mimic | 2026-03-03_7889d3b3fcadd142d55ce26e0ceef3db_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_mimic_mimic-ransomware_njrat_revil

Sharing

Copy URL Twitter E-mail

General

Target
2026-03-03_7889d3b3fcadd142d55ce26e0ceef3db_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_mimic_mimic-ransomware_njrat_revil
Size 2.1MB
Sample260303-dkq8bsav2c
SHA256 c731ac869d3af96aa66cc27af20eae89fd9e4717830ca2017c20e3c15b3669d9
MD5 7889d3b3fcadd142d55ce26e0ceef3db
SHA1 3d9bde398e181c7450587c9ad6ed79888c36dd07
SHA512 8802a0830768537944f07cdb9eb8c80d007d49575e01e4916421b81e70208bcc0edce32d9a5404d0e166b53dd42806bb09cff9b05ad4272ada8702cd12a155eb
SSDEEP 49152:+iPH/79yjEUmHhak4M/BRMtPZGvKuRInyn+0:+iPH/pnBZ4M5RMT1+
TLSH
T15AA5D002FBC28172F1934634917AAB7F897ABB209734C6D787D00D699D312C2663F7A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimic

Malware Config

Signatures

Detects Mimic ransomware 1 IoCs

resource	yara_rule
sample	family_mimic

Mimic family
mimic

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-03_7889d3b3fcadd142d55ce26e0ceef3db_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_mimic_mimic-ransomware_njrat_revil

File Explorer

2026-03-03_7889d3b3fcadd142d55ce26e0ceef3db_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_mimic_mimic-ransomware_njrat_revil

.exe 2.1MB

2026-03-03_7889d3b3fcadd142d55ce26e0ceef3db_amadey_coinminer_elex_glassworm_luca-stealer_lynx_medusalocker_mimic_mimic-ransomware_njrat_revil

IMPHASH 0d09039245fc6c3f7915bc4580e2f31b
SHA256 c731ac869d3af96aa66cc27af20eae89fd9e4717830ca2017c20e3c15b3669d9
MD5 7889d3b3fcadd142d55ce26e0ceef3db
SHA1 3d9bde398e181c7450587c9ad6ed79888c36dd07
SHA512 8802a0830768537944f07cdb9eb8c80d007d49575e01e4916421b81e70208bcc0edce32d9a5404d0e166b53dd42806bb09cff9b05ad4272ada8702cd12a155eb
SSDEEP 49152:+iPH/79yjEUmHhak4M/BRMtPZGvKuRInyn+0:+iPH/pnBZ4M5RMT1+
TLSH
T15AA5D002FBC28172F1934634917AAB7F897ABB209734C6D787D00D699D312C2663F7A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Mimic ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1241945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CancelIo CreateTimerQueueTimer DeleteTimerQueue GetQueuedCompletionStatus PostQueuedCompletionStatus lstrcatW lstrcpyW CreateIoCompletionPort CreateTimerQueue GetCurrentProcess SetProcessShutdownParameters LocalAlloc GetCurrentThread LocalFree GetSystemWindowsDirectoryW QueryDosDeviceW FindFirstFileW SetPriorityClass FindNextFileW TerminateProcess RemoveDirectoryW FindClose GetVersionExW K32GetProcessImageFileNameW DuplicateHandle CreateToolhelp32Snapshot GetExitCodeThread ProcessIdToSessionId Process32NextW K32GetProcessMemoryInfo Process32FirstW GetNativeSystemInfo LoadLibraryW Module32FirstW GetWindowsDirectoryW GetProcAddress WTSGetActiveConsoleSessionId CreateProcessW GetModuleHandleW CreateRemoteThread Module32NextW QueryFullProcessImageNameW K32GetMappedFileNameW CreateFileMappingW GetTickCount lstrcmpW IsWow64Process VirtualQueryEx InitializeCriticalSectionEx RaiseException DecodePointer GetComputerNameExW GlobalMemoryStatusEx ReadProcessMemory GetStdHandle GetEnvironmentVariableW GetFileType SetLastError InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW DeleteFiber ConvertFiberToThread FreeLibrary LoadLibraryA GetConsoleMode SetConsoleMode SetCurrentDirectoryW ReadConsoleW WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID Wow64RevertWow64FsRedirection Sleep OpenProcess Wow64DisableWow64FsRedirection GetCommandLineW WideCharToMultiByte GetLocalTime DeleteCriticalSection GetFileInformationByHandle SetFileAttributesW GetProcessHeap InitializeCriticalSection LeaveCriticalSection EnterCriticalSection CreateThread MapViewOfFile CreateEventA CreateFileMappingA ResetEvent SetEvent CreateEventW UnmapViewOfFile ReleaseMutex WaitForSingleObject CreateMutexA CreateMutexW WaitForMultipleObjects AllocConsole GetConsoleWindow SetConsoleCP GetFileTime ReadFile GetDriveTypeW FindNextVolumeW GetSystemTime GetVolumePathNamesForVolumeNameW CopyFileW SystemTimeToFileTime FindVolumeClose SetVolumeMountPointW GetDiskFreeSpaceExW ExitThread SetFileTime lstrlenW FindFirstVolumeW GetLogicalDrives GetVolumeInformationW CreateDirectoryW IsValidLocale GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler ExitProcess ResumeThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore lstrcmpiW MultiByteToWideChar CreateFileW GetFileSizeEx GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource VirtualFree VirtualProtect VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer SwitchToThread TryEnterCriticalSection AreFileApisANSI GetFullPathNameW HeapAlloc HeapFree GetFileAttributesW FindFirstFileExW GetCurrentDirectoryW QueryPerformanceFrequency GetStringTypeW GetCurrentProcessId LockResource SizeofResource FlushFileBuffers MoveFileW SetFilePointerEx CloseHandle DeleteFileW GetLastError SetEndOfFile DeviceIoControl WriteFile ReadConsoleA

