MALICIOUS — axrrwj.exe

MALICIOUS — axrrwj.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100), attributed to the Mira family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f7e2a0b2e100f4556b8149f21ae67cabf24e5c8dec13291cd41ef4fa493d58ca
• SHA-1: 37da2a8c172ad94557dc695f69fcedfd632ecdc5
• MD5: ae4145a76cb7f01248b1443a54ae6d98
• imphash: 044fa07aef4575da982ff3317702d6b1
• ssdeep: 6144:OO2Wwqr+D5V4GDaFswO6Fz0sKy7Nu1ZPmG9jn+WGZO5t3UvAYZqkDvdUC1TgHVGD:Pjwqr+D5V4EwO6Fz0sK+oPmG9jnbGYqL
• TLSH: T18545C622511D7B2EE862C0FEC61C6E2C80A7BD8961BB83CCC967521997D65F315310FA
• Submitted as: axrrwj.exe
• File type: pe · Size: 265952 bytes
• Verdict: malicious (89/100) · Family: Mira

Detections (4 of 55 engines)

• ClamAV (daily): Win.Malware.Mira-6717565-0
• Kaspersky (KVRT): Trojan.Win32.Agent.nezvfi
• Microsoft Defender: Worm:Win32/Mira!rfn
• Emsisoft (Emergency Kit): Dump:Generic.Mira.632D18E4

MITRE ATT&CK

• T1547.001

Why this verdict

The malicious score of 89/100 is the fusion of 2 weighted signals:

• ClamAV (daily) flagged Win.Malware.Mira-6717565-0 (rule Win.Malware.Mira-6717565-0) - engine signal, weight 0.90, confidence 0.95
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded domains

• fstream-inst.cc

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report