Chollima Hunter

← DPRK Hunting library

Fake MiroTalk Installer in a Recruiter Lure: Qt BeaverTail

WindowsmacOS

IOC Hunt medium Contagious InterviewBeaverTailInvisibleFerret

A MiroTalk.msi or MiroTalk.dmg installer a job candidate is asked to run for a video interview, carrying the Qt-compiled BeaverTail Unit 42 documents, followed by the downloader fetching Python and InvisibleFerret from its controller on TCP 1224.

What this hunt looks for

Unit 42's October 2024 update on Contagious Interview, which it tracks as CL-STA-0240, describes fake recruiters contacting developers through job-search platforms and persuading them to install software for an online interview. BeaverTail arrived as files masquerading as MiroTalk, a real-time video call application; Unit 42 notes the legitimate products are not flawed and only their names were borrowed.

The downloader was rewritten in Qt, as early as July 2024, so one code base builds for both operating systems: the victim runs MiroTalk.msi on Windows or mounts MiroTalk.dmg on macOS. A fake login window covers background theft, then the downloader fetches Python from /pdown on TCP 1224 and InvisibleFerret from /client/<campaign_id>.

The installer is the moment to catch: it arrives through a browser or chat client shortly after an interview is arranged, and Unit 42 publishes hashes for it. The queries look for names, hashes, the installer running, its child processes and the controller. The later chain has its own hunt, BeaverTail and InvisibleFerret.

Technique
Spearphishing through a job-search service (MITRE ATT&CK T1566.003) leading the victim to run a malicious installer (T1204.002) masquerading as a legitimate video-call application (T1036.005), which steals browser credentials (T1555.003) and retrieves its next stage over a non-standard port (T1571, T1105).
Data sources
File-write telemetry, EDR process telemetry, EDR network telemetry, File hashes, osquery
Last updated
2026-10-04

Indicators

The atomic values this hunt matches on, listed separately from the queries so they can be lifted into tooling that speaks none of the query languages below. Every value here is reported by one of the sources cited at the foot of this page.

TypeValueNote
File name MiroTalk.msi Windows installer carrying the Qt BeaverTail (Unit 42).
File name MiroTalk.dmg macOS disk image the victim mounts to run the installer package (Unit 42).
SHA256 36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670, de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170, fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0 BeaverTail installers, Windows MSI files (Unit 42).
SHA256 000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923, 9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c BeaverTail installer, macOS DMG disk images (Unit 42).
SHA256 0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd, 9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4, d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6 BeaverTail, Windows EXE files (Unit 42).
SHA256 0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132, d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e BeaverTail, macOS Mach-O executables (Unit 42).
IP 95.164.17.24, 185.235.241.208 BeaverTail and InvisibleFerret command-and-control servers (Unit 42); defanged in the source. 95.164.17.24:1224 is the address a targeted candidate reported publicly.
Port 1224 Controller port for the Python download and InvisibleFerret (Unit 42).
URI path /pdown, /client/<campaign_id> Python runtime and InvisibleFerret first-stage downloads (Unit 42).

Logic

Every query below implements these steps, so the same hunt returns the same result in each product.

  1. Collect: file writes, process starts and network connections on Windows and macOS endpoints
  2. Match: MiroTalk.msi or MiroTalk.dmg is written or run by msiexec, installer or hdiutil, or a MiroTalk-named parent starts a process
  3. Match: or controller 95.164.17.24 or 185.235.241.208 is contacted, or a proxy request is for /pdown or /client/<id> on port 1224
  4. Match: or, lower fidelity: a file or process hash is one of the ten reported BeaverTail hashes, or a public address is reached on port 1224
  5. Report: devices with the signal kinds hit, most kinds first

Queries

Defender / Sentinel KQL

Written for this site, from indicators reported by Unit 42

A device with the installer file, its run and a controller connection is the full Qt BeaverTail chain, and the installer file alone is worth a conversation with the candidate or recruiter.

