MALICIOUS — 135e9c0f73df4161faf02aa1db284271471796ba1d1e90b2c334079f2a20faa9

MALICIOUS — 135e9c0f73df4161faf02aa1db284271471796ba1d1e90b2c334079f2a20faa9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mira family. 8 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 135e9c0f73df4161faf02aa1db284271471796ba1d1e90b2c334079f2a20faa9
SHA-1: e86d69517edcbbb84172c7c2a76ace2499206d1e
MD5: d1c25fe29d375059974e9c11b6baae96
imphash: 09d0478591d4f788cb3e5ea416c25237
ssdeep: 6144:hYQVzmxpNme9T/DxzOaznwBQRXHA3GuTs9wrQZiDvwKvpr:hbCv1QaTwBQ9gjTsEQAR
TLSH: T105497D934991B253CC71C5D91C30E93EDEA35B2427D6728FCA061CE26A93227D242F5B
Submitted as: 135e9c0f73df4161faf02aa1db284271471796ba1d1e90b2c334079f2a20faa9
File type: pe · Size: 392345 bytes
Verdict: malicious (100/100) · Family: Mira

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Malware.Mira-9856841-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Worm:Win32/Mira
Emsisoft (Emergency Kit): Generic.Mira.90C800D3
Trellix Stinger (McAfee): Trojan-FMLZ!D1C25FE29D37
Kaspersky (KVRT): Trojan.Win32.Agent.icgh

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Mira-9856841-0 (rule Win.Malware.Mira-9856841-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Mira (rule Worm:Win32/Mira) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Mira.90C800D3 (rule Generic.Mira.90C800D3) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FMLZ!D1C25FE29D37 (rule Trojan-FMLZ!D1C25FE29D37) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.icgh (rule Trojan.Win32.Agent.icgh) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 36 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

6845 behavior events · 1 ATT&CK techniques · 41 dropped files.

Dropped files

C:\Program Files (x86) .exe - 1383ce6e3ebb2290c393e559f5795441776e9a820ccd6c575b96d58aabe4db12
C:\System Volume Information .exe - 7edc827d9c3e209a0093c3b1863b0edd10e43baab59c939d58ce121957281abe
C:\uac-done.txt .exe - 7910ccdf0fb7f4514593723640a0a3eec890772355e54793884f11b375d34ad8
C:\inetpub .exe - 619c911dce9aa69aa61693e00d4f7cea0fa6775f11d649d3530d9ca09ba8220c
C:\bake.ps1 - 82b3883814ced5d2faa364c5830367374e02b8366850f654f4c4293a6f5223a0
C:\pwfix.ps1 - 93730c0ca091e8a3cc2ab6923577b19ae8b687d3f3e3ef994a9a19f6b7e1fd5f
C:\$Recycle.Bin .exe - d96742d31662a24fac0daf74a8a67390ddc8efb19b3e0dc18f3f8e2d75785d43
C:\pwfix.ps1 .exe - 2504e7567e52d1c186a00b1783a05dee85b2827b95bae27432e9ecbb64b524f7
C:\swapfile.sys .exe - f8fced164a79067bd0054c10ba460ea336ed49ac5dbefb91a4b340edbcbe8edc
76693e6b356503f07fe220134cc520b2dc99a6a291e650720e4806b727053177 - 76693e6b356503f07fe220134cc520b2dc99a6a291e650720e4806b727053177
C:\uac-done.txt - ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a
C:\ThreatLens .exe - c44fa9b5a83cd5a703a5675aa0c837ddebeba6f0e15e41b62b2b4878758154d5
C:\ProgramData .exe - fb873747c88b461a18de352f8e5104bb62ab27bb1bc80a9dfae281dcceff6a2b
C:\Recovery .exe - 8273092d37acb5acaa74d0b6e683fd6e386c2fed94cf222ff84feb83c391b43a
C:\792.ini .exe - 2df89fbd40520f44474938f68f9e8160905945dd802509367be26fc5c58b2b50

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

fstream-inst.cc
ostream-inst.cc
istream-inst.cc
io-inst.cc
string-inst.cc
tinfo.cc

Embedded IP addresses

4.150.223.108
52.123.252.202
4.149.160.182
4.230.171.124
172.64.154.167
135.232.92.97
74.179.77.204
40.79.141.152
57.154.63.210
20.42.73.26
72.153.5.96
52.148.114.188
52.110.12.8
52.110.12.28

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report