Mirage - Revision history

Eric.freyssinet: Text replacement - "=Unknown" to "="

2015-08-08T13:44:18Z

Text replacement - "=Unknown" to "="

← Older revision		Revision as of 13:44, 8 August 2015
Line 3:		Line 3:
	\|Alias=MirageFox		\|Alias=MirageFox
	\|Sibling=Lingbo, Sin Digoo,		\|Sibling=Lingbo, Sin Digoo,
	\|Target=~~Unknown~~		\|Target=
	\|UserAgent=Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)		\|UserAgent=Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
	\|CCProtocol=HTTP		\|CCProtocol=HTTP
	\|Status=~~Unknown~~		\|Status=
	\|BeginYear=~~Unknown~~		\|BeginYear=
	\|EndYear=~~Unknown~~		\|EndYear=
	\|Group=Spying		\|Group=Spying
	\|Fonctionnalités=* [[feature::Phone home]] (with system information)		\|Fonctionnalités=* [[feature::Phone home]] (with system information)

Eric.freyssinet at 15:52, 31 July 2015

2015-07-31T15:52:36Z

← Older revision		Revision as of 15:52, 31 July 2015
Line 1:		Line 1:
	{{Botnet		{{Botnet
	\|Introduction=* Related to: [[sibling::Lingbo]] (similar behaviour), [[~~related to~~::Sin Digoo]] (same domain owners)		\|Introduction=* Related to: [[sibling::Lingbo]] (similar behaviour), [[sibling::Sin Digoo]] (same domain owners)
	\|~~Fonctionnalités~~=* [[feature::Phone home]] (with system information)		\|Alias=MirageFox
	* [[feature::Dynamic DNS]]		\|Sibling=Lingbo, Sin Digoo,
	\|~~Infrastructure~~=* [[port::TCP/80]], ~~[[port::TCP/443]]~~, ~~[[port::TCP/8080]]~~		\|Target=Unknown
	* Use of servers with [[related to::HTran]] to proxy the connections
	\|UserAgent=Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)		\|UserAgent=Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
	~~\|Language1=Chinese~~
	\|CCProtocol=HTTP		\|CCProtocol=HTTP
	~~\|Target=Unknown~~
	\|Status=Unknown		\|Status=Unknown
	\|BeginYear=Unknown		\|BeginYear=Unknown
	\|EndYear=Unknown		\|EndYear=Unknown
	\|Group=Spying		\|Group=Spying
	\|~~Alias~~=~~MirageFox~~		\|Fonctionnalités=* [[feature::Phone home]] (with system information)
			* [[feature::Dynamic DNS]]
			\|Infrastructure=* [[port::TCP/80]], [[port::TCP/443]], [[port::TCP/8080]]
			* Use of servers with [[related to::HTran]] to proxy the connections
			\|Language1=Chinese
	\|Yara rules=<syntaxhighlight lang='perl'>rule Mirage_APT_Backdoor : APT Mirage Backdoor Rat MirageRat		\|Yara rules=<syntaxhighlight lang='perl'>rule Mirage_APT_Backdoor : APT Mirage Backdoor Rat MirageRat
	{		{

Eric.freyssinet: 1 revision imported

2015-02-04T22:03:31Z

1 revision imported

New page

{{Botnet
|Introduction=* Related to: [[sibling::Lingbo]] (similar behaviour), [[related to::Sin Digoo]] (same domain owners)
|Fonctionnalités=* [[feature::Phone home]] (with system information)
* [[feature::Dynamic DNS]]
|Infrastructure=* [[port::TCP/80]], [[port::TCP/443]], [[port::TCP/8080]]
* Use of servers with [[related to::HTran]] to proxy the connections
|UserAgent=Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
|Language1=Chinese
|CCProtocol=HTTP
|Target=Unknown
|Status=Unknown
|BeginYear=Unknown
|EndYear=Unknown
|Group=Spying
|Alias=MirageFox
|Yara rules=<syntaxhighlight lang='perl'>rule Mirage_APT_Backdoor : APT Mirage Backdoor Rat MirageRat
{
meta:
author = "Silas Cutler (SCutler@SecureWorks.com)"
version = "1.0"
description = "Malware related to APT campaign"
type = "APT Trojan / RAT / Backdoor"
strings:
$a1 = "welcome to the desert of the real"
$a2 = "Mirage"
$b = "Encoding: gzip"
$c = /\/[A-Za-z]*\?hl=en/
condition:
(($a1 or $a2) or $b) and $c
}</syntaxhighlight>
|Victime4=
}}