2026-04-15_f1fd8d8da682d150ba7fd857ac7c982d_glassworm_mimikatz

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-15_f1fd8d8da682d150ba7fd857ac7c982d_glassworm_mimikatz
Size 762KB
Sample260415-prct3ag12x
SHA256 97ac7ed55b31a7893e2824665124a37d4a5ed1e50ec914351601b1af30f42baa
MD5 f1fd8d8da682d150ba7fd857ac7c982d
SHA1 1ff9e0557ad3881ee5465cf1f833b6f5ece9920b
SHA512 a5219e491006e89c5fcc01fcff54408e9dff5f4548d3f542207c6c0a5188bd7815b9a9988209f68ee1c056f6fd696a1a19a24c2a57dff5a8b6db96a0cddda31f
SSDEEP 6144:VkXZDpZrETDOGTTn+/m5TzV43SDh6ADeNJdLf/JQCwfxH:VkBuvn95mCDzcRwpH
TLSH
T15DF4B5006BE95588F1B26BB59AF2E111EBB378555930C30F119CC66F2FF3A419D29B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-15_f1fd8d8da682d150ba7fd857ac7c982d_glassworm_mimikatz

File Explorer

2026-04-15_f1fd8d8da682d150ba7fd857ac7c982d_glassworm_mimikatz

.exe 762KB

2026-04-15_f1fd8d8da682d150ba7fd857ac7c982d_glassworm_mimikatz

IMPHASH bdd45496de71cf3e139357ae9be5b766
SHA256 97ac7ed55b31a7893e2824665124a37d4a5ed1e50ec914351601b1af30f42baa
MD5 f1fd8d8da682d150ba7fd857ac7c982d
SHA1 1ff9e0557ad3881ee5465cf1f833b6f5ece9920b
SHA512 a5219e491006e89c5fcc01fcff54408e9dff5f4548d3f542207c6c0a5188bd7815b9a9988209f68ee1c056f6fd696a1a19a24c2a57dff5a8b6db96a0cddda31f
SSDEEP 6144:VkXZDpZrETDOGTTn+/m5TzV43SDh6ADeNJdLf/JQCwfxH:VkBuvn95mCDzcRwpH
TLSH
T15DF4B5006BE95588F1B26BB59AF2E111EBB378555930C30F119CC66F2FF3A419D29B32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

390488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptReleaseContext CryptGenKey CryptGetProvParam CryptGetHashParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptSetHashParam CryptHashData CryptCreateHash CryptExportKey CryptDecrypt SystemFunction007 CryptDuplicateKey CryptEncrypt CryptAcquireContextW CryptGetKeyParam CryptAcquireContextA CryptDestroyKey GetLengthSid CopySid LsaClose _LsaPolOpen LsaQueryInformationPolicy CreateWellKnownSid CreateProcessAsUserW CreateProcessWithLogonW RegQueryValueExW RegEnumValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey SystemFunction032 ConvertSidToStringSidW SystemFunction033 QueryServiceObjectSecurity QueryServiceStatusEx BuildSecurityDescriptorW OpenServiceW StartServiceW FreeSid ControlService SetServiceObjectSecurity DeleteService AllocateAndInitializeSid OpenSCManagerW CloseServiceHandle CreateServiceW IsTextUnicode GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership OpenProcessToken CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory IsValidSid GetSidSubAuthority GetSidSubAuthorityCount SetThreadToken SystemFunction006 CryptEnumProviderTypesW CryptGetUserKey OpenEventLogW ClearEventLogW GetNumberOfEventLogRecords CryptSignHashW LsaRetrievePrivateData LsaOpenSecret LsaQueryTrustedDomainInfoByName CryptDeriveKey LsaQuerySecret SystemFunction001 SystemFunction005 LsaSetSecret LsaEnumerateTrustedDomainsEx SystemFunction023 LookupPrivilegeValueW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus OpenThreadToken LookupPrivilegeNameW EqualSid CredFree CredEnumerateW ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction027 SystemFunction026 SystemFunction041 CredUnmarshalCredentialW CredIsMarshaledCredentialW

