Mirage: Difference between revisions

Latest revision as of 13:44, 8 August 2015

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Mirage
Alias	MirageFox
Group	Spying
Parent
Sibling	Lingbo, Sin Digoo
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target
Origin
Distribution vector
UserAgent	Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
CCProtocol	HTTP (Centralized)
Activity	/
Status
Language
Programming language
Operation/Working group

	Author	Editor	Year
The Mirage campaign	Silas Cutler	DELL SecureWorks	2012

@@ Line 1: / Line 1: @@
 {{Botnet
-|Introduction=* Related to: [[sibling::Lingbo]] (similar behaviour), [[related to::Sin Digoo]] (same domain owners)
+|Introduction=* Related to: [[sibling::Lingbo]] (similar behaviour), [[sibling::Sin Digoo]] (same domain owners)
+|Alias=MirageFox
+|Sibling=Lingbo, Sin Digoo,
+|Target=
+|UserAgent=Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
+|CCProtocol=HTTP
+|Status=
+|BeginYear=
+|EndYear=
+|Group=Spying
 |Fonctionnalités=* [[feature::Phone home]] (with system information)
 * [[feature::Dynamic DNS]]
 |Infrastructure=* [[port::TCP/80]], [[port::TCP/443]], [[port::TCP/8080]]
 * Use of servers with [[related to::HTran]] to proxy the connections
-|UserAgent=Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
 |Language1=Chinese
-|CCProtocol=HTTP
-|Target=Unknown
-|Status=Unknown
-|BeginYear=Unknown
-|EndYear=Unknown
-|Group=Spying
-|Alias=MirageFox
 |Yara rules=<syntaxhighlight lang='perl'>rule Mirage_APT_Backdoor : APT Mirage Backdoor Rat MirageRat
 {