MALICIOUS — 6055398536939675d8d4594fed99284f7a2d8faf94ee696ab967ef1ac874643a
MALICIOUS — 6055398536939675d8d4594fed99284f7a2d8faf94ee696ab967ef1ac874643a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
6055398536939675d8d4594fed99284f7a2d8faf94ee696ab967ef1ac874643a - SHA-1:
c20958de055a643be058916e807ed12a6fe6f8dd - MD5:
5c6e2a780010ab333bad0fbe51c8cce9 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
MITRE ATT&CK
Dynamic analysis (windows)
6208 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- settings-win.data.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13845/files/6f567c845d300a4984cdacf7e98534bc3b2d9bfec8bf8c83197c67dd57b7ddc6 —
6f567c845d300a4984cdacf7e98534bc3b2d9bfec8bf8c83197c67dd57b7ddc6 - /opt/CAPEv2/storage/analyses/13845/files/5176ad13282473f73e00532c20d0ea0deaabc8a09b3b058cd33d3fb6ece2556d —
5176ad13282473f73e00532c20d0ea0deaabc8a09b3b058cd33d3fb6ece2556d - /opt/CAPEv2/storage/analyses/13845/files/1a1b5088d5b7aa7d551e8e722f4c336f90ff981cefc26c67d62f1776d337fff9 —
1a1b5088d5b7aa7d551e8e722f4c336f90ff981cefc26c67d62f1776d337fff9 - /opt/CAPEv2/storage/analyses/13845/files/8261e1c6a04a9308d5d2dd892bee3217e6d597bc5e99f65f1ac9f39258909b50 —
8261e1c6a04a9308d5d2dd892bee3217e6d597bc5e99f65f1ac9f39258909b50 - /opt/CAPEv2/storage/analyses/13845/files/436aeb8b35c8eb09b3e60266afd2186b1aa929ed7e97ebc5619fe9996f15a9c2 —
436aeb8b35c8eb09b3e60266afd2186b1aa929ed7e97ebc5619fe9996f15a9c2 - /opt/CAPEv2/storage/analyses/13845/files/b873444d78f5fa07339f892aab2e9bfb74296e48864067634cee3c952ddba139 —
b873444d78f5fa07339f892aab2e9bfb74296e48864067634cee3c952ddba139 - /opt/CAPEv2/storage/analyses/13845/files/0b0d744e10ceabea9a358872cbe7ef46f5d6473e38c900f54c6bc63256929b2b —
0b0d744e10ceabea9a358872cbe7ef46f5d6473e38c900f54c6bc63256929b2b - /opt/CAPEv2/storage/analyses/13845/files/c37324086e733958bc1fee998eb83b69456671abe697c9c6c04efdcac7be69d0 —
c37324086e733958bc1fee998eb83b69456671abe697c9c6c04efdcac7be69d0 - /opt/CAPEv2/storage/analyses/13845/files/2b2f28694f0319825143d6b2b63bafed1b7678d25e71aa8dd3e40c46821026e6 —
2b2f28694f0319825143d6b2b63bafed1b7678d25e71aa8dd3e40c46821026e6 - /opt/CAPEv2/storage/analyses/13845/files/8669dae8f9a947ff89d69d0dcb806f33bf47a64403acd28c6baf58837172f4cb —
8669dae8f9a947ff89d69d0dcb806f33bf47a64403acd28c6baf58837172f4cb - /opt/CAPEv2/storage/analyses/13845/files/d1449c37704d22593c6a007ea881f870551dfff549100686750137bbabfe11ac —
d1449c37704d22593c6a007ea881f870551dfff549100686750137bbabfe11ac - /opt/CAPEv2/storage/analyses/13845/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/13845/files/6c29cae96c912491195a13f12f51cf382a744604747f4ca38d91f05349b0c261 —
6c29cae96c912491195a13f12f51cf382a744604747f4ca38d91f05349b0c261 - /opt/CAPEv2/storage/analyses/13845/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/13845/files/58968332a402277cd91f1316600dd0e86318408cb73e96991736419fb07e0c33 —
58968332a402277cd91f1316600dd0e86318408cb73e96991736419fb07e0c33
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786558722&P2=404&P3=2&P4=jGWPWdAl6AL75yqGd%2bxs9ae0ZJV0Eg7Bn7S82T4%2fBT%2f0BA0rqY2vdWJjseyr5TZeAcHHHC4kxERGqVKpUJMCaQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786558748&P2=404&P3=2&P4=FVrVSTInvzBebTWav%2bmd9ngxq3i6%2fq0uMCNp5oITZi1O8Gd4yzcFR%2fEAwpkH0lC7%2bmd1%2fmRwg2JaxQ81jWpspg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 44.224.227.115
- 40.115.75.193
- 35.165.194.112
- 52.86.189.103
- 4.150.223.115
- 103.229.10.211
- 40.84.85.40
- 20.247.185.124
- 4.230.171.124
- 135.233.95.144
- 20.165.94.54
- 20.42.65.93
- 4.237.188.71
- 20.42.65.84
- 172.178.240.163
- 48.211.4.16
- 108.158.32.67
- 142.250.195.136
- 203.26.79.13
- 135.233.95.80
- 52.123.252.238
- 108.158.32.57
- 3.175.115.44
- 18.65.243.179
- 52.148.114.188
File paths
- D:\QL
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report