mimic | 2025-03-04_25c42f220b7608d96be0934f7a8946f5_luca-stealer_mimic-ransomware_revil

Sharing

Copy URL

Twitter E-mail

General

Target

2025-03-04_25c42f220b7608d96be0934f7a8946f5_luca-stealer_mimic-ransomware_revil
Size

2.0MB
MD5

25c42f220b7608d96be0934f7a8946f5
SHA1

4a0b7a89efc7f9136da947a91902a946f7810773
SHA256

4fca74dc19e3efc23d83111a7732cd7b2d99a79b252f7ae4ee146dd1bbfeefe5
SHA512

7bb76d146f453fc51ef9876e0233cd06c7d34416c3c947577fc337fbd191e1aff4fd109916e9561f2e14ec1720f2bf675dd37898bc306b6cd8f5191286a07eb3
SSDEEP

49152:9SPJrSDOXqWDKpMzPnwrpjKnWtPXSr+l4khj+c:9SPJrSDQqgwrp2nWtSQ4

Score

10^/10

mimic

Malware Config

Signatures

Detects Mimic ransomware 1 IoCs

resource	yara_rule
sample	family_mimic

Mimic family
mimic

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-03-04_25c42f220b7608d96be0934f7a8946f5_luca-stealer_mimic-ransomware_revil

Files

2025-03-04_25c42f220b7608d96be0934f7a8946f5_luca-stealer_mimic-ransomware_revil
.exe windows:6 windows x86 arch:x86

529e819ff6f5cfca600585c214a72488

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CancelIo
CreateTimerQueueTimer
DeleteTimerQueue
GetQueuedCompletionStatus
PostQueuedCompletionStatus
lstrcatW
lstrcpyW
CreateIoCompletionPort
CreateTimerQueue
GetCurrentProcess
SetProcessShutdownParameters
LocalAlloc
GetCurrentThread
LocalFree
GetSystemWindowsDirectoryW
QueryDosDeviceW
FindFirstFileW
SetPriorityClass
FindNextFileW
TerminateProcess
RemoveDirectoryW
FindClose
GetVersionExW
K32GetProcessImageFileNameW
DuplicateHandle
CreateToolhelp32Snapshot
GetExitCodeThread
ProcessIdToSessionId
Process32NextW
K32GetProcessMemoryInfo
Process32FirstW
GetNativeSystemInfo
LoadLibraryW
Module32FirstW
GetWindowsDirectoryW
GetProcAddress
WTSGetActiveConsoleSessionId
CreateProcessW
GetModuleHandleW
CreateRemoteThread
Module32NextW
QueryFullProcessImageNameW
K32GetMappedFileNameW
CreateFileMappingW
GetTickCount
lstrcmpW
IsWow64Process
VirtualQueryEx
InitializeCriticalSectionEx
RaiseException
DecodePointer
GetComputerNameExW
GlobalMemoryStatusEx
ReadProcessMemory
GetStdHandle
GetEnvironmentVariableW
GetFileType
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
QueryPerformanceCounter
GetSystemTimeAsFileTime
FormatMessageW
DeleteFiber
ConvertFiberToThread
FreeLibrary
LoadLibraryA
GetConsoleMode
SetConsoleMode
SetCurrentDirectoryW
ReadConsoleW
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
Wow64RevertWow64FsRedirection
Sleep
OpenProcess
Wow64DisableWow64FsRedirection
GetCommandLineW
WideCharToMultiByte
GetLocalTime
DeleteCriticalSection
GetFileInformationByHandle
SetFileAttributesW
GetProcessHeap
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateThread
MapViewOfFile
CreateEventA
CreateFileMappingA
ResetEvent
SetEvent
CreateEventW
UnmapViewOfFile
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateMutexW
WaitForMultipleObjects
AllocConsole
GetConsoleWindow
SetConsoleCP
GetFileTime
ReadFile
GetDriveTypeW
FindNextVolumeW
GetSystemTime
GetVolumePathNamesForVolumeNameW
CopyFileW
SystemTimeToFileTime
FindVolumeClose
SetVolumeMountPointW
GetDiskFreeSpaceExW
ExitThread
SetFileTime
DeviceIoControl
lstrlenW
FindFirstVolumeW
GetLogicalDrives
GetVolumeInformationW
IsValidLocale
GetConsoleOutputCP
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
ExitProcess
ResumeThread
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
VirtualProtect
VirtualAlloc
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
CreateDirectoryW
lstrcmpiW
MultiByteToWideChar
CreateFileW
GetFileSizeEx
GetModuleFileNameW
LoadLibraryExW
FindResourceW
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
SwitchToThread
TryEnterCriticalSection
AreFileApisANSI
GetFullPathNameW
HeapAlloc
HeapFree
GetFileAttributesW
FindFirstFileExW
GetCurrentDirectoryW
QueryPerformanceFrequency
GetStringTypeW
GetCurrentProcessId
LoadResource
LockResource
SizeofResource
FlushFileBuffers
MoveFileW
SetFilePointerEx
CloseHandle
DeleteFileW
GetLastError
SetEndOfFile
WriteFile
ReadConsoleA

