mimic | 6c62da469a894fa0a40c6e3b6d9f8b5dc8ea7a03b82879e4627435c9fa748963

General

Target
2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry
Size 3.0MB
Sample260413-te8hesfv5y
SHA256 6c62da469a894fa0a40c6e3b6d9f8b5dc8ea7a03b82879e4627435c9fa748963
MD5 9f95431f1ee85dab9e7cccce4411cb77
SHA1 67802367dbd0d7666f6618a65aaa229d28fea3ae
SHA512 f0b149d901fb00004492ef69332fbce31e3628afd4066e8ded53f7fba6ff52a08467b03048bd5732337f19233e60395b37b3e902d14418d2ee8a773cd586b84f
SSDEEP 98304:wgwRivguPPMqOVhThtsxrelreBpJqCB111XH:wgLvIVh0xreUcCjb3
TLSH
T17FE5331276EB0AB1D0D21AF2179C573B1EF8B6251B1A0BE7879065234B313C66B783DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-04-13_9f95431f1ee85dab9e7cccce4411cb77_elex_mimic_pay2key_wannacry
- Size 3.0MB
- SHA256 6c62da469a894fa0a40c6e3b6d9f8b5dc8ea7a03b82879e4627435c9fa748963
- MD5 9f95431f1ee85dab9e7cccce4411cb77
- SHA1 67802367dbd0d7666f6618a65aaa229d28fea3ae
- SHA512 f0b149d901fb00004492ef69332fbce31e3628afd4066e8ded53f7fba6ff52a08467b03048bd5732337f19233e60395b37b3e902d14418d2ee8a773cd586b84f
- SSDEEP 98304:wgwRivguPPMqOVhThtsxrelreBpJqCB111XH:wgLvIVh0xreUcCjb3
- TLSH
  T17FE5331276EB0AB1D0D21AF2179C573B1EF8B6251B1A0BE7879065234B313C66B783DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution mimic persistence ransomware
- Detects Mimic ransomware
- Family: Mimic
  Ransomware family was first exploited in the wild in 2022.
  ransomware mimic
- Custom signature
  
  Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Custom signature
  
  Detects command variations typically used by ransomware
- Custom signature
  
  Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
- Custom signature
  
  Detects executables containing commands for clearing Windows Event Logs
- Custom signature
  
  Detects executables packed with ConfuserEx Mod
- Renames multiple (84) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1 behavioral2