Group-IB observed that Millenium RAT 4.x places additional random Base64 content alongside configuration data. This can alter resulting file hashes between builds even when underlying functionality remains similar. Each build can produce a different hash while behaving the same way.
This is why hash-based detection is insufficient on its own. A hash matches a known file fingerprint; when builds vary hashes, hash-based detections miss. Hashes remain useful — they identify known-bad samples quickly — but they cannot be the sole detection mechanism.
Modern defenders should correlate file reputation, behavioral activity, process lineage, persistence behavior, network communication, and endpoint telemetry. A process running from AppData, creating a Run key, connecting to the Telegram Bot API, and accessing browser credentials is a higher-confidence signal than any single hash match, and it survives hash variation between builds.