union
    (DeviceFileEvents
        | where Timestamp > ago(90d)
        | where FileName in~ ("MiroTalk.msi", "MiroTalk.dmg")
            // optional: lower fidelity, the ten hashes are the 2024 builds Unit 42 analysed and a rebuild changes them; delete this line and the next
            or SHA256 in ("36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670", "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd", "9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4", "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132", "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e")
        | project Timestamp, DeviceId, DeviceName, Signal = "installer file", Detail = strcat(FolderPath, "/", FileName)),
    (DeviceProcessEvents
        | where Timestamp > ago(90d)
        | where (FileName in~ ("msiexec.exe", "installer", "hdiutil") and ProcessCommandLine contains "MiroTalk")
            or InitiatingProcessFileName contains "MiroTalk" or InitiatingProcessFolderPath contains "MiroTalk" or InitiatingProcessCommandLine contains "MiroTalk"
            // optional: lower fidelity, the ten hashes are the 2024 builds Unit 42 analysed and a rebuild changes them; delete this line and the next
            or SHA256 in ("36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670", "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd", "9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4", "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132", "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e")
        | project Timestamp, DeviceId, DeviceName, Signal = "installer run", Detail = strcat(InitiatingProcessFileName, " -> ", FileName, " ", ProcessCommandLine)),
    (DeviceNetworkEvents
        | where Timestamp > ago(90d)
        | where RemoteIP in ("95.164.17.24", "185.235.241.208")
            // optional: lower fidelity, port 1224 is not unique to this campaign; delete this line and the next
            or (RemotePort == 1224 and not(ipv4_is_private(RemoteIP)))
        | project Timestamp, DeviceId, DeviceName, Signal = "controller", Detail = strcat(InitiatingProcessFileName, " -> ", RemoteIP, ":", RemotePort))
| summarize Hits = count(), Signals = make_set(Signal), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Details = make_set(Detail, 5) by DeviceId, DeviceName
| order by array_length(Signals) desc, LastSeen desc
Lower-fidelity parts (2)
  • the ten SHA256 hashes — they identify only the 2024 builds Unit 42 analysed and a rebuild changes every one. Remove: delete each // optional: comment line that names the hashes together with the SHA256 in (...) line beneath it, in both branches
  • the port 1224 branch — port 1224 is not unique to this campaign and the match is bounded only by the public-address filter. Remove: delete the // optional: comment line and the line beneath it

