microsoft_visual_cc obfuscated overlay overlay packed packed risepro themidawinlicense unsafe zero

Link:

https://www.filescan.io/uploads/68e5e2e7d4a0085473c39281/reports/61ac8471-5d09-48b5-ac3c-91ce753d452f/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-10-07T09:43:00Z UTC

Last seen:

2025-10-09T22:42:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/0fc29056-f97f-49c0-9927-f4e51005cd98

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/d511e371982a234c5ef727bcbfd627a8

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee/

Verdict:

Malicious

Threat:

Family.MILLENIUMRAT

Link:

https://tip.neiki.dev/file/da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee

Threat name:

Win32.Malware.Heuristic

Status:

Malicious

First seen:

2025-10-07 12:25:45 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

14 of 24 (58.33%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ijekazzmpjbl4iynghjfdecr6bv6s7w4h3zidnpheepammlspxa._file

Result

Malware family:

milleniumrat

Score:

10/10

Tags:

family:milleniumrat credential_access defense_evasion discovery rat spyware stealer

Link:

https://tria.ge/reports/251008-enffns1zew/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Browser Information Discovery

System Location Discovery: System Language Discovery

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Checks BIOS information in registry

Executes dropped EXE

Identifies Wine through registry keys

Reads user/profile data of web browsers

Uses browser remote debugging

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Detects MilleniumRAT stealer

MilleniumRat

Milleniumrat family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/afdfff46-094c-4a55-9479-49bf55b90ec3

Unpacked files

SH256 hash:

da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee

MD5 hash:

d511e371982a234c5ef727bcbfd627a8

SHA1 hash:

e7acd1a840e8a892d80334f336f3df6b5c08fa65

Link:

https://www.unpac.me/results/681eb780-5ac8-4b62-adef-da61582ac521/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/da1245033963d215f118698e928c828f835f4bf6e1f7940daf3908f0318b93ee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_Sandworm_ArguePatch_Apr_2022_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:	https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs Create hunting rule
Author:	ditekSHen
Description:	Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM names

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL Create hunting rule
Author:	ditekSHen
Description:	Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion

Rule name:	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing possible sandbox analysis VM usernames

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	Macos_Infostealer_Wallets_8e469ea0 Create hunting rule
Author:	Elastic Security

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	WIN_WebSocket_Base64_C2_20250726 Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects configuration strings used by malware to specify WebSocket command-and-control endpoints inside Base64-encoded data. It looks for prefixes such as '#ws://' or '#wss://' that were found in QuasarRAT configuration data.