{
  "family": "mira",
  "sample_count": 729,
  "category": "worm",
  "description": "Trojan:Win32/Mira (distinct from the IoT botnet Mirai) is a malicious Windows trojan primarily designed to act as a backdoor and downloader. Once it infiltrates a system, often via drive-by downloads or bundled with pirated software, it quietly establishes a connection to a remote command-and-control (C2) server. It gathers system profiling information (such as operating system version, computer name, and IP address) and sends this telemetry to the attacker. The primary threat posed by Mira is its ability to download and execute arbitrary secondary payloads, meaning an initial Mira infection can quickly escalate into a ransomware, banking trojan, or information stealer incident depending on the attacker's current campaign.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "high",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1071.001",
    "T1082",
    "T1059",
    "T1105",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059",
      "name": "Command and Scripting Interpreter",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Quarantine the affected endpoint to sever the connection to the C2 server and prevent payload downloading.",
    "Analyze DNS and HTTP traffic logs to identify the remote C2 domains and sinkhole or block them network-wide.",
    "Conduct a forensic review to determine if secondary payloads were successfully downloaded and executed prior to containment."
  ],
  "what_to_avoid": [
    "Do not assume the threat is eradicated simply by removing the Mira executable; thoroughly investigate for secondary dropped malware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}