MALICIOUS — 9aa6c6695c6e12bc92615209e5ee86b40ccc7b8b7e4ac4a20e5c791f91f84c9e
MALICIOUS — 9aa6c6695c6e12bc92615209e5ee86b40ccc7b8b7e4ac4a20e5c791f91f84c9e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
9aa6c6695c6e12bc92615209e5ee86b40ccc7b8b7e4ac4a20e5c791f91f84c9e - SHA-1:
c8298366e18e048ad6b0205b6dd038975b0f63b1 - MD5:
874d5cf05a01d7d0b25612a5106cf269 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
MITRE ATT&CK
Dynamic analysis (windows)
6188 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- settings-win.data.microsoft.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- msedge.api.cdp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- licensing.mp.microsoft.com
- odc.officeapps.live.com
- geo.prod.do.dsp.mp.microsoft.com
- assets.msn.com
Dropped files
- /opt/CAPEv2/storage/analyses/14313/files/71a0cee65361f91d3de198ea9c8ef63dfa01cd35a620dd9d2fb94a4bb9eb62d1 —
71a0cee65361f91d3de198ea9c8ef63dfa01cd35a620dd9d2fb94a4bb9eb62d1 - /opt/CAPEv2/storage/analyses/14313/files/ed832176fe816b83b974cd6f085323454e83c5c3acfdfc8748f7bd5d5d344e80 —
ed832176fe816b83b974cd6f085323454e83c5c3acfdfc8748f7bd5d5d344e80 - /opt/CAPEv2/storage/analyses/14313/files/dbd02dcccc0befa2261e2f3057e267633c9af3aa2fdef5dc89fa11940ccbddf2 —
dbd02dcccc0befa2261e2f3057e267633c9af3aa2fdef5dc89fa11940ccbddf2 - /opt/CAPEv2/storage/analyses/14313/files/cea0936e688fd8c22fdbfa2cc211c9fbbd5cd39a74c0a9efd4c171b968253596 —
cea0936e688fd8c22fdbfa2cc211c9fbbd5cd39a74c0a9efd4c171b968253596 - /opt/CAPEv2/storage/analyses/14313/files/ad7931476c58c7a6cc95fc5d0feec473a850e8844fef891a51f41dbfef2e730f —
ad7931476c58c7a6cc95fc5d0feec473a850e8844fef891a51f41dbfef2e730f - /opt/CAPEv2/storage/analyses/14313/files/b281660c717ab9cdc66d6cc097108a6f4f485eb300cab97bb9fb2a0ce3b29516 —
b281660c717ab9cdc66d6cc097108a6f4f485eb300cab97bb9fb2a0ce3b29516 - /opt/CAPEv2/storage/analyses/14313/files/2dedee0011aab1040b6c61181f76a11b23b0c8a33c42a6b1b11166c04cb435ca —
2dedee0011aab1040b6c61181f76a11b23b0c8a33c42a6b1b11166c04cb435ca - /opt/CAPEv2/storage/analyses/14313/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/14313/files/edc9f4547234c8ccaa0d65272742e3da59d8952c46ba732a5b3e57fe54f005e5 —
edc9f4547234c8ccaa0d65272742e3da59d8952c46ba732a5b3e57fe54f005e5 - /opt/CAPEv2/storage/analyses/14313/files/ad73e6ab17705e08629b2f3a71a838dfa4c2712433232bf7ec759682c9e284e6 —
ad73e6ab17705e08629b2f3a71a838dfa4c2712433232bf7ec759682c9e284e6 - /opt/CAPEv2/storage/analyses/14313/files/d0f4ea063a3fa7ddc0413a24fca60e4ea7256c30a4055db41ab2fb7deeda6b9d —
d0f4ea063a3fa7ddc0413a24fca60e4ea7256c30a4055db41ab2fb7deeda6b9d - /opt/CAPEv2/storage/analyses/14313/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/14313/files/a81a9c37c2875912c258626987e6ae259a4117e62c178ccbe1477f3e7ca17cb6 —
a81a9c37c2875912c258626987e6ae259a4117e62c178ccbe1477f3e7ca17cb6 - /opt/CAPEv2/storage/analyses/14313/files/3be2d173a522e9a0642df74b38eb2aeabd3c6d37b24733983bef3ea493d5cc1a —
3be2d173a522e9a0642df74b38eb2aeabd3c6d37b24733983bef3ea493d5cc1a - /opt/CAPEv2/storage/analyses/14313/files/252e0342e85de024ad5ddf7a538f9f3efa522c0bfb6fc57c81c4b59387430eed —
252e0342e85de024ad5ddf7a538f9f3efa522c0bfb6fc57c81c4b59387430eed
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786571499&P2=404&P3=2&P4=d%2bleHRpzPTwiTj1d6KHbP8yLAGKABrPcfkj88hJMQX%2bWRbJ5AYU4H0hCUy6R6eIGksJSKZUJGSOfXXWVYVSesQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786571526&P2=404&P3=2&P4=D%2ffuLcmytbDQO4M5qehgYal0ziEs73iHLIp%2b6P1EEEQYZOE%2f%2ft0frnerodvG581wFAON0e22UkNApCnkbQqvKA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 54.161.175.42
- 203.26.79.13
- 103.229.10.180
- 35.165.194.112
- 32.185.157.5
- 13.55.4.2
- 40.84.85.40
- 20.42.65.84
- 52.230.60.54
- 4.230.171.124
- 57.155.104.224
- 52.110.12.5
- 52.110.12.38
- 20.165.94.63
- 74.179.77.164
- 74.178.76.44
- 20.42.65.94
- 172.178.240.162
- 20.11.121.11
- 108.158.32.22
- 3.175.115.90
- 172.217.25.200
- 92.223.78.30
- 142.250.195.110
- 108.158.32.49
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report