MALICIOUS — f748a4d4481e56f03609d667ab5792201d349e1957f4f83465cbd5a2f34e76a6
MALICIOUS — f748a4d4481e56f03609d667ab5792201d349e1957f4f83465cbd5a2f34e76a6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
f748a4d4481e56f03609d667ab5792201d349e1957f4f83465cbd5a2f34e76a6 - SHA-1:
955ae2c4c4a64557c1078989296cbfa79851cbcc - MD5:
a591ce3da8408ad2162ca2b11888bb13 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (99/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
MITRE ATT&CK
Dynamic analysis (windows)
6351 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- tas02.sls.update.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/14243/files/b6175e8d07734eb404ac837be9738d06ac978b71ccabfb7d5e6b89c50e278471 —
b6175e8d07734eb404ac837be9738d06ac978b71ccabfb7d5e6b89c50e278471 - /opt/CAPEv2/storage/analyses/14243/files/d7ad3f067288accacfce376e657585a7d6cca9c5ec2a6abfaeef7f3dc71dfc66 —
d7ad3f067288accacfce376e657585a7d6cca9c5ec2a6abfaeef7f3dc71dfc66 - /opt/CAPEv2/storage/analyses/14243/files/cc123fd86121c9c17e310aba6b8892652a00aeb6eb2671a4b0e7713ae3646009 —
cc123fd86121c9c17e310aba6b8892652a00aeb6eb2671a4b0e7713ae3646009 - /opt/CAPEv2/storage/analyses/14243/files/03eca284f98c7d44bfbbe97b9e9dc7fbe94157fdf4e076a7ee0ba7cea8eca6aa —
03eca284f98c7d44bfbbe97b9e9dc7fbe94157fdf4e076a7ee0ba7cea8eca6aa - /opt/CAPEv2/storage/analyses/14243/files/0d339a94f8d99c45ccc431f5789e9a5b45517e002ababc47be899e68d45d9e68 —
0d339a94f8d99c45ccc431f5789e9a5b45517e002ababc47be899e68d45d9e68 - /opt/CAPEv2/storage/analyses/14243/files/cda921c128615f0fc26fdcfd144f4e14422209114e1b18ddf93d1ffe81b6e243 —
cda921c128615f0fc26fdcfd144f4e14422209114e1b18ddf93d1ffe81b6e243 - /opt/CAPEv2/storage/analyses/14243/files/c13818ee018e93834c58a9d1b6644a4d13ea39f0e365474511bd2e3f628dbf99 —
c13818ee018e93834c58a9d1b6644a4d13ea39f0e365474511bd2e3f628dbf99 - /opt/CAPEv2/storage/analyses/14243/files/3fb8112a0386d8e85f08a73105392f5cd1c35b174fd9ab005876e7d08fdf9d6a —
3fb8112a0386d8e85f08a73105392f5cd1c35b174fd9ab005876e7d08fdf9d6a - /opt/CAPEv2/storage/analyses/14243/files/d2f6098e70d4b88ec54a7a6faed4a6ab8201d7b665f4ac3b18ca1b6e03ea2e6e —
d2f6098e70d4b88ec54a7a6faed4a6ab8201d7b665f4ac3b18ca1b6e03ea2e6e - /opt/CAPEv2/storage/analyses/14243/files/aaec1529512a8ef01065f2ac0c90fb008bcb53d53aee45c08cc6da34742a5d9d —
aaec1529512a8ef01065f2ac0c90fb008bcb53d53aee45c08cc6da34742a5d9d - /opt/CAPEv2/storage/analyses/14243/files/ccb83da76d230619ed930d62ef8f118783488ec922b5cdce2a9b868924dee128 —
ccb83da76d230619ed930d62ef8f118783488ec922b5cdce2a9b868924dee128 - /opt/CAPEv2/storage/analyses/14243/files/65ba80130cf49eeca69d10d0c9d10dd367a935cbff9491415e88a5c4a575bce4 —
65ba80130cf49eeca69d10d0c9d10dd367a935cbff9491415e88a5c4a575bce4 - /opt/CAPEv2/storage/analyses/14243/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/14243/files/c596d5f74774f00130df31dd86d7a6362f03a203b39fa0be9ebc182d6e782653 —
c596d5f74774f00130df31dd86d7a6362f03a203b39fa0be9ebc182d6e782653 - /opt/CAPEv2/storage/analyses/14243/files/4d03a99d37d667d96432c22a891bef32e349323d6963a4698b747599944d69ce —
4d03a99d37d667d96432c22a891bef32e349323d6963a4698b747599944d69ce
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786569599&P2=404&P3=2&P4=GEO88VGZVw2BeA6BDwd7VVOpXnICaqKnL30syOh3DuCB%2fQVAusrQcYXfOAfyIq9Dlcn7gsocialLZrTCJgUCBw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786569679&P2=404&P3=2&P4=V9CnPOXn9f4E8iD9KNB66SCH%2fzK6j2DC7Oa%2bsdBW5c3vRA6fk8I7PHLvyC%2bbPAyRQkfYaA2vGZ7EVPes78Ex7g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 4.150.223.110
- 52.123.252.220
- 20.247.184.142
- 4.247.188.233
- 4.230.171.124
- 74.178.76.128
- 20.184.175.7
- 135.232.92.97
- 20.165.94.63
- 51.105.71.136
- 172.178.240.161
- 203.26.79.13
- 52.123.252.247
- 20.165.94.46
- 184.84.165.171
- 72.145.35.104
- 52.148.114.188
- 74.178.76.44
- 52.110.12.56
- 52.110.12.24
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report