Unveiling A New Threat The Millenium Rat

At CYFIRMA, our mission is to equip you with the most cutting-edge insights into the evolving landscape of cybersecurity threats, both targeting organizations and individuals. Our research team identified a new RAT on GitHub, available for purchase. This in-depth report investigates the Millenium-RAT, particularly version 2.4; a Win32 executable built on .NET. Notably, the RAT is actively under development, with a new version, 2.5, released just three days ago.

Significantly, these sophisticated tools and their fundamental elements are readily accessible via widely used platforms such as GitHub. While their creators may offer justifications for their developments, the truth remains that such open accessibility significantly heightens the risk. This accessibility makes it increasingly easy for threat actors to acquire, modify, and tailor these tools for nefarious purposes. The prevalent availability of these tools, coupled with their potential for misuse, emphasizes the immediate need for heightened cybersecurity awareness to mitigate the expanding threat landscape.

The developer of the Millenium RAT specifies a price of $30 for lifetime access to version 2.4. Remarkably, for the latest version updated just three days ago, there is no explicit mention of a price. Instead, interested individuals are encouraged to establish via Telegram for further details.

The analysed malware, Millenium-RAT-2.4, is a sophisticated Remote Access Tool (RAT) targeting Windows systems. This malware exemplifies a sophisticated range of malicious functionalities meticulously crafted to stealthily gather sensitive user data, evade detection through advanced anti-analysis techniques, establish persistence, and enable remote control over the compromised system. The Millenium-RAT-2.4 boasts a diverse skill set, featuring data exfiltration, system information harvesting, evasion tactics targeting sandbox environments, anti-debugging measures, process disruption, self-destruct mechanisms, and remote command execution through the Telegram platform.

Moreover, this malicious software specializes in capturing browser data, Discord tokens, keystrokes, and system information, intending to exploit and leak sensitive data for unauthorized access and control. Leveraging the Telegram API for communication and file transmission, it poses substantial risks to both user privacy and system security.

Covert Threat of Millenium RAT on GitHub: The CYFIRMA research team has unveiled a concerning threat known as the Millenium RAT, distinguished for its diverse functionalities designed to clandestinely extract an extensive range of data from compromised systems and other functionalities like evading detection, establish persistence, and enable remote control over the compromised system. Disturbingly, this RAT is being on GitHub, ambiguously presented as an educational resource, while clandestinely offering lifetime access for a nominal fee. Despite being a closed-source project without publicly available code, interested parties are directed to make via Telegram for access.

In September-2023, our team released a detailed report on The-Murk-Stealer; an open-source data-stealing tool that is deceptively presented as an educational resource on GitHub. The report can be accessed here. Such tactics echoes the prevalent strategy of malware developers who exploit platforms such as GitHub by camouflaging their malicious tools under the facades of ‘educational’ or ‘research’ projects. This guise of legitimacy hides their harmful intent, fuelling the spread of cyber threats disguised as innocent tools.

Evolution: From Version 2.4 to 2.5: The analyzed sample pertains to version 2.4, available for a lifetime access at $30, as disclosed by the malware author on their GitHub account. The features of malware are mentioned with the end note- “for education purpose only”.

The malware is continuously undergoing development, with the most recent upgrade to version 2.5, released just three days ago. This time, the author doesn’t specify a price; instead, they request interested individuals to via Telegram.

RAT Builder: The RAT builder is also available which offers customization options, allowing tailored creation of the RAT according to specific requirements. Users can provide details such as the Telegram Bot token, Telegram chat ID, and even select filenames, including the keylogger file. Additionally, users have the choice to incorporate features like anti-debugging measures or exclude them as needed.

Millenium RAT Possibly Derived from ToxicEye RAT: It appears that the Millenium RAT is a derivative of an open-source Telegram RAT named ToxicEye RAT. The latter is presently archived and hasn’t received updates for a substantial period, approximately in the last three years.

The structure and modules of MilleniumRAT and ToxicEye RATs are same.

The code, namespaces, function names, arguments are also similar in different modules. Here the below screenshot shows “commands” module starting code of both.

The code in other modules exhibits similar structure, code and functionalities, as illustrated below for the other module “Program”.

The Rising Threat-Millenium RAT: From GitHub’s Faux Education to Real Danger: This indicates the ease with which open-source malicious code, tools, and malware can be leveraged by other malicious actors. They can customize and enhance these codes to suit contemporary needs, subsequently offering them for sale or distribution on popular platforms like GitHub.

The emergence of the malware like Millenium RAT poses a serious concern within the realm of cybersecurity, standing out for its multifaceted capabilities aimed at surreptitiously extracting a wide array of data from compromised systems. The RAT employs various techniques, including evasion tactics, establishing persistence, and allowing remote control over infected systems.

Moreover, the provision of a RAT builder allows customization, where users can choose features and parameters such as Telegram details and filenames, denoting the alarming ease with which these malicious tools can be manipulated and distributed. This is further highlighted by the evident similarities between the MilleniumRAT and the older ToxicEye RAT, suggesting how existing open-source malicious code can be adapted and repurposed by other malicious actors to suit their needs, presenting a serious threat to cybersecurity landscapes.

Basic Details: MD5: eba4be8ed0e9282976f8ee0b04fb2474 SHA256: 6d207c1e954f9d60f693e17e63df73fb8e954d02544b5d52b8b18c4ab86a267e File Type: Win32 EXE

The provided binary is a Win32 executable developed using .NET. Its compilation timestamp on December 9, 2077, raises significant suspicion. This distant future date suggests potential tampering or an attempt to conceal the true compilation time.

