Overview

overview

10

Static

static

10

Win32/mimidrv.sys

windows7-x64

10

Win32/mimidrv.sys

windows10-2004-x64

10

Win32/mimikatz.exe

windows7-x64

1

Win32/mimikatz.exe

windows10-2004-x64

1

Win32/mimilib.dll

windows7-x64

3

Win32/mimilib.dll

windows10-2004-x64

3

Win32/mimilove.exe

windows7-x64

1

Win32/mimilove.exe

windows10-2004-x64

1

Win32/mimispool.dll

windows7-x64

1

Win32/mimispool.dll

windows10-2004-x64

1

x64/mimidrv.sys

windows7-x64

10

x64/mimidrv.sys

windows10-2004-x64

10

x64/mimikatz.exe

windows7-x64

1

x64/mimikatz.exe

windows10-2004-x64

1

x64/mimilib.dll

windows7-x64

1

x64/mimilib.dll

windows10-2004-x64

1

x64/mimispool.dll

windows7-x64

1

x64/mimispool.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mimikatz_trunk.7z

  • Size

    879KB

  • MD5

    9b161e8fe171550ff1116c11e62b734f

  • SHA1

    1890075e36c792d99aecb57424cffbdbcbe6215f

  • SHA256

    1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3

  • SHA512

    e877464194c5af4a92682a4b323173a7f9940e96e7abf847dc18d63ec54d01f14d6c43f7cad44e9cae3b2a6ec0d4ab8cc9798047e839a9b1c6fb2358e309558c

  • SSDEEP

    24576:VVS8/iDSEVeuUaR1XMuzs65mOwhkVahwu5Opo:V88/i+EVpUaR18ot6ye5Opo

Score
10/10
mimikatz

Malware Config

Signatures

  • Mimikatz family
    mimikatz
  • mimikatz is an open source tool to dump credentials on Windows 6 IoCs
  • Unsigned PE 7 IoCs

    Checks for missing Authenticode signature.

Files

  • mimikatz_trunk.7z
    .7z
  • README.md
  • Win32/mimidrv.sys
    .sys windows:6 windows x86 arch:x86

    25862203800205f80fd8b3a6634ea1c6


    Code Sign

    Headers

    Imports

    Sections

  • Win32/mimikatz.exe
    .exe windows:5 windows x86 arch:x86

    ff6abb25b3369620afef1dacd4a21f4c


    Headers

    Imports

    Sections

  • Win32/mimilib.dll
    .dll windows:5 windows x86 arch:x86

    721f5090ab31a091c5b9778028cc974c


    Headers

    Imports

    Exports

    Sections

  • Win32/mimilove.exe
    .exe windows:5 windows x86 arch:x86

    4e1492696c43305d97c6c6a4e8958cdf


    Headers

    Imports

    Sections

  • Win32/mimispool.dll
    .dll windows:5 windows x86 arch:x86

    3d9268f54e37cd480a12f0595aa6b437


    Headers

    Imports

    Exports

    Sections

  • kiwi_passwords.yar
  • mimicom.idl
  • x64/mimidrv.sys
    .sys windows:6 windows x64 arch:x64

    a63c276e82b09fa57509d7958aa9d208


    Code Sign

    Headers

    Imports

    Sections

  • x64/mimikatz.exe
    .exe windows:5 windows x64 arch:x64

    55ee500bb4bdfc49f27a98ae456d8edf


    Headers

    Imports

    Sections

  • x64/mimilib.dll
    .dll windows:5 windows x64 arch:x64

    eaa79f1d9e8a00542b09cb462d0658ef


    Headers

    Imports

    Exports

    Sections

  • x64/mimispool.dll
    .dll windows:5 windows x64 arch:x64

    c38ebbf4627ca2303746c77210e5a12e


    Headers

    Imports

    Exports

    Sections