Splunk SPL

Written for this site, from indicators reported by Unit 42

The same installer, process and controller signals over endpoint and network indexes.

```Placeholders: index=endpoint holds file and process events from Windows and macOS (file_name, file_path, file_hash, process_name, process, parent_process_name); index=network holds EDR or flow records.```
index=endpoint earliest=-90d
    (file_name IN ("MiroTalk.msi","MiroTalk.dmg") OR (process_name IN ("msiexec.exe","installer","hdiutil") AND process="*MiroTalk*") OR parent_process_name="*MiroTalk*" OR process_path="*MiroTalk*"
    ```optional: lower fidelity, the ten hashes are the 2024 builds Unit 42 analysed and a rebuild changes them; delete this line and the next```
    OR file_hash IN ("36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670", "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd", "9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4", "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132", "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e")
    )
| eval signal=if(isnotnull(file_name), "installer file", "installer run"), detail=coalesce(file_path, process)
| stats count min(_time) AS first_seen max(_time) AS last_seen values(signal) AS signals values(detail) AS details BY host
| append
    [search index=network earliest=-90d (dest_ip IN ("95.164.17.24", "185.235.241.208")
        ```optional: lower fidelity, port 1224 is not unique to this campaign; delete this line and the next```
        OR dest_port=1224
     )
     | where NOT (cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("172.16.0.0/12", dest_ip) OR cidrmatch("192.168.0.0/16", dest_ip))
     | stats count min(_time) AS first_seen max(_time) AS last_seen values(dest_ip) AS details BY src
     | eval host=src, signals="controller"]
| append
    [search index=proxy earliest=-90d dest_port=1224
     | where match(url, "^https?://[^/]+:1224/(pdown|client/[0-9]+)")
     | stats count min(_time) AS first_seen max(_time) AS last_seen values(url) AS details BY src
     | eval host=src, signals="controller path"]
| stats sum(count) AS hits min(first_seen) AS first_seen max(last_seen) AS last_seen values(signals) AS signals values(details) AS details BY host
| eval signal_count=mvcount(signals)
| convert ctime(first_seen) ctime(last_seen)
| sort - signal_count, - last_seen
Lower-fidelity parts (2)
  • the ten SHA256 hashes — they identify only the 2024 builds Unit 42 analysed and a rebuild changes every one. Remove: delete the optional comment line and the file_hash IN line beneath it
  • the port 1224 branch — port 1224 is not unique to this campaign and the match is bounded only by the public-address filter. Remove: delete the optional comment line and the OR dest_port=1224 line beneath it

Sigma

Written for this site, from indicators reported by Unit 42

Three rules that apply to Windows and macOS process, file and network telemetry.

title: MiroTalk Installer Written, Run or Spawning a Child Process
id: bf53a08e-2cd6-4486-8c8b-71e0d1608909
status: experimental
description: >
  Detects msiexec, installer or hdiutil handling a package named MiroTalk, a
  process started by a MiroTalk-named parent, and one of the BeaverTail
  hashes, on Windows and macOS. Unit 42 documents MiroTalk.msi and
  MiroTalk.dmg as the delivery files of the Qt BeaverTail downloader.
references:
  - https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/
logsource:
  category: process_creation
detection:
  selection_install:
    Image|endswith:
      - '\msiexec.exe'
      - '/installer'
      - '/hdiutil'
    CommandLine|contains: 'MiroTalk'
  selection_child:
    ParentImage|contains: 'MiroTalk'
  # optional: lower fidelity, the ten hashes are the 2024 builds Unit 42 analysed and a rebuild changes them; delete this line and the selection below it
  selection_hash:
    Hashes|contains:
      - 'SHA256=36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670'
      - 'SHA256=de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170'
      - 'SHA256=fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0'
      - 'SHA256=000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923'
      - 'SHA256=9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c'
      - 'SHA256=0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd'
      - 'SHA256=9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4'
      - 'SHA256=d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6'
      - 'SHA256=0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132'
      - 'SHA256=d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e'
  condition: 1 of selection_*
falsepositives:
  - An organisation that distributes its own MiroTalk desktop client under this name
level: high
---
title: MiroTalk Installer Written to Disk
id: de765d78-6cd4-40ee-9109-97515a91a2aa
status: experimental
description: >
  Detects a file named MiroTalk.msi or MiroTalk.dmg written to disk, the
  delivery files Unit 42 documents for the Windows and macOS builds of the
  Qt BeaverTail downloader.
references:
  - https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/
logsource:
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - '\MiroTalk.msi'
      - '/MiroTalk.msi'
      - '\MiroTalk.dmg'
      - '/MiroTalk.dmg'
  condition: selection
falsepositives:
  - An organisation that distributes its own MiroTalk desktop client under this name
level: high
---
title: Connection to a Qt BeaverTail Controller
