Mira

Overview

Trojan:Win32/Mira (distinct from the IoT botnet Mirai) is a malicious Windows trojan primarily designed to act as a backdoor and downloader. Once it infiltrates a system, often via drive-by downloads or bundled with pirated software, it quietly establishes a connection to a remote command-and-control (C2) server. It gathers system profiling information (such as operating system version, computer name, and IP address) and sends this telemetry to the attacker. The primary threat posed by Mira is its ability to download and execute arbitrary secondary payloads, meaning an initial Mira infection can quickly escalate into a ransomware, banking trojan, or information stealer incident depending on the attacker's current campaign.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_MIRA {
    meta:
        description = "Detects Mira (worm)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "mira" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Mira Activity
id: cf5bdfb40421ac1f30cc4d45b66b5a81
status: experimental
description: Detects generic indicators of the mira malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*mira*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Quarantine the affected endpoint to sever the connection to the C2 server and prevent payload downloading.
2. Analyze DNS and HTTP traffic logs to identify the remote C2 domains and sinkhole or block them network-wide.
3. Conduct a forensic review to determine if secondary payloads were successfully downloaded and executed prior to containment.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the threat is eradicated simply by removing the Mira executable; thoroughly investigate for secondary dropped malware.

References & External Analysis

• Search "mira" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: worm)

Explore other malware families in the same category:

• Mofksys
• Chir
• Conficker
• Vobfus
• Allaple

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/mira.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.