Mirage: Difference between revisions

Revision as of 15:52, 31 July 2015

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Mirage
Alias	MirageFox
Group	Spying
Parent
Sibling	Lingbo, Sin Digoo
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Unknown
Origin
Distribution vector
UserAgent	Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
CCProtocol	HTTP (Centralized)
Activity	Unknown / Unknown
Status	Unknown
Language
Programming language
Operation/Working group

	Author	Editor	Year
The Mirage campaign	Silas Cutler	DELL SecureWorks	2012

@@ Line 1: / Line 1: @@
 {{Botnet
-|Introduction=* Related to: [[sibling::Lingbo]] (similar behaviour), [[related to::Sin Digoo]] (same domain owners)
+|Introduction=* Related to: [[sibling::Lingbo]] (similar behaviour), [[sibling::Sin Digoo]] (same domain owners)
-|Fonctionnalités=* [[feature::Phone home]] (with system information)
+|Alias=MirageFox
-* [[feature::Dynamic DNS]]
+|Sibling=Lingbo, Sin Digoo,
-|Infrastructure=* [[port::TCP/80]], [[port::TCP/443]], [[port::TCP/8080]]
+|Target=Unknown
-* Use of servers with [[related to::HTran]] to proxy the connections
 |UserAgent=Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)
-|Language1=Chinese
 |CCProtocol=HTTP
-|Target=Unknown
 |Status=Unknown
 |BeginYear=Unknown
 |EndYear=Unknown
 |Group=Spying
-|Alias=MirageFox
+|Fonctionnalités=* [[feature::Phone home]] (with system information)
+* [[feature::Dynamic DNS]]
+|Infrastructure=* [[port::TCP/80]], [[port::TCP/443]], [[port::TCP/8080]]
+* Use of servers with [[related to::HTran]] to proxy the connections
+|Language1=Chinese
 |Yara rules=<syntaxhighlight lang='perl'>rule Mirage_APT_Backdoor : APT Mirage Backdoor Rat MirageRat
 {