MALICIOUS — 464dbba8f404d7ddda1f792e5773a2682ce5956a9b655fe163048ac5c8520d38
MALICIOUS — 464dbba8f404d7ddda1f792e5773a2682ce5956a9b655fe163048ac5c8520d38 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
464dbba8f404d7ddda1f792e5773a2682ce5956a9b655fe163048ac5c8520d38 - SHA-1:
04132b86c5c122ef615ed4fcff6f576e837578e0 - MD5:
62246dae284c4ba8861ea7932e689457 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
MITRE ATT&CK
Dynamic analysis (windows)
6049 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- msedge.api.cdp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- assets.msn.com
- kv801.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/14049/files/ba1c6034d22f090e98d5457e49a24ec7388d99af2780ebd79d4eb1ed39b913f3 —
ba1c6034d22f090e98d5457e49a24ec7388d99af2780ebd79d4eb1ed39b913f3 - /opt/CAPEv2/storage/analyses/14049/files/73517bd8dcf5a832482659a1cfcde8671e5f7a3e348548b578e92d2e4fba0d7e —
73517bd8dcf5a832482659a1cfcde8671e5f7a3e348548b578e92d2e4fba0d7e - /opt/CAPEv2/storage/analyses/14049/files/f28eba38b36b722318b84bebf8e04cc6e7390092ede4f1744ab09c5646d421cc —
f28eba38b36b722318b84bebf8e04cc6e7390092ede4f1744ab09c5646d421cc - /opt/CAPEv2/storage/analyses/14049/files/f8c9f605f8dddeab8fbe972243c27ab7578881505a89282de0c2f5d5718fc868 —
f8c9f605f8dddeab8fbe972243c27ab7578881505a89282de0c2f5d5718fc868 - /opt/CAPEv2/storage/analyses/14049/files/b3e7c62bdd60f8f516e304e103cf4222dbced0b830ebbaf1ef6ae63b4d319a4e —
b3e7c62bdd60f8f516e304e103cf4222dbced0b830ebbaf1ef6ae63b4d319a4e - /opt/CAPEv2/storage/analyses/14049/files/e17ac43c0e111f7b608aed970ce360760937b80c8abbee92ce0b2d24cc52c2b9 —
e17ac43c0e111f7b608aed970ce360760937b80c8abbee92ce0b2d24cc52c2b9 - /opt/CAPEv2/storage/analyses/14049/files/3477d5f8367187ccf79700aee15476cc5078286360a9d7cba1defe5df51b6f1b —
3477d5f8367187ccf79700aee15476cc5078286360a9d7cba1defe5df51b6f1b - /opt/CAPEv2/storage/analyses/14049/files/5bb473c8f6fe9cc210174fb41939772abbf85763dfd26eabe01544e4bc9f4690 —
5bb473c8f6fe9cc210174fb41939772abbf85763dfd26eabe01544e4bc9f4690 - /opt/CAPEv2/storage/analyses/14049/files/b3fdf85bd32ef7aaa4cc7a4dc597504c700a537d57cb66ee37f5d133eb5efc12 —
b3fdf85bd32ef7aaa4cc7a4dc597504c700a537d57cb66ee37f5d133eb5efc12 - /opt/CAPEv2/storage/analyses/14049/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/14049/files/2fc7cc13ac7e20f21517dcae3cc9e5e50e7f98924112863997374431c1763a30 —
2fc7cc13ac7e20f21517dcae3cc9e5e50e7f98924112863997374431c1763a30 - /opt/CAPEv2/storage/analyses/14049/files/778f8a7c107b61f44d6b0dbacd41f048a6543e71bc2becd85de7651744d92e67 —
778f8a7c107b61f44d6b0dbacd41f048a6543e71bc2becd85de7651744d92e67 - /opt/CAPEv2/storage/analyses/14049/files/d3315d14ba5c7b0da5111fe24b741807661b4f2b3fe9172388655d35d1d82afe —
d3315d14ba5c7b0da5111fe24b741807661b4f2b3fe9172388655d35d1d82afe - /opt/CAPEv2/storage/analyses/14049/files/f71c9f0fad5b2e241cc2e958a8526d2ecc962617e0ca1e9978a61f355bedc107 —
f71c9f0fad5b2e241cc2e958a8526d2ecc962617e0ca1e9978a61f355bedc107 - /opt/CAPEv2/storage/analyses/14049/files/7416bc3bcaacd3f1a9ebe0b559890a56b7f5e9775afbfa33edfd2f3bd0b08427 —
7416bc3bcaacd3f1a9ebe0b559890a56b7f5e9775afbfa33edfd2f3bd0b08427
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786564248&P2=404&P3=2&P4=F3TGghMhuWSu0mNmcQmCDpYDdfWQOdoap6at%2be%2biKq09Nvnrp5U5lvclkP0x5SgEddA0OnKIt9ZZn1OssiMMew%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786564306&P2=404&P3=2&P4=Q8PbmimiK3Y2PaeCnCoYA2hOfsNYvcF31ZQ6r0gqS4SXXjXVGc%2bXTMtLI%2fITatOyZbJLjSFTcWCQKBzgUzoOAg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 40.79.141.153
- 52.123.252.195
- 4.230.171.124
- 57.154.63.210
- 52.253.84.76
- 20.42.179.204
- 74.179.71.159
- 20.165.94.63
- 149.154.167.99
- 74.178.240.51
- 20.184.175.17
- 149.154.164.24
- 203.26.79.13
- 20.42.179.192
- 172.178.240.163
- 52.182.143.212
- 20.42.65.84
- 92.223.78.30
- 72.154.7.99
- 52.148.114.188
- 52.110.12.42
- 52.110.12.1
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report