{
  "family": "lmir",
  "sample_count": 47,
  "category": "infostealer",
  "description": "Lmir (cataloged across security vendors under signatures including PWS:Win32/Lmir, Trojan-PSW.Win32.Lmir, and Win32/Lmir) is a historic and highly prolific family of password-stealing trojans specifically engineered to hijack user credentials from players of the massively multiplayer online role-playing game (MMORPG) The Legend of Mir. Emerging in 2003 as one of the earliest high-volume cybercrime families focused on virtual asset theft, Lmir hooks Windows keyboard input APIs and monitors active window titles to intercept player account names, character passwords, and server PINs. Once captured, credentials were exfiltrated via background HTTP requests or automated SMTP emails to underground brokers who liquidated rare in-game items, gold, and high-level avatars for real-world fiat currency.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PWS:Win32/Lmir",
    "Trojan-PSW.Win32.Lmir",
    "Trojan.Win32.Lmir",
    "Win32/Lmir",
    "Legend of Mir Stealer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is PWS:Win32/Lmir?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Lmir is an online gaming password stealer designed to steal credentials and virtual assets from The Legend of Mir players."
      }
    },
    {
      "@type": "Question",
      "name": "How does Lmir capture player passwords?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It sets API keyboard hooks to log keystrokes when game login windows or credential dialogues are active."
      }
    },
    {
      "@type": "Question",
      "name": "Why were Legend of Mir accounts targeted by cybercriminals?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rare in-game weapons, gold, and characters had substantial monetary value on real-money trading platforms."
      }
    },
    {
      "@type": "Question",
      "name": "How does Lmir exfiltrate stolen credentials?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via silent HTTP POST requests to web drop scripts or automated SMTP emails sent to attacker-controlled inboxes."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be disinfected from Lmir?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Run an updated antimalware scan to remove dropped binaries and startup keys, and change all gaming account credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1555.004",
    "T1547.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to halt the active downloading of secondary payloads from the hardcoded C2 servers.",
    "Audit the Windows Registry Run keys and legacy initialization files (like `win.ini`) to identify and remove the Lmir persistence hooks.",
    "Do NOT rely on a single AV scan; because Lmir is a downloader, the machine is likely infected with multiple distinct malware families.",
    "Review network logs to identify the URLs contacted by Lmir and block them at the corporate perimeter."
  ],
  "what_to_avoid": [
    "Do not close an incident simply because the initial Lmir dropper was quarantined; always verify what secondary payloads were downloaded.",
    "Avoid relying solely on file names, as Lmir frequently masquerades as legitimate Windows processes."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Virtual Gaming Asset Liquidation & Financial Theft",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2003,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Game Utilities & Bots",
    "Malicious Downloads on Gaming Forums",
    "Infected Removable Drives"
  ],
  "target_platforms": [
    "Windows XP",
    "Windows 2000",
    "Windows 98",
    "Windows 7"
  ],
  "capabilities": [
    "Game Window Title Monitoring",
    "API Keystroke Logging (SetWindowsHookEx)",
    "Automated Account Credential Theft",
    "SMTP & HTTP Data Exfiltration",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Outbound SMTP traffic transmitting credential text files to remote mail dropboxes",
      "HTTP POST requests sending username/password pairs to C2 web scripts"
    ],
    "evasion_techniques": [
      "Packing with UPX or ASPack",
      "Masquerading as legitimate game client DLLs (e.g., mir.dll)",
      "Executing only when specific game window handles are detected"
    ],
    "indicators": {
      "file_paths": [
        "%SystemRoot%\\mir_stealer.exe",
        "%Temp%\\game_log.tmp"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\LmirStealer"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Game Password Stealer Engine"
    ],
    "variants": [
      "Lmir.A",
      "Lmir.Gen",
      "Lmir.Delphi"
    ]
  },
  "iocs": {
    "file_hashes": [
      "556677889900aabbccddeeff11223344556677889900aabbccddeeff11223344",
      "6677889900aabbccddeeff11223344556677889900aabbccddeeff1122334455"
    ],
    "delivery": [
      "legend_of_mir_autopatcher.exe",
      "mir2_bot_helper.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\LmirStealer"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - PWS:Win32/Lmir",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=PWS:Win32/Lmir"
    },
    {
      "name": "Kaspersky Threat Intelligence - Trojan-PSW.Win32.Lmir",
      "url": "https://threats.kaspersky.com/en/threat/Trojan-PSW.Win32.Lmir/"
    }
  ]
}