MALICIOUS — b8aa7b797c5e272113c775f3bd7f55c6e9b3f073f20b996fbe66cbef56dfff91
MALICIOUS — b8aa7b797c5e272113c775f3bd7f55c6e9b3f073f20b996fbe66cbef56dfff91 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
b8aa7b797c5e272113c775f3bd7f55c6e9b3f073f20b996fbe66cbef56dfff91 - SHA-1:
d71a8c95509ceb0a6b211fae4602a071b427c262 - MD5:
fdfdf7d0dbd3b997aa6504976ddbf2f7 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
MITRE ATT&CK
Dynamic analysis (windows)
6332 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/14345/files/477dd620cc1211e07fc3bc019a1d0b5212ead9b21d56560e421785362a9f900d —
477dd620cc1211e07fc3bc019a1d0b5212ead9b21d56560e421785362a9f900d - /opt/CAPEv2/storage/analyses/14345/files/abf884d2d3bc42008cf7f135dab925ab6574dc6e644b32f056f21f31ea689387 —
abf884d2d3bc42008cf7f135dab925ab6574dc6e644b32f056f21f31ea689387 - /opt/CAPEv2/storage/analyses/14345/files/1bba92f0c78f5b4f63d16ebb3406b46010807c17707c980f2db8974fc4dad9e9 —
1bba92f0c78f5b4f63d16ebb3406b46010807c17707c980f2db8974fc4dad9e9 - /opt/CAPEv2/storage/analyses/14345/files/18987573a0dc58a146060d42d50b482f126f3bcafad565e4d905d682c84e633e —
18987573a0dc58a146060d42d50b482f126f3bcafad565e4d905d682c84e633e - /opt/CAPEv2/storage/analyses/14345/files/306f6f7570f7b2f8800b53de6414590558cbbf37014cbdf7b3eeb106edab25ec —
306f6f7570f7b2f8800b53de6414590558cbbf37014cbdf7b3eeb106edab25ec - /opt/CAPEv2/storage/analyses/14345/files/3ec540d3e5a3a6d4abffe5bf0f6e8836e76f1f2e87db747a499b056833f883c2 —
3ec540d3e5a3a6d4abffe5bf0f6e8836e76f1f2e87db747a499b056833f883c2 - /opt/CAPEv2/storage/analyses/14345/files/35f0a59dd16fd08a8e7d1c54029d0e31941a1a886ba35fc265598fe9eadf29fb —
35f0a59dd16fd08a8e7d1c54029d0e31941a1a886ba35fc265598fe9eadf29fb - /opt/CAPEv2/storage/analyses/14345/files/2906f739ecafea2c41fe9227c151e4493c34a57f6eac13720f5dda70ef39ae90 —
2906f739ecafea2c41fe9227c151e4493c34a57f6eac13720f5dda70ef39ae90 - /opt/CAPEv2/storage/analyses/14345/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/14345/files/a61d72b4380fc670c5e031dc7a813fcd22a7cfafffdd6a63da024f15c47bfc5a —
a61d72b4380fc670c5e031dc7a813fcd22a7cfafffdd6a63da024f15c47bfc5a - /opt/CAPEv2/storage/analyses/14345/files/882cdb70d697e5206c2a09ee1d8501ec6ba2968090faabceae29d8b1ecfbd255 —
882cdb70d697e5206c2a09ee1d8501ec6ba2968090faabceae29d8b1ecfbd255 - /opt/CAPEv2/storage/analyses/14345/files/f1af690a6fdd9ce32707a686dc16f1c688761b051ac99b079dee112be807dd2f —
f1af690a6fdd9ce32707a686dc16f1c688761b051ac99b079dee112be807dd2f - /opt/CAPEv2/storage/analyses/14345/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/14345/files/047666cc0ad57eb244065a44ce02eae61fe8c06fcc1aba615d56400f312971a7 —
047666cc0ad57eb244065a44ce02eae61fe8c06fcc1aba615d56400f312971a7 - /opt/CAPEv2/storage/analyses/14345/files/d2e0e7296d890b5746cc7b3c593dd31510285724f9114c7daed92d7cfc592d3e —
d2e0e7296d890b5746cc7b3c593dd31510285724f9114c7daed92d7cfc592d3e
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786572412&P2=404&P3=2&P4=lTsTo1EQAGnpqhR55FkHvZtvsdNihSL8k96WtuiN0I3wfg%2fQBRGAz9tKVziFRNHKsRUXc3TeImu1qSRxGz9YkA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786572460&P2=404&P3=2&P4=cN5qJK6JzglhzGVAmqsTt%2fhKYeoPWMCDor3Dyi0V7CmVJU2rX5GWbNDQ9AvvxnraeCB9wfJ3lN3jPG%2b2%2bnt9yg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- y.ly
Embedded IP addresses
- 20.184.175.17
- 40.84.97.4
- 4.230.171.124
- 4.144.132.223
- 203.26.79.13
- 74.179.77.204
- 74.179.77.164
- 20.42.65.84
- 172.178.240.162
- 135.232.92.34
- 20.89.1.12
- 20.50.201.206
- 20.42.179.204
- 52.110.12.32
- 184.84.165.171
- 184.84.165.136
- 52.110.12.20
- 72.154.7.97
- 52.148.114.188
- 52.110.12.30
- 52.110.12.3
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report