Threat video1:00
Mirax RAT Server-Side Device Takeover: Detection & IOCs
Mirax RAT hijacks banking phones through Meta-ad streaming app lures: 9 detection rules, 29 IOCs, 18 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for Mirax RAT Server-Side Device Takeover: Detection & IOCs →
Chapters
- 0:00The hookAndroid banking RAT strikes via ads.
- 0:04The storyDelivered through streaming app ads.
- 0:10Attack pathRequests Accessibility Service access.
- 0:23AttributionAttributed to MiraxBot.
- 0:28Indicators of compromise28 indicators to hunt: 4 domains, 4 SHA-256 hashes and 19 SHA-1 hashes, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to exfiltration.
- 0:43Remediation4 steps now: Block and alert on the Group-IB C2 domains oscofneuid[.]com.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Android banking RAT strikes via ads.
0:05Delivered through streaming app ads.
0:07Masquerades as Google Play Services.
0:11Requests Accessibility Service access.
0:13Connects to command center.
0:15Intercepts SMS and notifications.
0:18Injects phishing overlays on banking apps.
0:23Attributed to MiraxBot. Confidence: low.
0:2828 indicators to hunt: 4 domains, 4 SHA-256 hashes and 19 SHA-1 hashes, and more.
0:3818 ATT&CK techniques, from initial access to exfiltration.
0:434 steps now: Block and alert on the Group-IB C2 domains oscofneuid[.]com.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.