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMessageW UnregisterHotKey PostMessageW ShowWindow PeekMessageW RegisterHotKey wvsprintfW wsprintfW

advapi32

RegGetValueW RevertToSelf GetTokenInformation OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW ConvertSidToStringSidW SetSecurityInfo InitializeAcl OpenProcessToken RegSetValueExW RegCreateKeyExW LookupPrivilegeNameW RegCloseKey GetSecurityDescriptorDacl AdjustTokenPrivileges GetSecurityDescriptorSacl LookupPrivilegeValueW QueryServiceStatusEx DuplicateTokenEx EnumServicesStatusW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource EqualSid CreateWellKnownSid GetUserNameW LookupAccountSidW CloseServiceHandle OpenSCManagerW ControlService EnumDependentServicesW ChangeServiceConfigW OpenServiceW SetThreadToken

shell32

SHEmptyRecycleBinW SHCreateItemFromParsingName CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoGetObject CoCreateInstance CoInitialize CoSetProxyBlanket CoUninitialize CoInitializeSecurity

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

ws2_32

inet_ntop htons setsockopt WSAGetLastError gethostname recv inet_ntoa WSAAddressToStringW socket WSAStartup WSASocketW shutdown gethostbyname send WSASetLastError getsockopt closesocket WSAIoctl bind WSACleanup

shlwapi

PathStripPathW StrStrW PathFileExistsW PathRemoveExtensionW PathGetArgsW PathFindExtensionW StrStrIA PathRemoveFileSpecW StrStrIW

iphlpapi

GetIpNetTable GetAdaptersInfo

netapi32

NetShareEnum NetApiBufferFree

mpr

WNetGetConnectionW WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

rstrtmgr

RmRegisterResources RmGetList RmShutdown RmStartSession RmEndSession

everything32

Everything_GetNumResults Everything_SetRequestFlags Everything_Exit Everything_CleanUp Everything_GetLastError Everything_QueryW Everything_GetResultFullPathNameW Everything_SetSearchW Everything_GetResultSize Everything_DeleteRunHistory Everything_IsDBLoaded Everything_SetSort

bcrypt

BCryptGenRandom