MALICIOUS — a221c8e3baaa06603416cfc0565eb23de0bd678cbeb18c1cba22fbe304635f41
MALICIOUS — a221c8e3baaa06603416cfc0565eb23de0bd678cbeb18c1cba22fbe304635f41 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
a221c8e3baaa06603416cfc0565eb23de0bd678cbeb18c1cba22fbe304635f41 - SHA-1:
ada01292f745a81b0f68f9f13c81836d767dc3f2 - MD5:
91afadef2b0706d4fa3d1d3d67286d0a - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
MITRE ATT&CK
Dynamic analysis (windows)
6371 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
- v10.events.data.microsoft.com
- watson.events.data.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13755/files/021556cf515a81ea43efe0fdc289d33bd930e7375ae59da2b1eced8f8d2776f9 —
021556cf515a81ea43efe0fdc289d33bd930e7375ae59da2b1eced8f8d2776f9 - /opt/CAPEv2/storage/analyses/13755/files/8f70281a8dd92fcf7eec24221d52b4368f5d22c3916457b44366a0bb4f006cf4 —
8f70281a8dd92fcf7eec24221d52b4368f5d22c3916457b44366a0bb4f006cf4 - /opt/CAPEv2/storage/analyses/13755/files/734e5c7560a1d819af410369bcedcbd2cb1b008921a80a7f56d76daaa69ebb04 —
734e5c7560a1d819af410369bcedcbd2cb1b008921a80a7f56d76daaa69ebb04 - /opt/CAPEv2/storage/analyses/13755/files/8284fc4f2cac09c5d270d38f1d4457c7ef94e8ce9ffff4d1d22721293a0f2f14 —
8284fc4f2cac09c5d270d38f1d4457c7ef94e8ce9ffff4d1d22721293a0f2f14 - /opt/CAPEv2/storage/analyses/13755/files/9cdfe11012aee7d81f53a8fde6a0dc7189e57e99b56c13a569afd99d7013191e —
9cdfe11012aee7d81f53a8fde6a0dc7189e57e99b56c13a569afd99d7013191e - /opt/CAPEv2/storage/analyses/13755/files/61ecd70314dd382a130b7e5a14c6810bec72e5040cc3d616dfbd1489a4b3ad8d —
61ecd70314dd382a130b7e5a14c6810bec72e5040cc3d616dfbd1489a4b3ad8d - /opt/CAPEv2/storage/analyses/13755/files/de2accf396776370170ad2f261cadbccf54ab0217d663f20a19d0e446c7a7e2d —
de2accf396776370170ad2f261cadbccf54ab0217d663f20a19d0e446c7a7e2d - /opt/CAPEv2/storage/analyses/13755/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/13755/files/9e9e8698e794ed279ac05fb9e252ec057540d5264d3a5e0148b8346c6b1b1d18 —
9e9e8698e794ed279ac05fb9e252ec057540d5264d3a5e0148b8346c6b1b1d18 - /opt/CAPEv2/storage/analyses/13755/files/f7c13962be3bb62515892b0ca0da0d8514be51b66638dc2b2c63326d829fad35 —
f7c13962be3bb62515892b0ca0da0d8514be51b66638dc2b2c63326d829fad35 - /opt/CAPEv2/storage/analyses/13755/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/13755/files/182930a79118e9c6857386f835f572430d9f7fc825bba14aaed1f7a51d29c5b7 —
182930a79118e9c6857386f835f572430d9f7fc825bba14aaed1f7a51d29c5b7 - /opt/CAPEv2/storage/analyses/13755/files/f0ed81483ce1e5bef000ff18a5845f0f7c3d9b059e10dc31d8a0748602eea9af —
f0ed81483ce1e5bef000ff18a5845f0f7c3d9b059e10dc31d8a0748602eea9af - /opt/CAPEv2/storage/analyses/13755/files/4e9a786fecd64867b285f3dc8e8d644f95c8915aa4e01f63eef968f6a31de89c —
4e9a786fecd64867b285f3dc8e8d644f95c8915aa4e01f63eef968f6a31de89c - /opt/CAPEv2/storage/analyses/13755/files/a42e57db93b93ecb2224fdb1276f4ebb0b6705cc4a95ec1899772df8dc47a684 —
a42e57db93b93ecb2224fdb1276f4ebb0b6705cc4a95ec1899772df8dc47a684
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786556488&P2=404&P3=2&P4=F5RSbCq6tvFFz8q2vvs1mMj9iAdRmon0RFbZlgEprY31hZivehITBYNaH0jsdJKfou1KqUQN8DUfCiAOVSFqbA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 13.89.179.12
- 57.154.63.210
- 52.253.84.76
- 4.230.171.124
- 74.179.77.204
- 13.69.109.130
- 172.178.240.163
- 74.178.240.51
- 203.26.79.13
- 20.50.201.195
- 52.110.12.31
- 52.110.12.56
- 4.207.44.73
- 52.123.252.222
- 20.165.94.46
- 52.148.114.188
- 72.154.7.106
- 52.110.12.30
- 52.110.12.16
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report