mimic | 2025-10-20_704a45264d8ebc808f249c72a6d67268_amadey_coinminer_elex_luca-stealer_lynx_mimic-ransomware_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2025-10-20_704a45264d8ebc808f249c72a6d67268_amadey_coinminer_elex_luca-stealer_lynx_mimic-ransomware_njrat_revil
Size 2.3MB
Sample251020-lrpxvasmck
SHA256 050f723c8c6d4b5e8386c4b2f1b63824f76d78a1b0c1954ccb940bf4516541e9
MD5 704a45264d8ebc808f249c72a6d67268
SHA1 5e8115a8874a5375b9c9d34d53c9010219254fd3
SHA512 2cbf9c774d5df9d945a1d54ea561465dd7a8fc09627e34de1de8a42139cf8daa72b1750b7a5afde592f733ac202d2069e749e2f1e96bf19ae6ff11e446a642e4
SSDEEP 49152:ElhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCro7JVUfAnuwx9k484:ElhRuiVhG/o80ny2CnZGaHCMFSfAnuw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mimic

Malware Config

Signatures

Detects Mimic ransomware 1 IoCs

resource	yara_rule
sample	family_mimic

Mimic family
mimic

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2025-10-20_704a45264d8ebc808f249c72a6d67268_amadey_coinminer_elex_luca-stealer_lynx_mimic-ransomware_njrat_revil

File Explorer

2025-10-20_704a45264d8ebc808f249c72a6d67268_amadey_coinminer_elex_luca-stealer_lynx_mimic-ransomware_njrat_revil

.exe 2.3MB

2025-10-20_704a45264d8ebc808f249c72a6d67268_amadey_coinminer_elex_luca-stealer_lynx_mimic-ransomware_njrat_revil

IMPHASH 5db996f530c574ab3c34e6ed3f1396a6
SHA256 050f723c8c6d4b5e8386c4b2f1b63824f76d78a1b0c1954ccb940bf4516541e9
MD5 704a45264d8ebc808f249c72a6d67268
SHA1 5e8115a8874a5375b9c9d34d53c9010219254fd3
SHA512 2cbf9c774d5df9d945a1d54ea561465dd7a8fc09627e34de1de8a42139cf8daa72b1750b7a5afde592f733ac202d2069e749e2f1e96bf19ae6ff11e446a642e4
SSDEEP 49152:ElhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCro7JVUfAnuwx9k484:ElhRuiVhG/o80ny2CnZGaHCMFSfAnuw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects Mimic ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1276327

