MALICIOUS — d053b34994ddaebbc5fc5dceb0806d0ffbb10681eb8e28e39c1d2252304d41a5
MALICIOUS — d053b34994ddaebbc5fc5dceb0806d0ffbb10681eb8e28e39c1d2252304d41a5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
d053b34994ddaebbc5fc5dceb0806d0ffbb10681eb8e28e39c1d2252304d41a5 - SHA-1:
ac890b209f93403edf45dee5b0c74114e6cab42f - MD5:
31b317d9d731bd61881e6f3a0bad0028 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Dynamic analysis (windows)
6209 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- licensing.mp.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/14341/files/2d071d3f4d750bd267c0cd3d1bb7d8ad2d7834c69cf025e943ab13f1cbd18636 —
2d071d3f4d750bd267c0cd3d1bb7d8ad2d7834c69cf025e943ab13f1cbd18636 - /opt/CAPEv2/storage/analyses/14341/files/051702f0a5d8e63f2cfea65c3c3ad3ae72f6d55e95c4e515a29994671d7d0f02 —
051702f0a5d8e63f2cfea65c3c3ad3ae72f6d55e95c4e515a29994671d7d0f02 - /opt/CAPEv2/storage/analyses/14341/files/02b668542d872e92e859d28f3e183033c440c09cb54d6c7435226b9448cbeadd —
02b668542d872e92e859d28f3e183033c440c09cb54d6c7435226b9448cbeadd - /opt/CAPEv2/storage/analyses/14341/files/60cd87ab553c4c2bacf45502af63826ae7b46c13cf4b8cad3868bfa05be1122a —
60cd87ab553c4c2bacf45502af63826ae7b46c13cf4b8cad3868bfa05be1122a - /opt/CAPEv2/storage/analyses/14341/files/ec19fadc00140dd68276aaf940540d9b5be54cb6d60fd979f2ac56c7c0b147f5 —
ec19fadc00140dd68276aaf940540d9b5be54cb6d60fd979f2ac56c7c0b147f5 - /opt/CAPEv2/storage/analyses/14341/files/f433eacc522cdd00efe558988775bd9d8f62980abd9898b3d84c14c7b6b838a5 —
f433eacc522cdd00efe558988775bd9d8f62980abd9898b3d84c14c7b6b838a5 - /opt/CAPEv2/storage/analyses/14341/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/14341/files/f1662613766f0a0a53cfd0dc9173b0a8754ab7bc69ea36cba23db6eb80a67211 —
f1662613766f0a0a53cfd0dc9173b0a8754ab7bc69ea36cba23db6eb80a67211 - /opt/CAPEv2/storage/analyses/14341/files/a90c8003b6f5edd45511057644686282cb868fd69b013308d91159f40f70331b —
a90c8003b6f5edd45511057644686282cb868fd69b013308d91159f40f70331b - /opt/CAPEv2/storage/analyses/14341/files/012773caed73c6360f32b58bdc8722a4b9ad8229040bc96112ca8f5ebb1c1a61 —
012773caed73c6360f32b58bdc8722a4b9ad8229040bc96112ca8f5ebb1c1a61 - /opt/CAPEv2/storage/analyses/14341/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/14341/files/4a3826b17bf95b8d17d968c67e908e2c95ca55638a20f35a73c6ed268a9864fb —
4a3826b17bf95b8d17d968c67e908e2c95ca55638a20f35a73c6ed268a9864fb - /opt/CAPEv2/storage/analyses/14341/files/f23d00851c60d78af603d0de0945a02d5df382fe9eb259d0aed8a27f3f30e053 —
f23d00851c60d78af603d0de0945a02d5df382fe9eb259d0aed8a27f3f30e053 - /opt/CAPEv2/storage/analyses/14341/files/56310222b9df373219aac53f517a88038c4cca3f265ab49357ad89e847973bf9 —
56310222b9df373219aac53f517a88038c4cca3f265ab49357ad89e847973bf9 - /opt/CAPEv2/storage/analyses/14341/files/b2b8d3a2797eb0e1ca879f3a779d6b3be0e02e7ff690774069381de450696e50 —
b2b8d3a2797eb0e1ca879f3a779d6b3be0e02e7ff690774069381de450696e50
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786572359&P2=404&P3=2&P4=MCvwKADbE7ujYyJXF1%2bnSCeUqqeVMeECbYuKW7JKERpnzVEMSBl2gzvGOyMTDM8gebz2ZOc%2bpv%2bMybEw7jJ%2f5g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786572378&P2=404&P3=2&P4=MVCq5fOJiM%2fnfIAnj0sU8to%2fg4QfHnpYcv29xD%2bjuDyYOSQEhVDchbkYs8N3jhKqw08oqsqPwAtf5yGSiAv79A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 20.42.73.28
- 4.144.132.223
- 20.42.179.192
- 4.230.171.124
- 85.210.193.152
- 74.178.240.61
- 74.179.77.164
- 74.179.77.204
- 20.52.64.200
- 172.178.240.161
- 203.26.79.13
- 74.179.71.159
- 172.66.2.5
- 72.154.7.97
- 52.148.114.188
- 52.110.12.49
- 52.110.12.10
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report