mimic | 19014566054[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

19014566054.zip
Size

1.4MB
MD5

5d3d66c6cd46cb7c1c779721c33a5200
SHA1

5ca7f0aa579d3e0b5c86c74fa25745dc5398544f
SHA256

69a30c51d3d6a61c72a8bc4530bf6729975de96ee25c2b0d960b7955f921f60e
SHA512

87721a777d39e3786d8911f4090d2948cceb88685b8cc8f95b134ef2d8217be0371a4f1a6286ef45943be43208d339ffb0d3f6c87768bd9ee396fbb258fb1e24
SSDEEP

24576:zqKa/D9UOSQ71YLWozrGqxfnLTxmfvswcgtCN4cXhmvXTACG6FkhQYJ3O:+x/De071ClGqhJQgi+hmUCZerJ+

Score

10^/10

mimic

Malware Config

Signatures

Detects Mimic ransomware 1 IoCs

resource	yara_rule
static1/unpack001/d7c3d9e42084f4319428f4624d8f1f9e707d758c1d95f0a6c1b39bc913fd5f8b	family_mimic

Mimic family
mimic

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/d7c3d9e42084f4319428f4624d8f1f9e707d758c1d95f0a6c1b39bc913fd5f8b

Files

19014566054.zip
.zip

Password: infected
d7c3d9e42084f4319428f4624d8f1f9e707d758c1d95f0a6c1b39bc913fd5f8b
.exe windows:6 windows x86 arch:x86

5db996f530c574ab3c34e6ed3f1396a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
Wow64RevertWow64FsRedirection
SetCurrentDirectoryW
ExitProcess
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
GetProcessHeap
CancelIo
CreateTimerQueueTimer
DeleteTimerQueue
GetQueuedCompletionStatus
PostQueuedCompletionStatus
lstrcatW
lstrcpyW
CreateIoCompletionPort
CreateTimerQueue
GetCurrentProcess
SetProcessShutdownParameters
LocalAlloc
GetCurrentThread
LocalFree
GetSystemWindowsDirectoryW
QueryDosDeviceW
SetPriorityClass
RemoveDirectoryW
GetVersionExW
K32GetProcessImageFileNameW
DuplicateHandle
CreateToolhelp32Snapshot
GetExitCodeThread
ProcessIdToSessionId
Process32NextW
K32GetProcessMemoryInfo
Process32FirstW
GetNativeSystemInfo
LoadLibraryW
Module32FirstW
GetWindowsDirectoryW
GetProcAddress
WTSGetActiveConsoleSessionId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
Module32NextW
QueryFullProcessImageNameW
K32GetMappedFileNameW
CreateFileMappingW
GetTickCount
IsWow64Process
VirtualQueryEx
GetExitCodeProcess
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetComputerNameExW
GlobalMemoryStatusEx
ReadProcessMemory
GetStdHandle
GetEnvironmentVariableW
GetFileType
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
FormatMessageW
DeleteFiber
ConvertFiberToThread
FreeLibrary
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocalTime
DeleteCriticalSection
GetFileInformationByHandle
SetFileAttributesW
GetFileAttributesW
InitializeCriticalSection
LeaveCriticalSection
SetErrorMode
CreateThread
MapViewOfFile
CreateEventA
CreateFileMappingA
ResetEvent
SetEvent
UnmapViewOfFile
ReleaseMutex
CreateMutexA
CreateMutexW
WaitForMultipleObjects
lstrcmpW
GetCurrentProcessId
Sleep
CreateEventW
WaitForSingleObject
FindClose
lstrlenW
FindNextFileW
ReadFile
FindFirstFileW
AllocConsole
GetConsoleWindow
SetConsoleCP
GetFileTime
GetDriveTypeW
FindNextVolumeW
GetSystemTime
GetVolumePathNamesForVolumeNameW
CopyFileW
SystemTimeToFileTime
FindVolumeClose
DeleteFileW
GetDiskFreeSpaceExW
ExitThread
SetFileTime
FindFirstVolumeW
GetLogicalDrives
GetVolumeInformationW
CreateDirectoryW
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
ResumeThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
lstrcmpiW
MultiByteToWideChar
lstrcpynW
GetFileSizeEx
GetModuleFileNameW
LoadLibraryExW
FindResourceW
LoadResource
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
SwitchToThread
TryEnterCriticalSection
AreFileApisANSI
GetFullPathNameW
FindFirstFileExW
GetCurrentDirectoryW
QueryPerformanceFrequency
GetStringTypeW
TerminateProcess
Wow64DisableWow64FsRedirection
EnterCriticalSection
GetCommandLineW
LockResource
CreateFileW
SizeofResource
FlushFileBuffers
MoveFileW
SetFilePointerEx
CloseHandle
GetLastError
SetEndOfFile
DeviceIoControl
WriteFile
LoadLibraryA

user32

GetMessageW
wvsprintfW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
ShowWindow
PeekMessageW
RegisterHotKey
SendMessageTimeoutW
FindWindowW
wsprintfW
PostMessageW
UnregisterHotKey

advapi32

CloseServiceHandle
RevertToSelf
GetTokenInformation
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
ConvertSidToStringSidW
SetSecurityInfo
RegGetValueW
InitializeAcl
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeNameW
RegCloseKey
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetSecurityDescriptorSacl
LookupPrivilegeValueW
QueryServiceStatusEx
DuplicateTokenEx
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
EqualSid
CreateWellKnownSid
GetUserNameW
LookupAccountSidW
OpenSCManagerW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
OpenServiceW
EnumServicesStatusW
SetThreadToken

shell32

SHEmptyRecycleBinW
SHCreateItemFromParsingName
CommandLineToArgvW

ole32

CoInitializeEx
CoTaskMemFree
CoGetObject
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

ws2_32

setsockopt
WSAGetLastError
inet_ntop
getsockopt
gethostname
inet_ntoa
WSAAddressToStringW
socket
WSAStartup
WSASocketW
send
WSASetLastError
htons
shutdown
gethostbyname
closesocket
WSAIoctl
bind
WSACleanup
recv

shlwapi

PathStripPathW
StrStrW
PathFileExistsW
PathRemoveExtensionW
PathGetArgsW
PathFindExtensionW
StrStrIA
PathRemoveFileSpecW
StrStrIW

iphlpapi

GetIpNetTable
GetAdaptersInfo

netapi32

NetShareEnum
NetApiBufferFree

mpr

WNetOpenEnumW
WNetCloseEnum
WNetGetConnectionW
WNetEnumResourceW

rstrtmgr

RmShutdown
RmStartSession
RmGetList
RmRegisterResources
RmEndSession

everything32

Everything_GetNumResults
Everything_SetRequestFlags
Everything_Exit
Everything_CleanUp
Everything_GetLastError
Everything_QueryW
Everything_GetResultFullPathNameW
Everything_SetSearchW
Everything_SetSort
Everything_DeleteRunHistory
Everything_IsDBLoaded
Everything_GetResultSize

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 465KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 257KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

5db996f530c574ab3c34e6ed3f1396a6

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

ws2_32

shlwapi

iphlpapi

netapi32

mpr

rstrtmgr

everything32

bcrypt

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 465KB - Virtual size: 464KB

.data Size: 15KB - Virtual size: 39KB

.rsrc Size: 257KB - Virtual size: 256KB

.reloc Size: 68KB - Virtual size: 67KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 465KB - Virtual size: 464KB

.data
Size: 15KB - Virtual size: 39KB

.rsrc
Size: 257KB - Virtual size: 256KB

.reloc
Size: 68KB - Virtual size: 67KB