MALICIOUS — a4ad97af2679c28181efc3ccccdc205f63391bbd387897b25435b88a9dd6a26b
MALICIOUS — a4ad97af2679c28181efc3ccccdc205f63391bbd387897b25435b88a9dd6a26b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
a4ad97af2679c28181efc3ccccdc205f63391bbd387897b25435b88a9dd6a26b - SHA-1:
ceaac418bbabd1ba33a36f4c146524be3e016393 - MD5:
fa2f0d4b0f7c9d025b5840dbceb7dbfa - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Dynamic analysis (windows)
6216 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- msedge.api.cdp.microsoft.com
- assets.msn.com
- licensing.mp.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/14454/files/ac3eeaeaef7816d872a67f26e65bc714b0423d6e299690bceaef30f0c868aa1e —
ac3eeaeaef7816d872a67f26e65bc714b0423d6e299690bceaef30f0c868aa1e - /opt/CAPEv2/storage/analyses/14454/files/902dd115f46a949dba941596457201ce35996cd634c1e0d195c779ee30d5821b —
902dd115f46a949dba941596457201ce35996cd634c1e0d195c779ee30d5821b - /opt/CAPEv2/storage/analyses/14454/files/2b44a5e10949e6e6a92514ebaba2ace1e96393d6c993d731ea31bfe0593c824a —
2b44a5e10949e6e6a92514ebaba2ace1e96393d6c993d731ea31bfe0593c824a - /opt/CAPEv2/storage/analyses/14454/files/17bf03ef69ea4a2eecd994fd8c7e8fc3252b843f87968ce87539554782fee5e6 —
17bf03ef69ea4a2eecd994fd8c7e8fc3252b843f87968ce87539554782fee5e6 - /opt/CAPEv2/storage/analyses/14454/files/ee244398213aaa2383c841644dc7200b90236ee1eb071a9e5d9b8b7b1df2003f —
ee244398213aaa2383c841644dc7200b90236ee1eb071a9e5d9b8b7b1df2003f - /opt/CAPEv2/storage/analyses/14454/files/148342b5f39566f4076c49ec000e20ef989c2a5beb300da072c6ff781d9f31cc —
148342b5f39566f4076c49ec000e20ef989c2a5beb300da072c6ff781d9f31cc - /opt/CAPEv2/storage/analyses/14454/files/3ef4957c4245d992c01c2c60ff60219ba43ed4d0d62c3b288b64ffbf035d083d —
3ef4957c4245d992c01c2c60ff60219ba43ed4d0d62c3b288b64ffbf035d083d - /opt/CAPEv2/storage/analyses/14454/files/5083806b2f3653b42c6414ac99b7ca2a21187595b122c9d5b2cac211945f97a4 —
5083806b2f3653b42c6414ac99b7ca2a21187595b122c9d5b2cac211945f97a4 - /opt/CAPEv2/storage/analyses/14454/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/14454/files/7e8cd6d76557170e1a16c1416dd854a6a8a61d77dd1fb8d784f3bbd9d04b7d86 —
7e8cd6d76557170e1a16c1416dd854a6a8a61d77dd1fb8d784f3bbd9d04b7d86 - /opt/CAPEv2/storage/analyses/14454/files/2f1510d7f3a4d6c1081f1a3bf8c959bdc3e7c3db8886d936d7b1d21e8f13095b —
2f1510d7f3a4d6c1081f1a3bf8c959bdc3e7c3db8886d936d7b1d21e8f13095b - /opt/CAPEv2/storage/analyses/14454/files/e0146c8a84ce6456d7680985ab1a3c6c5f2937e70b28652030206484fd7bbdf4 —
e0146c8a84ce6456d7680985ab1a3c6c5f2937e70b28652030206484fd7bbdf4 - /opt/CAPEv2/storage/analyses/14454/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/14454/files/e77b9877ea315e809342051d92afa0427b1231c757f2828203fb662dfc530676 —
e77b9877ea315e809342051d92afa0427b1231c757f2828203fb662dfc530676 - /opt/CAPEv2/storage/analyses/14454/files/d795dc4dbba8283e75d983e0ff5301ab8cfe24e286bb83fc05b5b09570392ff1 —
d795dc4dbba8283e75d983e0ff5301ab8cfe24e286bb83fc05b5b09570392ff1
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786575657&P2=404&P3=2&P4=Qen2kNcGGSvd0HcCm6isDen185riJ%2fAoI5aRuPJXSyheefHEbKN8RJqOQSJyPCMaR72B3SLGw7002jzDL3v5VQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786575711&P2=404&P3=2&P4=T0vfFwmD8MbIbKHkWtjesyTUF8DAOzd1etAumtwYIQzsxlajrea7wdXQmImx8v5uQ1GmlAGeSlUxHpHTxcGVpA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 74.179.71.159
- 4.150.223.106
- 52.123.252.234
- 4.230.171.124
- 172.215.188.225
- 52.253.84.76
- 74.179.77.204
- 20.165.94.54
- 4.207.44.70
- 203.26.79.13
- 135.234.160.245
- 52.110.12.26
- 52.110.12.21
- 184.84.165.136
- 72.145.35.101
- 40.79.141.152
- 74.178.232.29
- 52.148.114.188
- 52.110.12.51
- 52.110.12.20
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report