mimic | 0eed4f8f14e639d0f6774a58aeda52e69b78c17777037312486bb92a30ada259

General

Target
2026-04-15_172bd8cc09edb66e97bdda6cf6752143_elex_mimic_pay2key_wannacry
Size 3.5MB
Sample260415-cmsnhadv8p
SHA256 0eed4f8f14e639d0f6774a58aeda52e69b78c17777037312486bb92a30ada259
MD5 172bd8cc09edb66e97bdda6cf6752143
SHA1 9f021810ce1b67500429bd0c7e3cf033b43a4c55
SHA512 1a3f7a2b17c800623b282acd1a991ae1fbc0bf1a67af9d381846da2e9037042ee3761d7fcbc685a2cb8a1676765ccdfa9d171e94d8daf71fe93044ae24feb980
SSDEEP 98304:UgwR2vguPPou2Bzg1jGE5FS3E/HrmP9Aji:UgNv25jEKU/HrmP9AO
TLSH
T19F06335273D289B3F1CA1BB3E728B6F111F5B3280F1B81C357205A256632BEAD1B5395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\BD3FDDDF-6CAF-3EBC-D9CF-C8DF72D8F78A\global_options.ini

Ransom Note

26=ELPACO-team 27=TIB;sql;sqlite;sqlite3;sqlitedb;mdf;mdb;adb;db;db3;dbf;dbs;udb;dbv;dbx;edb;exb;1cd;fdb;idb;mpd;myd;odb;xls;xlsx;doc;docx;bac;bak;back;zip;rar;dt;4dd;4dl;abcddb;abs;abx;accdb;accdc;accde;accdr;accdt;accdw;accft;ade;adf;adn;adp;alf;arc;ask;bacpac;bdf;btr;cat;cdb;chck;ckp;cma;cpd;dacpac;dad;dadiagrams;daschema;db-shm;db-wal;db2;dbc;dbt;dcb;dct;dcx;ddl;dlis;dp1;dqy;dsk;dsn;dtsx;dxl;eco;ecx;epim;fcd;fic;fm5;fmp;fmp12;fmpsl;fol;fp3;fp4;fp5;fp7;fpt;frm;gdb;grdb;gwi;hdb;his;hjt;ib;icg;icr;ihx;itdb;itw;jet;jtx;kdb;kexi;kexic;kexis;lgc;lut;lwx;maf;maq;mar;mas;mav;maw;mdn;mdt;mrg;mud;mwb;ndf;nnt;nrmlib;ns2;ns3;ns4;nsf;nv;nv2;nwdb;nyf;oqy;ora;orx;owc;p96;p97;pan;pdb;pdm;pnz;qry;qvd;rbf;rctd;rod;rodx;rpd;rsd;s2db;sas7bdat;sbf;scx;sdb;sdc;sdf;sis;sl3;spq;sqlite2;te;temx;tmd;tps;trc;trm;udl;usr;v12;vis;vpd;vvv;wdb;wmdb;wrk;xdb;xld;xmlff;7z; 28=386;cmd;deskthemepack;diagcab;diagcfg;diagpkg;dll;info;mui;sys;theme;tmp; 29=steamapps;Cache;Boot;Chrome;Firefox;Mozilla;Mozilla Firefox;MicrosoftEdge;Internet Explorer;Tor Browser;Opera;Opera Software;Common Files;Config.Msi;Intel;Microsoft;Microsoft Shared;Microsoft.NET;MSBuild;MSOCache;Packages;PerfLogs;ProgramData;System Volume Information;tmp;Temp;USOShared;Windows;Windows Defender;Windows Journal;Windows NT;Windows Photo Viewer;Windows Security;Windows.old;WindowsApps;WindowsPowerShell;WINNT;$RECYCLE.BIN;$WINDOWS.~BT;$Windows.~WS;:\Users\Public\;:\Users\Default\; 30=desktop.ini;iconcache.db;thumbs.db; 31= 32= 33=reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AllowMultipleTSSessions" /t REG_DWORD /d 0x1 /f;reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "fSingleSessionPerUser" /t REG_DWORD /d 0x0 /f;reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe" /v Debugger /t REG_SZ /d "c:\windows\system32\cmd.exe"; 34=1 35=2 36=0 37=0 38=0 39=1 40=0 41=1 42=1 43=1 44=1 45=1 46=1 47=0 48=1 49=0 50=0 51=0 53=1 54=0 55=1 56=1 57=1 58=1 59=1 60=1 61=1 62=1 63=Hello my dear friend (Do not scan the files with antivirus in any case. In case of data loss, the consequences are yours)\nYour data is encrypted\nYour decryption ID is ID_PLACEHOLDER\nUnfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\nIf you want to recover your files, write us\n1) eMail - [email protected]\n2) Telegram - @DataSupport911 or https://t.me/DataSupport911\n\nAttention!\n\nDo not rename encrypted files. \nDo not try to decrypt your data using third party software - it may cause permanent data loss. \nWe are always ready to cooperate and find the best way to solve your problem. \nThe faster you write - the more favorable conditions will be for you. \nOur company values its reputation. We give all guarantees of your files decryption. 66=1

Emails

[email protected]\n2

URLs

https://t.me/DataSupport911\n\nAttention!\n\nDo

Targets

- Target
  2026-04-15_172bd8cc09edb66e97bdda6cf6752143_elex_mimic_pay2key_wannacry
- Size 3.5MB
- SHA256 0eed4f8f14e639d0f6774a58aeda52e69b78c17777037312486bb92a30ada259
- MD5 172bd8cc09edb66e97bdda6cf6752143
- SHA1 9f021810ce1b67500429bd0c7e3cf033b43a4c55
- SHA512 1a3f7a2b17c800623b282acd1a991ae1fbc0bf1a67af9d381846da2e9037042ee3761d7fcbc685a2cb8a1676765ccdfa9d171e94d8daf71fe93044ae24feb980
- SSDEEP 98304:UgwR2vguPPou2Bzg1jGE5FS3E/HrmP9Aji:UgNv25jEKU/HrmP9AO
- TLSH
  T19F06335273D289B3F1CA1BB3E728B6F111F5B3280F1B81C357205A256632BEAD1B5395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery mimic persistence ransomware
- Detects Mimic ransomware
- Family: Mimic
  Ransomware family was first exploited in the wild in 2022.
  ransomware mimic
- Clears Windows event logs
  defense_evasion ransomware
- Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
- Detects command variations typically used by ransomware
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r
- Detects executables containing commands for clearing Windows Event Logs
- Detects executables packed with ConfuserEx Mod
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer
  Detects ConfuserEx .NET packer.
behavioral1 behavioral2