id: 0b6f4c0e-6a8e-4f8f-9d0e-5f6c8a7d9e10
status: experimental
description: >
  Detects connections to the two controllers Unit 42 reports for the Qt
  BeaverTail and InvisibleFerret, and to any public address on port 1224.
references:
  - https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/
logsource:
  category: network_connection
detection:
  selection_ip:
    DestinationIp:
      - '95.164.17.24'
      - '185.235.241.208'
  # optional: lower fidelity, port 1224 is not unique to this campaign; delete this line and the two blocks below it
  selection_port:
    DestinationPort: 1224
  filter_private:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection_ip or (selection_port and not filter_private)
level: high
---
title: Request for the Qt BeaverTail Controller Paths
id: 0b6f4c0e-6a8e-4f8f-9d0e-5f6c8a7d9e11
status: experimental
description: >
  Detects proxy requests for the /pdown and /client controller paths Unit 42
  reports for the Python and InvisibleFerret downloads on port 1224.
references:
  - https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/
logsource:
  category: proxy
detection:
  selection:
    c-uri|re: '^https?://[^/]+:1224/(pdown|client/[0-9]+)'
  condition: selection
level: high
Lower-fidelity parts (2)
  • the ten SHA256 hashes — they identify only the 2024 builds Unit 42 analysed and a rebuild changes every one. Remove: delete the # optional: comment line and the selection_hash block beneath it
  • the port 1224 branch — port 1224 is not unique to this campaign and the match is bounded only by the public-address filter. Remove: delete the # optional: comment line, the selection_port and filter_private blocks, and change the condition to: selection_ip

CrowdStrike LogScale

Written for this site, from indicators reported by Unit 42

The same installer-run, hash and controller signals over Falcon process and network events; file-write events are not used.

(#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ ((FileName=/^(msiexec\.exe|installer|hdiutil)$/i CommandLine=/MiroTalk/i) or ParentBaseFileName=/MiroTalk/i))
    // optional: lower fidelity, the ten hashes are the 2024 builds Unit 42 analysed and a rebuild changes them; delete this line and the next
    or (#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ in(SHA256HashData, values=["36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670", "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd", "9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4", "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132", "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e"]))
or (#event_simpleName=NetworkConnectIP4 in(RemoteAddressIP4, values=["95.164.17.24", "185.235.241.208"]))
    // optional: lower fidelity, port 1224 is not unique to this campaign; delete this line and the next
    or (#event_simpleName=NetworkConnectIP4 RemotePort=1224 NOT cidr(RemoteAddressIP4, subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"]))
| groupBy([aid, ComputerName], function=[count(as=Hits), count(#event_simpleName, distinct=true, as=SignalKinds), collect([#event_simpleName]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(SignalKinds, order=desc)
Lower-fidelity parts (2)
  • the ten SHA256 hashes — they identify only the 2024 builds Unit 42 analysed and a rebuild changes every one. Remove: delete the // optional: comment line and the line beneath it
  • the port 1224 branch — port 1224 is not unique to this campaign and the match is bounded only by the public-address filter. Remove: delete the // optional: comment line and the line beneath it

Elastic

Written for this site, from indicators reported by Unit 42

The same installer, hash and controller signals over Elastic Defend events, counted per host.

FROM logs-endpoint.events.*
| EVAL cmd = TO_LOWER(process.command_line)
| WHERE TO_LOWER(file.name) IN ("mirotalk.msi", "mirotalk.dmg")
    OR (TO_LOWER(process.name) IN ("msiexec.exe", "installer", "hdiutil") AND cmd RLIKE ".*mirotalk.*")
    OR TO_LOWER(process.parent.name) RLIKE ".*mirotalk.*"
    OR CIDR_MATCH(destination.ip, "95.164.17.24/32", "185.235.241.208/32")
    OR (destination.port == 1224 AND NOT CIDR_MATCH(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8"))
    OR file.hash.sha256 IN ("36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670", "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd", "9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4", "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132", "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e")
    OR process.hash.sha256 IN ("36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670", "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd", "9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4", "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132", "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e")
| EVAL signal = CASE(file.name IS NOT NULL, "installer file", destination.ip IS NOT NULL, "controller", "installer run")
| STATS hits = COUNT(*), signal_kinds = COUNT_DISTINCT(signal), signals = VALUES(signal), last_seen = MAX(@timestamp) BY host.name
| SORT signal_kinds DESC, last_seen DESC
Lower-fidelity parts (2)
  • the ten SHA256 hashes — they identify only the 2024 builds Unit 42 analysed and a rebuild changes every one. Remove: delete the two OR lines ending in file.hash.sha256 IN and process.hash.sha256 IN
