MALICIOUS — a7089bdfa34871427afe9e895c705d8c6c9665b1e337da3270a3c31b70874399
MALICIOUS — a7089bdfa34871427afe9e895c705d8c6c9665b1e337da3270a3c31b70874399 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
a7089bdfa34871427afe9e895c705d8c6c9665b1e337da3270a3c31b70874399 - SHA-1:
afff10992ebd3a6c2a789f78b384dba8f2fa3fbc - MD5:
0162cd97d4cf52c9d5169e7908ed7713 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Dynamic analysis (windows)
6206 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- msedge.api.cdp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/14242/files/10602578e15e6f60b514f48025cddcc2bf8e359372364782a75497eb670b0d84 —
10602578e15e6f60b514f48025cddcc2bf8e359372364782a75497eb670b0d84 - /opt/CAPEv2/storage/analyses/14242/files/4b6b1582ae4594b770680480127ade1cc055c3460cb814209303664b4a4dae45 —
4b6b1582ae4594b770680480127ade1cc055c3460cb814209303664b4a4dae45 - /opt/CAPEv2/storage/analyses/14242/files/358966717b93728c0e6f34210a10d3e33d5ef7f9f88d9d52fd844d7b3b33d567 —
358966717b93728c0e6f34210a10d3e33d5ef7f9f88d9d52fd844d7b3b33d567 - /opt/CAPEv2/storage/analyses/14242/files/d77744bfcd00e8e9044071dbe43577cee029489639c1265fa9725f6ebdd7d720 —
d77744bfcd00e8e9044071dbe43577cee029489639c1265fa9725f6ebdd7d720 - /opt/CAPEv2/storage/analyses/14242/files/318f92d8b6a6304bcc43a7950acf38f454c93ea49071101b97e953bb03c24d4f —
318f92d8b6a6304bcc43a7950acf38f454c93ea49071101b97e953bb03c24d4f - /opt/CAPEv2/storage/analyses/14242/files/ad6ce6e472ab154e117fe5260cc2523e1801820ae8f56ea0963a6caaabebb063 —
ad6ce6e472ab154e117fe5260cc2523e1801820ae8f56ea0963a6caaabebb063 - /opt/CAPEv2/storage/analyses/14242/files/0de5a23723a54f56349c405c1e048998e304da814beea402f1456882a13a5efa —
0de5a23723a54f56349c405c1e048998e304da814beea402f1456882a13a5efa - /opt/CAPEv2/storage/analyses/14242/files/d69feeff364827af6c22473d71da02d43d36ed3645b6e4d852a233501ad7ee0c —
d69feeff364827af6c22473d71da02d43d36ed3645b6e4d852a233501ad7ee0c - /opt/CAPEv2/storage/analyses/14242/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/14242/files/7e00824b8fe68a805b5734875ff345fde80ffafe51e156adf11b2bc2c233b624 —
7e00824b8fe68a805b5734875ff345fde80ffafe51e156adf11b2bc2c233b624 - /opt/CAPEv2/storage/analyses/14242/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/14242/files/bed898ce662e38ab1d889d0d769f2e1199e56fe58f0c96354e009a3c2d803011 —
bed898ce662e38ab1d889d0d769f2e1199e56fe58f0c96354e009a3c2d803011 - /opt/CAPEv2/storage/analyses/14242/files/da8b2c96b3ae4ae56610174f10099b7d531c42975765d02ca7c8408127149a6c —
da8b2c96b3ae4ae56610174f10099b7d531c42975765d02ca7c8408127149a6c - /opt/CAPEv2/storage/analyses/14242/files/e7e34e75b3bf417bd3d7e75dee800c97793d50d04cd64bd312bae2e8a1e8f8ae —
e7e34e75b3bf417bd3d7e75dee800c97793d50d04cd64bd312bae2e8a1e8f8ae - /opt/CAPEv2/storage/analyses/14242/files/9221bcb52cdd52477fe1985cc55d7eb4861191a60bd2e77123fd397096a4380b —
9221bcb52cdd52477fe1985cc55d7eb4861191a60bd2e77123fd397096a4380b
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786569528&P2=404&P3=2&P4=efY6wokFEpNHud2NE3zphRmanrb%2b2z55CCTdMcSbJNQXmSNQ6RcjpDdkUGT8uFCXF2awW6sbgfyiFX9E5orMHA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786569571&P2=404&P3=2&P4=DYCiHHN7AjRlrWSFoHto20L4ltRjTUMulKO1GHNbB1uF%2fqMUBYaEG9if7C67zVxJBTwxctjqiVz5arZj3p7O2Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 4.150.223.104
- 20.247.184.197
- 40.84.85.40
- 4.230.171.124
- 74.178.240.61
- 135.232.92.97
- 20.42.65.89
- 74.179.71.159
- 52.123.252.248
- 203.26.79.13
- 135.233.45.223
- 52.110.12.53
- 92.223.78.30
- 52.110.12.4
- 184.84.165.171
- 72.153.5.60
- 52.148.114.188
- 52.110.12.19
- 52.110.12.28
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report