The Mirage Campaign

Dell SecureWorks CTU analysed the Mirage (MirageFox) RAT campaign (since April 2012) that targeted executives at energy, oil and military organizations via spearphishing droppers that masquerade as PDFs; the report documents two main Mirage variants (POST and GET with custom encodings/Base64), persistence and C2 behaviors (HTTP/SSL over ports 80/443/8080, use of HTran and dDNS), custom environment-specific builds, sinkholed infrastructure, victim counts and geographic distribution, and provides IOCs including MD5 hashes and Yara rules for detection.