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess Wow64RevertWow64FsRedirection SetCurrentDirectoryW ExitProcess SetUnhandledExceptionFilter HeapFree HeapAlloc GetProcessHeap CancelIo CreateTimerQueueTimer DeleteTimerQueue GetQueuedCompletionStatus PostQueuedCompletionStatus lstrcatW lstrcpyW CreateIoCompletionPort CreateTimerQueue GetCurrentProcess SetProcessShutdownParameters LocalAlloc GetCurrentThread LocalFree GetSystemWindowsDirectoryW QueryDosDeviceW SetPriorityClass RemoveDirectoryW GetVersionExW K32GetProcessImageFileNameW DuplicateHandle CreateToolhelp32Snapshot GetExitCodeThread ProcessIdToSessionId Process32NextW K32GetProcessMemoryInfo Process32FirstW GetNativeSystemInfo LoadLibraryW Module32FirstW GetWindowsDirectoryW GetProcAddress WTSGetActiveConsoleSessionId CreateProcessW GetModuleHandleW CreateRemoteThread Module32NextW QueryFullProcessImageNameW K32GetMappedFileNameW CreateFileMappingW GetTickCount IsWow64Process VirtualQueryEx GetExitCodeProcess InitializeCriticalSectionEx RaiseException DecodePointer GetComputerNameExW GlobalMemoryStatusEx ReadProcessMemory GetStdHandle GetEnvironmentVariableW GetFileType SetLastError InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW DeleteFiber ConvertFiberToThread FreeLibrary WideCharToMultiByte GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocalTime DeleteCriticalSection GetFileInformationByHandle SetFileAttributesW GetFileAttributesW InitializeCriticalSection LeaveCriticalSection SetErrorMode CreateThread MapViewOfFile CreateEventA CreateFileMappingA ResetEvent SetEvent UnmapViewOfFile ReleaseMutex CreateMutexA CreateMutexW WaitForMultipleObjects lstrcmpW GetCurrentProcessId Sleep CreateEventW WaitForSingleObject FindClose lstrlenW FindNextFileW ReadFile FindFirstFileW AllocConsole GetConsoleWindow SetConsoleCP GetFileTime GetDriveTypeW FindNextVolumeW GetSystemTime GetVolumePathNamesForVolumeNameW CopyFileW SystemTimeToFileTime FindVolumeClose DeleteFileW GetDiskFreeSpaceExW ExitThread SetFileTime FindFirstVolumeW GetLogicalDrives GetVolumeInformationW CreateDirectoryW GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler ResumeThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect lstrcmpiW MultiByteToWideChar lstrcpynW GetFileSizeEx GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer SwitchToThread TryEnterCriticalSection AreFileApisANSI GetFullPathNameW FindFirstFileExW GetCurrentDirectoryW QueryPerformanceFrequency GetStringTypeW TerminateProcess Wow64DisableWow64FsRedirection EnterCriticalSection GetCommandLineW LockResource CreateFileW SizeofResource FlushFileBuffers MoveFileW SetFilePointerEx CloseHandle GetLastError SetEndOfFile DeviceIoControl WriteFile LoadLibraryA

user32

GetMessageW wvsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxW ShowWindow PeekMessageW RegisterHotKey SendMessageTimeoutW FindWindowW wsprintfW PostMessageW UnregisterHotKey

advapi32

CloseServiceHandle RevertToSelf GetTokenInformation OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW ConvertSidToStringSidW SetSecurityInfo RegGetValueW InitializeAcl OpenProcessToken RegSetValueExW RegCreateKeyExW LookupPrivilegeNameW RegCloseKey GetSecurityDescriptorDacl AdjustTokenPrivileges GetSecurityDescriptorSacl LookupPrivilegeValueW QueryServiceStatusEx DuplicateTokenEx CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource EqualSid CreateWellKnownSid GetUserNameW LookupAccountSidW OpenSCManagerW ControlService EnumDependentServicesW ChangeServiceConfigW OpenServiceW EnumServicesStatusW SetThreadToken

shell32

SHEmptyRecycleBinW SHCreateItemFromParsingName CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoGetObject CoCreateInstance CoInitialize CoInitializeSecurity CoUninitialize CoSetProxyBlanket

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

ws2_32

setsockopt WSAGetLastError inet_ntop getsockopt gethostname inet_ntoa WSAAddressToStringW socket WSAStartup WSASocketW send WSASetLastError htons shutdown gethostbyname closesocket WSAIoctl bind WSACleanup recv

shlwapi

PathStripPathW StrStrW PathFileExistsW PathRemoveExtensionW PathGetArgsW PathFindExtensionW StrStrIA PathRemoveFileSpecW StrStrIW

iphlpapi

GetIpNetTable GetAdaptersInfo

netapi32

NetShareEnum NetApiBufferFree

mpr

WNetOpenEnumW WNetCloseEnum WNetGetConnectionW WNetEnumResourceW

rstrtmgr

RmShutdown RmStartSession RmGetList RmRegisterResources RmEndSession

everything32

Everything_GetNumResults Everything_SetRequestFlags Everything_Exit Everything_CleanUp Everything_GetLastError Everything_QueryW Everything_GetResultFullPathNameW Everything_SetSearchW Everything_SetSort Everything_DeleteRunHistory Everything_IsDBLoaded Everything_GetResultSize

bcrypt

BCryptGenRandom