  • the port 1224 branch — port 1224 is not unique to this campaign and the match is bounded only by the public-address filter. Remove: delete the OR line beginning (destination.port == 1224

Cortex XQL

Written for this site, from indicators reported by Unit 42

The same installer, hash and controller signals over Cortex events.

dataset = xdr_data
| filter (event_type = ENUM.FILE and lowercase(action_file_name) in ("mirotalk.msi", "mirotalk.dmg"))
    or (event_type = ENUM.PROCESS and ((lowercase(action_process_image_name) in ("msiexec.exe", "installer", "hdiutil") and lowercase(action_process_image_command_line) ~= "mirotalk") or lowercase(actor_process_image_name) ~= "mirotalk"))
        // optional: lower fidelity, the ten hashes are the 2024 builds Unit 42 analysed and a rebuild changes them; delete this line and the next
    or (action_file_sha256 in ("36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670", "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd", "9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4", "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132", "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e") or action_process_image_sha256 in ("36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670", "de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170", "fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0", "000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923", "9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c", "0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd", "9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4", "d5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6", "0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132", "d801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e"))
    or (event_type = ENUM.NETWORK and action_remote_ip in ("95.164.17.24", "185.235.241.208"))
        // optional: lower fidelity, port 1224 is not unique to this campaign; delete this line and the next
    or (event_type = ENUM.NETWORK and action_remote_port = 1224 and incidr(action_remote_ip, "10.0.0.0/8") = false and incidr(action_remote_ip, "172.16.0.0/12") = false and incidr(action_remote_ip, "192.168.0.0/16") = false)
| comp count() as hits, count_distinct(event_type) as signal_kinds, max(_time) as last_seen by agent_hostname
| sort desc signal_kinds, desc last_seen
Lower-fidelity parts (2)
  • the ten SHA256 hashes — they identify only the 2024 builds Unit 42 analysed and a rebuild changes every one. Remove: delete the // optional: comment line and the line beneath it
  • the port 1224 branch — port 1224 is not unique to this campaign and the match is bounded only by the public-address filter. Remove: delete the // optional: comment line and the line beneath it

osquery

Written for this site, from indicators reported by Unit 42

A point-in-time check of the installer files, running MiroTalk-named processes and, optionally, hashes on the machine in hand.

SELECT 'installer file' AS signal, f.filename AS item, f.path AS detail
FROM file f
WHERE (f.path LIKE '/Users/%/Downloads/%' OR f.path LIKE '/Users/%/Desktop/%' OR f.path LIKE 'C:\Users\%\Downloads\%' OR f.path LIKE 'C:\Users\%\Desktop\%') AND f.filename IN ('MiroTalk.msi', 'MiroTalk.dmg')
UNION ALL
SELECT 'running process', name, path || ' ' || cmdline
FROM processes
WHERE lower(path) LIKE '%mirotalk%' OR lower(cmdline) LIKE '%mirotalk%'
-- optional: lower fidelity, the ten hashes are 2024 builds and hashing every Downloads and Desktop file is slow; delete this line and the four below it
UNION ALL
SELECT 'hash match', f.filename, h.sha256
FROM file f JOIN hash h ON h.path = f.path
WHERE (f.path LIKE '/Users/%/Downloads/%' OR f.path LIKE '/Users/%/Desktop/%' OR f.path LIKE 'C:\Users\%\Downloads\%' OR f.path LIKE 'C:\Users\%\Desktop\%') AND h.sha256 IN ('36cac29ff3c503c2123514ea903836d5ad81067508a8e16f7947e3e675a08670', 'de6f9e9e2ce58a604fe22a9d42144191cfc90b4e0048dffcc69d696826ff7170', 'fd9e8fcc5bda88870b12b47cbb1cc8775ccff285f980c4a2b683463b26e36bf0', '000b4a77b1905cabdb59d2b576f6da1b2ef55a0258004e4a9e290e9f41fb6923', '9abf6b93eafb797a3556bea1fe8a3b7311d2864d5a9a3687fce84bc1ec4a428c', '0621d37818c35e2557fdd8a729e50ea662ba518df8ca61a44cc3add5c6deb3cd', '9e3a9dbf10793a27361b3cef4d2c87dbd3662646f4470e5242074df4cb96c6b4', 'd5c0b89e1dfbe9f5e5b2c3f745af895a36adf772f0b72a22052ae6dfa045cea6', '0f5f0a3ac843df675168f82021c24180ea22f764f87f82f9f77fe8f0ba0b7132', 'd801ad1beeab3500c65434da51326d7648a3c54923d794b2411b7b6a2960f31e');
Lower-fidelity parts (1)
  • the ten SHA256 hashes — they identify only the 2024 builds Unit 42 analysed and a rebuild changes every one. Remove: delete the -- optional: comment line and the UNION ALL, SELECT, FROM and WHERE lines beneath it, ending at the semicolon

False positives and tuning

The hashes are exact and date from 2024, so they identify only the builds Unit 42 analysed; the file names are what a later build is likely to keep.

A file named for a video-call product the organisation has not deployed, arriving after an interview was arranged, is the pattern. If you run MiroTalk, check whether it ships a desktop client under this name.

Port 1224 is not unique to this campaign; the port-only branch is broad by design and bounded by the public-address filter.

Sources

Tuning required before use This hunt is a starting point. Adapt the queries to your schema, validate them against your baseline and tune them for the false positives noted above. Indicators go stale as operators rotate hosts.