user32

wsprintfW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
wvsprintfW
GetMessageW
UnregisterHotKey
PostMessageW
ShowWindow
PeekMessageW
RegisterHotKey

advapi32

RegGetValueW
RevertToSelf
GetTokenInformation
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteValueW
ConvertSidToStringSidW
SetSecurityInfo
InitializeAcl
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeNameW
RegCloseKey
GetSecurityDescriptorDacl
AdjustTokenPrivileges
GetSecurityDescriptorSacl
LookupPrivilegeValueW
QueryServiceStatusEx
DuplicateTokenEx
EnumServicesStatusW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
EqualSid
CreateWellKnownSid
GetUserNameW
LookupAccountSidW
CloseServiceHandle
OpenSCManagerW
ControlService
EnumDependentServicesW
ChangeServiceConfigW
OpenServiceW
SetThreadToken

shell32

CommandLineToArgvW
SHCreateItemFromParsingName
SHEmptyRecycleBinW

ole32

CoSetProxyBlanket
CoTaskMemFree
CoGetObject
CoInitializeEx
CoCreateInstance
CoInitialize
CoInitializeSecurity
CoUninitialize

oleaut32

VariantInit
SysFreeString
SysAllocString
VariantClear

shlwapi

StrStrIA
PathFileExistsW
StrStrIW
PathRemoveFileSpecW
PathStripPathW
PathFindExtensionW
PathGetArgsW
PathRemoveExtensionW
StrStrW

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

ws2_32

gethostbyname
closesocket
WSAIoctl
bind
recv
send
WSASocketW
WSAStartup
socket
WSAAddressToStringW
WSAGetLastError
setsockopt
htons
WSACleanup
shutdown
inet_ntop
getsockopt
gethostname
WSASetLastError
inet_ntoa

iphlpapi

GetIpNetTable
GetAdaptersInfo

netapi32

NetShareEnum
NetApiBufferFree

mpr

WNetGetConnectionW
WNetCloseEnum
WNetEnumResourceW
WNetOpenEnumW

rstrtmgr

RmRegisterResources
RmGetList
RmShutdown
RmStartSession
RmEndSession

everything32

Everything_GetNumResults
Everything_SetRequestFlags
Everything_Exit
Everything_CleanUp
Everything_GetLastError
Everything_QueryW
Everything_GetResultFullPathNameW
Everything_SetSearchW
Everything_GetResultSize
Everything_DeleteRunHistory
Everything_IsDBLoaded
Everything_SetSort

bcrypt

BCryptGenRandom

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 458KB - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

529e819ff6f5cfca600585c214a72488

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

crypt32

ws2_32

iphlpapi

netapi32

mpr

rstrtmgr

everything32

bcrypt

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 458KB - Virtual size: 458KB

.data Size: 14KB - Virtual size: 32KB

.rsrc Size: 7KB - Virtual size: 6KB

.reloc Size: 65KB - Virtual size: 65KB

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 458KB - Virtual size: 458KB

.data
Size: 14KB - Virtual size: 32KB

.rsrc
Size: 7KB - Virtual size: 6KB

.reloc
Size: 65KB - Virtual size: 65KB