MALICIOUS — c7a591770426c05878c9296ee4c5b340fe542e1909968b9e38b6b3911016f240

MALICIOUS — c7a591770426c05878c9296ee4c5b340fe542e1909968b9e38b6b3911016f240 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c7a591770426c05878c9296ee4c5b340fe542e1909968b9e38b6b3911016f240
SHA-1: c3a8cc4e617e36a74aae0f01c66c07bc585438cd
MD5: 80910deca16975fb0b3cc158ed1ef73f
imphash: 3a2003ea545fe942681da9e7683ebb58
File type: pe · Size: 405668 bytes
Verdict: malicious (99/100) · Family: Mira

Detections (6 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
ClamAV (daily): Win.Malware.Mira-7407830-0
Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
Microsoft Defender: Worm:Win32/Mira!pz
Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Dynamic analysis (windows)

6189 behavior events · 1 ATT&CK techniques · 34 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/13800/files/6c695e55c877a308115958e04cf9a24710d74b911a445e7a66d9189556ceecc8 — 6c695e55c877a308115958e04cf9a24710d74b911a445e7a66d9189556ceecc8
/opt/CAPEv2/storage/analyses/13800/files/cbede3dd42cf457aee19ed6604d0d65de26023355ecd33e5f94817482ee7a40b — cbede3dd42cf457aee19ed6604d0d65de26023355ecd33e5f94817482ee7a40b
/opt/CAPEv2/storage/analyses/13800/files/abf9a225ddc545fe21315dc381c8989f7e5141063e2d9ffcf5ed3eca4dfa223a — abf9a225ddc545fe21315dc381c8989f7e5141063e2d9ffcf5ed3eca4dfa223a
/opt/CAPEv2/storage/analyses/13800/files/5b2067500f34cbecc378e4a0d7c91475331e13bcba5ed84338aaad8278d9ee1e — 5b2067500f34cbecc378e4a0d7c91475331e13bcba5ed84338aaad8278d9ee1e
/opt/CAPEv2/storage/analyses/13800/files/d42c14be5183b26334d1b30de8796d3991066ca94e0582a4c6c22aa79d35efcb — d42c14be5183b26334d1b30de8796d3991066ca94e0582a4c6c22aa79d35efcb
/opt/CAPEv2/storage/analyses/13800/files/c58146cb33d90ab309f0b9346a522942ce17a2b678f09c4907f658e0a0d378cc — c58146cb33d90ab309f0b9346a522942ce17a2b678f09c4907f658e0a0d378cc
/opt/CAPEv2/storage/analyses/13800/files/491bff3fb92242a3d39a167038b2af2d449e4524ed484a723a6036f9b0702e38 — 491bff3fb92242a3d39a167038b2af2d449e4524ed484a723a6036f9b0702e38
/opt/CAPEv2/storage/analyses/13800/files/65b27a49b671554d4404b59ca464b6aefdfefc94a9d2a7148e1ab48862a168d2 — 65b27a49b671554d4404b59ca464b6aefdfefc94a9d2a7148e1ab48862a168d2
/opt/CAPEv2/storage/analyses/13800/files/5c881c09e4f5f24cd7b77fd8200a31fac6716a9c8e5f3cbc9696284cc1681e92 — 5c881c09e4f5f24cd7b77fd8200a31fac6716a9c8e5f3cbc9696284cc1681e92
/opt/CAPEv2/storage/analyses/13800/files/d89b465245eb66fedf744c3ecc1d5126ecf2bb295702cbbb994f2c0e5d7ae8d3 — d89b465245eb66fedf744c3ecc1d5126ecf2bb295702cbbb994f2c0e5d7ae8d3
/opt/CAPEv2/storage/analyses/13800/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 — f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25
/opt/CAPEv2/storage/analyses/13800/files/660e5bee360419ce31764d2f04adbb97e59b3c210528d2e2f50f23f7c7348ede — 660e5bee360419ce31764d2f04adbb97e59b3c210528d2e2f50f23f7c7348ede
/opt/CAPEv2/storage/analyses/13800/files/4dab092475016fec996d02e4de95dc4b1bca30994e5e0b3a6ff764cc0fafe40f — 4dab092475016fec996d02e4de95dc4b1bca30994e5e0b3a6ff764cc0fafe40f
/opt/CAPEv2/storage/analyses/13800/files/292f584825c0d37bd971aa5104ac99b6e4986314752e64d3e786a645fc4218d1 — 292f584825c0d37bd971aa5104ac99b6e4986314752e64d3e786a645fc4218d1
/opt/CAPEv2/storage/analyses/13800/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a — ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786557501&P2=404&P3=2&P4=TPWvkAWpM5fgAIu9tfZWH9manvJrhr0XuwPZ3YxEGDmzOOB%2brgyH3dPOfakEbx8qN9IDdyYKxICDmAXSa8FB9A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786557622&P2=404&P3=2&P4=B57WnctBePksAWUys88OX1nJscESFZX7eR3uxQkx%2bIgulKL8WHPy44eP%2bjcVsmSf0V%2fS4q7Z%2b%2bg%2bpDcYWzHi9g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

13.89.179.15
4.230.171.124
40.84.97.4
4.144.132.114
85.210.196.11
20.165.94.63
4.207.44.75
52.110.12.20
52.110.12.25
74.179.77.164
20.42.65.93
172.215.188.225
135.233.45.223
20.184.175.9
203.26.79.13
20.192.184.192
92.223.78.30
52.123.252.218
135.232.92.34
72.154.7.102
52.123.252.233
52.110.12.53
52.148.114.188
52.110.12.32

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report