MALICIOUS — f942ce08a68be231c7ca417ef990e785f20b930fb21605949ab83f8d856e9596
MALICIOUS — f942ce08a68be231c7ca417ef990e785f20b930fb21605949ab83f8d856e9596 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mira family. 6 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
f942ce08a68be231c7ca417ef990e785f20b930fb21605949ab83f8d856e9596 - SHA-1:
1df348d19a5d86acdbafbc1b6f2e2aefc6354edb - MD5:
d00383abd8f30de13295f8579457aea5 - imphash:
3a2003ea545fe942681da9e7683ebb58 - File type: pe · Size: 405668 bytes
- Verdict: malicious (100/100) · Family: Mira
Detections (6 of 52 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
- ClamAV (daily): Win.Malware.Mira-7407830-0
- Detect It Easy (packer/type): DIE:VMProtect 2.0.3-2.13
- Microsoft Defender: Worm:Win32/Mira!pz
- Emsisoft (Emergency Kit): Gen:Heur.Minggy.1
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Dynamic analysis (windows)
6348 behavior events · 1 ATT&CK techniques · 34 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- msedge.api.cdp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- assets.msn.com
- licensing.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/14127/files/6b91dd09683d6c2659a1329d6d7f54cdea907c7ca809d01831b46c96f83d4485 —
6b91dd09683d6c2659a1329d6d7f54cdea907c7ca809d01831b46c96f83d4485 - /opt/CAPEv2/storage/analyses/14127/files/bd18dfd41f85707600b05b871bc171a6233935bda46c57c0be45d78c75c46f64 —
bd18dfd41f85707600b05b871bc171a6233935bda46c57c0be45d78c75c46f64 - /opt/CAPEv2/storage/analyses/14127/files/2b3df7c8ef11032185a3494b160da2735c138bd0282fc5d058ea5625278eb505 —
2b3df7c8ef11032185a3494b160da2735c138bd0282fc5d058ea5625278eb505 - /opt/CAPEv2/storage/analyses/14127/files/ddb024cd5a865c7929cabbb342b3e0efe3b6f74c510d6fb7bd45eb2b95621736 —
ddb024cd5a865c7929cabbb342b3e0efe3b6f74c510d6fb7bd45eb2b95621736 - /opt/CAPEv2/storage/analyses/14127/files/90c783f5832aa6d70517b9d3b7c42a163e51eab35163ab23377be5ee3e410992 —
90c783f5832aa6d70517b9d3b7c42a163e51eab35163ab23377be5ee3e410992 - /opt/CAPEv2/storage/analyses/14127/files/f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 —
f8d2c17bdf34ccfb58070ac8b131a8d95055340101a329f9a7212ac5240d0c25 - /opt/CAPEv2/storage/analyses/14127/files/0533909266effa19aa94aebe938ee82428630bfa847904a30e891ab7eded0681 —
0533909266effa19aa94aebe938ee82428630bfa847904a30e891ab7eded0681 - /opt/CAPEv2/storage/analyses/14127/files/eb946bb81750d8d21ce56fdbabd8b5f58e9f2ac3761ccdac6e1371d887c902d1 —
eb946bb81750d8d21ce56fdbabd8b5f58e9f2ac3761ccdac6e1371d887c902d1 - /opt/CAPEv2/storage/analyses/14127/files/acf61b43b0b4e4306a2448dedbdcadb14e07e66697d7bb19a9220bd693e76b49 —
acf61b43b0b4e4306a2448dedbdcadb14e07e66697d7bb19a9220bd693e76b49 - /opt/CAPEv2/storage/analyses/14127/files/387853d1ca8409f1f8fad86a38692915e80f90ef967360f610d55b9f5baea51d —
387853d1ca8409f1f8fad86a38692915e80f90ef967360f610d55b9f5baea51d - /opt/CAPEv2/storage/analyses/14127/files/ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a —
ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a - /opt/CAPEv2/storage/analyses/14127/files/66c0ec4c687a4a2feb22e1fdc764f00a66b0a22292a5a504162e05f07c68de06 —
66c0ec4c687a4a2feb22e1fdc764f00a66b0a22292a5a504162e05f07c68de06 - /opt/CAPEv2/storage/analyses/14127/files/40a2d7eef56c580ce6e6d8a969e94ac1ebe67154b5bd78be53ff819883ed8228 —
40a2d7eef56c580ce6e6d8a969e94ac1ebe67154b5bd78be53ff819883ed8228 - /opt/CAPEv2/storage/analyses/14127/files/4ac98a094842bb0b5811e210b24e0f6f8b299371b118bf0487871825ebe7fba6 —
4ac98a094842bb0b5811e210b24e0f6f8b299371b118bf0487871825ebe7fba6 - /opt/CAPEv2/storage/analyses/14127/files/a95c75c72d8bb9d1a28b870644747595578ca10dd2816ffaf6c40ff5dd96ab4c —
a95c75c72d8bb9d1a28b870644747595578ca10dd2816ffaf6c40ff5dd96ab4c
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786566372&P2=404&P3=2&P4=fHEzt9nki8eQvmC3mLjFw%2fOukCocO%2f78%2b8v5tlnyICbqHHrEqGUr%2bUnBKf8MEmpMDvEuYFMJ04usNLVlRCNLxA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786566398&P2=404&P3=2&P4=evC9jE%2f0epn0zZbpfLuNLPRqQhkZ16pOskn4nOHxBi1FjNKDEP06oInUUJFPv%2blfh3BhkOAMaWZTHKEidRLuXA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 4.150.223.103
- 4.230.171.124
- 85.210.193.152
- 20.247.184.197
- 74.179.77.204
- 20.165.94.54
- 20.42.73.24
- 74.178.76.44
- 203.26.79.13
- 4.207.44.77
- 40.74.98.198
- 20.184.175.8
- 172.178.240.161
- 4.247.188.233
- 20.42.179.204
- 184.84.165.136
- 72.154.7.110
- 52.148.114.188
- 52.110.12.52
- 52.110.12.5
More Mira samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report