MirageFox

ATP Sandbox Adv. Heuristics

Description

MirageFox is a remote access tool used against Windows systems, an upgraded version of the Mirage RAT believed to originate in 2012.

Stats

First seen: March 2022
Last seen: September 2026

MITRE ATT&CK techniques

5 techniques across 3 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0005 Stealth

T1140Deobfuscate/Decode Files or Information
T1574Hijack Execution Flow
- T1574.001DLL

TA0007 Discovery

T1033System Owner/User Discovery
T1082System Information Discovery

Associated groups

G0004Ke3chang

Alert name variants

Alert Name	Engine
Win32.Trojan.Miragefox	ATP Sandbox Adv. Heuristics

Related families

Clambling InvisiMole Metamorfo PlugX PUBLOAD

References