Overview

Trojan:Win32/Mira (distinct from the IoT botnet Mirai) is a malicious Windows trojan primarily designed to act as a backdoor and downloader. Once it infiltrates a system, often via drive-by downloads or bundled with pirated software, it quietly establishes a connection to a remote command-and-control (C2) server. It gathers system profiling information (such as operating system version, computer name, and IP address) and sends this telemetry to the attacker. The primary threat posed by Mira is its ability to download and execute arbitrary secondary payloads, meaning an initial Mira infection can quickly escalate into a ransomware, banking trojan, or information stealer incident depending on the attacker's current campaign.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Technique	Name	Tactic
`T1059`	Command and Scripting Interpreter	Execution
`T1105`	Ingress Tool Transfer	Command and Control
`T1082`	System Information Discovery	Discovery
`T1071.001`	Application Layer Protocol: Web Protocols	Command and Control
`T1543.003`	Create or Modify System Process: Windows Service	Persistence

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_MIRA {
    meta:
        description = "Detects Mira (worm)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "mira" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Mira Activity
id: cf5bdfb40421ac1f30cc4d45b66b5a81
status: experimental
description: Detects generic indicators of the mira malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*mira*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

Quarantine the affected endpoint to sever the connection to the C2 server and prevent payload downloading.
Analyze DNS and HTTP traffic logs to identify the remote C2 domains and sinkhole or block them network-wide.
Conduct a forensic review to determine if secondary payloads were successfully downloaded and executed prior to containment.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

Do not assume the threat is eradicated simply by removing the Mira executable; thoroughly investigate for secondary dropped malware.

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.

Mira