The sample is Millenium-RAT-2.4 version, which is the latest version as mentioned in the GitHub account of the malware author.

Geolocation Identification: On execution, the RAT connects with the URL to collect information the location which includes country, city, ISP, longitude, latitude, time zone etc.

RAT Configuration, File Decryption and Operational Settings: The RAT reads the file located in the current directory, likely a configuration file, and decodes the contents. The file is split into an array using the delimiter ‘|’ and a marker [EOF]. It validates the decoded information: if the array does not contain at least 14 elements, the application terminates. It utilizes a custom encoding method (Rot13) to decode the array elements. It assigns decoded values to corresponding properties in the config class that define various operational settings of the malware.

Advanced Evasion Techniques and System Detection Capabilities: The RAT employs a variety of evasion techniques, attempts to gather system and user data, and initiates threads for different functionalities. It conceals the console window of the malware from the user’s view, checks if a copy of the malware is running or not, enabling the malware to run automatically on system startup.

It detects virtual machine environments, sandbox software, debuggers, and installed antivirus software. Here’s a breakdown of each function: It checks for signs of VirtualBox or other virtual machine software by gathering system information, inspects the Win32_ComputerSystem class properties, such as Manufacturer and Model, to identify virtual environments and searches for keywords like “VIRTUAL,” “vmware,” or “VirtualBox” within system details. It also inspects the Win32_VideoController class properties to further identify VMware or VBox (VirtualBox).

It also detects the presence of Sandboxie by checking for specific module handles. Verifies the presence of several DLLs (SbieDll.dll, SxIn.dll, Sf2.dll, snxhk.dll, cmdvrt32.dll) associated with Sandboxie by using GetModuleHandle. It attempts to detect if the application is running within a debugger. Measures the execution time elapsed by creating a time interval and sleeping for a brief period. It compares the time before and after the sleep, and if the time elapsed is too short, it indicates potential debugging activity.

It queries the system to gather information installed antivirus products. Retrieves the display names of installed antivirus software.

Hindering Analysis and Monitoring: The malware monitors and actively disrupts the execution of specified processes that are commonly associated with network monitoring tools or malware analysis, thereby hindering their operation. By targeting known monitoring tools such as Wireshark, Process Hacker, netstat, netmon, tcpview, Filemon, regmon, cain, the malware aims to avoid being detected and analyzed.

Self-Installation and Self Destruction Features of the RAT: The RAT has the capability to install and uninstall itself. It checks if the installation path for the malware exists. If not, it creates the necessary directories, copies the current executable file (malware) to the specified installation path (“C:\Users\Username\AppData\Roaming\GoogleChromeUpdateLog”) with name “Update.exe”if the malware’s file doesn’t exist there. It ensures that the malware is installed and ready to execute from the specified path.

RAT also removes the malware and associated artifacts from the system. It attempts to delete autorun entries that the malware created, deletes registry keys associated with the malware’s configuration (if present), generates a batch file to perform cleanup actions and removes the installation and keylogger directories (“C:\Users\Username\AppData\Roaming\SoftwareLogs”).It initiates a process that executes the batch file created and then terminates the current process to self-destruct. The malware moves or self-deletes the executable file from its initial location to the designated installation path, where it is set to run. This action helps in evading detection by altering the file’s location and content.

Autostart-Establishing Persistence via Registry Modification: The RAT ensures that it runs automatically upon system startup. It attempts to delete the registry key if it already exists at “HKCU\Software\Microsoft\Windows\CurrentVersion\Run” with the entry name “ChromeUpdate”. After removing the existing autorun entry, the code then attempts to set a new autorun entry in the registry by creating a new hidden command prompt process. It writes a new registry entry to the “HKCU\Software\Microsoft\Windows\CurrentVersion\Run” path. The entry created is named with the name “ChromeUpdate”, and it points to the malicious executable file “Update.exe” at “C:\Users\Username\AppData\Roaming\GoogleChromeUpdateLog”.

Verifying Internet Connectivity for Malware Operations: The RAT confirms active internet connectivity by attempting to ping both “google.com” and “api.telegram.org” before proceeding further with operations that rely on an internet connection. The success of these ping requests would confirm that the malware can reach these domains, ensuring that the infected system is connected to the internet.

Stealing Sensitive Browser Data for Exfiltration via Telegram: RAT is designed to steal sensitive data from various web browsers installed on the infected system. The module consists of two main functions: StealBrowserData and StealHistory. These functions attempt to gather information from several popular browsers. The data is then organized, compressed, and sent to an external server for exfiltration, using the Telegram API.

It aggressively targets and gathers data from Chrome, Microsoft Edge, Opera, Brave, and other browsers by first terminating any running instances of these browsers. It then proceeds to collect various sensitive information, such as passwords, downloads, credit card details, cookies, and browsing history, from specific directories associated with the targeted browsers. This information is subsequently structured and stored in separate text files (BrowserPasswords.txt, BrowserDownloads.txt, CreditCards.txt, BrowserCookies.txt) within a newly created directory named “Browser data”. Once collected, these files are compressed into a ZIP archive (Browser data.zip). Similarly, it also reads the history information, prepares the text based on URL and title, then writes this data to a file named BrowserHistory.txt.