MALICIOUS — c8136fb29ddf0a3a70a40094cc1970757ea8adafd5e9081681ce9ce11bbb2e3d
MALICIOUS — c8136fb29ddf0a3a70a40094cc1970757ea8adafd5e9081681ce9ce11bbb2e3d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
c8136fb29ddf0a3a70a40094cc1970757ea8adafd5e9081681ce9ce11bbb2e3d - SHA-1:
0ee8dc92ed525291eadf5933b76debf16a509c2d - MD5:
0f67533ed65e583b177eae7b442e65a0 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (100/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
MITRE ATT&CK
Dynamic analysis (windows)
6201 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- licensing.mp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- geo.prod.do.dsp.mp.microsoft.com
- settings-win.data.microsoft.com
- kv801.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/13880/files/3c4d76ea8fa3a311f016bb87ea91fc550165f42e600c52e84ed24a22c31b8f4d —
3c4d76ea8fa3a311f016bb87ea91fc550165f42e600c52e84ed24a22c31b8f4d - /opt/CAPEv2/storage/analyses/13880/files/bfff0230501a3d88a745b66569fc50dd323798011557642e8d5f10bc37a5fcce —
bfff0230501a3d88a745b66569fc50dd323798011557642e8d5f10bc37a5fcce - /opt/CAPEv2/storage/analyses/13880/files/076442c642a355efb91e48ff5a00572ac7e7146ea50978f3b8f73152d0f2ffb2 —
076442c642a355efb91e48ff5a00572ac7e7146ea50978f3b8f73152d0f2ffb2 - /opt/CAPEv2/storage/analyses/13880/files/9d71091c568311a7ad95bc0d641862a0dfd4b2447d493ad0dea68512e7c78c5a —
9d71091c568311a7ad95bc0d641862a0dfd4b2447d493ad0dea68512e7c78c5a - /opt/CAPEv2/storage/analyses/13880/files/4f8d892ab9c71c40162d9cd9df0507d6ecfdb12e43f4e7064a3c3c781cf16cc6 —
4f8d892ab9c71c40162d9cd9df0507d6ecfdb12e43f4e7064a3c3c781cf16cc6 - /opt/CAPEv2/storage/analyses/13880/files/9ab801cfd8357adfe523c553d68690b78df7c6bf6e87446e5c50ca5314772ff5 —
9ab801cfd8357adfe523c553d68690b78df7c6bf6e87446e5c50ca5314772ff5 - /opt/CAPEv2/storage/analyses/13880/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/13880/files/71ba8f119d98ca74ccd0ebf4b9bc149b3946e1915a310f0b45cc92b98fc0e544 —
71ba8f119d98ca74ccd0ebf4b9bc149b3946e1915a310f0b45cc92b98fc0e544 - /opt/CAPEv2/storage/analyses/13880/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/13880/files/aba20c518f0aa35938457b016521eb0371f9a6bb00d3258e368b5066c9e1703f —
aba20c518f0aa35938457b016521eb0371f9a6bb00d3258e368b5066c9e1703f - /opt/CAPEv2/storage/analyses/13880/files/e00cfc2eeabea484226ef5d1b5233ddee44d9d006f75ddff998c66e228b15ead —
e00cfc2eeabea484226ef5d1b5233ddee44d9d006f75ddff998c66e228b15ead - /opt/CAPEv2/storage/analyses/13880/files/7d132d7c259851d11d22d3714e84dffc9122e80333349d27d63cf713183ec3f6 —
7d132d7c259851d11d22d3714e84dffc9122e80333349d27d63cf713183ec3f6 - /opt/CAPEv2/storage/analyses/13880/files/66fdaeb5c6dbad64ade5eb3ee794a4a59c4da85a55dc90b3371164c02371a62a —
66fdaeb5c6dbad64ade5eb3ee794a4a59c4da85a55dc90b3371164c02371a62a - /opt/CAPEv2/storage/analyses/13880/files/afdfd6243aa9d97bc35eead7d7b7cefd896cf317fb7c63635cee1cd46297f64c —
afdfd6243aa9d97bc35eead7d7b7cefd896cf317fb7c63635cee1cd46297f64c - /opt/CAPEv2/storage/analyses/13880/files/e8752e406b1299b6f3dd65fc621a25df0918202c229a8f988329bf24b71261e2 —
e8752e406b1299b6f3dd65fc621a25df0918202c229a8f988329bf24b71261e2
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786559676&P2=404&P3=2&P4=Hovi7sckLNbeSJ%2bYTzXzAUNDvHfqwlE%2fK936kNtY1NUD9aTLQbvjwqQJGHECWecjSM1R1aoawx%2bE%2ft1RlJ1qHQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786559698&P2=404&P3=2&P4=P2s8UJXVFwFs8Q5mDNeKsHey8yjCHQ0m6bPAMYeA7KTGNXoeo29P%2fT4xtmEj8Md9zzUu%2fg5vMI12jcJIq2zi3w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- va.ua
Embedded IP addresses
- 74.178.232.29
- 4.150.223.106
- 52.123.252.203
- 4.144.132.114
- 4.230.171.124
- 40.84.97.4
- 20.165.94.46
- 20.165.94.63
- 135.232.92.97
- 4.150.223.105
- 203.26.79.13
- 172.178.240.161
- 92.223.78.30
- 162.159.142.9
- 72.153.5.137
- 52.110.12.45
- 52.110.12.37
- 52.148.114.188
- 52.110.12.11
- 52.110.12.38
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report