cabinet

ord13 ord10 ord14 ord11

fltlib

FilterFindFirst FilterFindNext

gdi32

DeleteObject CreateFontW SelectObject

mpr

WNetCancelConnection2W WNetAddConnection2W

odbc32

ord31 ord24 ord13 ord75 ord111 ord43 ord9 ord141

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

rpcrt4

RpcBindingInqAuthClientW RpcBindingSetOption RpcBindingFromStringBindingW RpcStringBindingComposeW RpcBindingSetAuthInfoExW RpcStringFreeW MesHandleFree RpcImpersonateClient RpcRevertToSelf MesEncodeIncrementalHandleCreate MesDecodeIncrementalHandleCreate RpcBindingFree RpcServerRegisterAuthInfoW MesIncrementalHandleReset NdrMesTypeEncode2 NdrMesTypeDecode2 NdrMesTypeFree2 NdrMesTypeAlignSize2 RpcBindingVectorFree RpcServerUseProtseqEpW RpcServerUnregisterIfEx RpcBindingToStringBindingW UuidToStringW RpcServerRegisterIf2 RpcMgmtWaitServerListen RpcServerListen NdrClientCall2 NdrServerCall2 UuidCreate RpcEpResolveBinding RpcBindingSetObject I_RpcBindingInqSecurityContext RpcEpUnregister RpcEpRegisterW RpcServerInqBindings RpcMgmtStopServerListening RpcBindingSetAuthInfoW RpcMgmtEpEltInqBegin RpcMgmtEpEltInqDone RpcMgmtEpEltInqNextW I_RpcGetCurrentCallHandle

shlwapi

PathCombineW PathCanonicalizeW PathIsRelativeW UrlUnescapeW PathFindFileNameW PathIsDirectoryW

shell32

CommandLineToArgvW

user32

ReleaseDC CloseClipboard ChangeClipboardChain CreateWindowExW GetDesktopWindow DrawTextW GetClientRect GetDC GetKeyboardLayout GetClipboardSequenceNumber GetClipboardData TranslateMessage DispatchMessageW SetClipboardViewer DestroyWindow PostMessageW DefWindowProcW GetMessageW OpenClipboard RegisterClassExW UnregisterClassW SendMessageW EnumClipboardFormats IsCharAlphaNumericW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

hid

HidD_SetFeature HidD_FreePreparsedData HidD_GetFeature HidD_GetAttributes HidP_GetCaps HidD_GetPreparsedData HidD_GetHidGuid

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW

winscard

SCardTransmit SCardControl SCardListReadersW SCardGetCardTypeProviderNameW SCardListCardsW SCardReleaseContext SCardEstablishContext SCardFreeMemory SCardConnectW SCardGetAttrib SCardDisconnect

winsta

WinStationCloseServer WinStationEnumerateW WinStationFreeMemory WinStationQueryInformationW WinStationOpenServerW WinStationConnectW

msasn1

ASN1_CreateEncoder ASN1BERDotVal2Eoid ASN1_CloseEncoder ASN1_FreeEncoded ASN1_CreateModule ASN1_CloseDecoder ASN1_CreateDecoder ASN1_CloseModule

ntdll

RtlFreeAnsiString RtlUnicodeStringToAnsiString RtlFreeUnicodeString RtlDowncaseUnicodeString RtlEqualUnicodeString RtlInitUnicodeString NtQueryObject RtlGetCompressionWorkSpaceSize RtlCompressBuffer _NtQrySysInfo _NtQryProcInfo RtlGetCurrentPeb RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlAppendUnicodeStringToString RtlUpcaseUnicodeString RtlIpv6AddressToStringW RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess NtOpenDirectoryObject NtQueryDirectoryObject RtlAdjustPrivilege NtTerminateProcess NtSuspendProcess NtSetSystemEnvironmentValueEx NtQuerySystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW

kernel32

CreatePipe SetHandleInformation GlobalSize GetFileAttributesExW SetFileAttributesW GetCurrentProcessId SetConsoleTitleW GetTickCount GlobalMemoryStatusEx ExitProcess GetLocalTime GetSystemInfo RaiseException GetDiskFreeSpaceExW GetTickCount64 ExitThread GetCommandLineW SetConsoleCtrlHandler GetDateFormatW GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetTimeFormatW lstrlenA ClearCommError PurgeComm CreateRemoteThread WaitForSingleObject CreateProcessW SetConsoleOutputCP GetConsoleOutputCP MapViewOfFile CreateFileMappingW UnmapViewOfFile VirtualQueryEx VirtualQuery VirtualFreeEx _WinMemRead_ VirtualAllocEx VirtualProtectEx VirtualAlloc VirtualFree SetLastError VirtualProtect _WinMemWrite GetComputerNameExW DeviceIoControl _WinProcOpen�DeviceIoControl DuplicateHandle GetCurrentProcess FlushFileBuffers GetCurrentDirectoryW GetFileAttributesW FindClose ExpandEnvironmentStringsW FindNextFileW GetFileSizeEx FindFirstFileW lstrlenW FreeLibrary GetModuleHandleW LoadLibraryW GetModuleHandleA FileTimeToDosDateTime GetTempFileNameA FileTimeToLocalFileTime DeleteFileA CreateFileA GetTempPathA GetFileInformationByHandle GetCurrentDirectoryA SetFilePointer GetSystemDirectoryW LocalFree CreateThread CloseHandle TerminateThread GetLastError Sleep CreateFileW LocalAlloc WriteFile ReadFile FileTimeToSystemTime GetProcAddress LoadLibraryA GetTimeZoneInformation FillConsoleOutputCharacterW SetCurrentDirectoryW SetConsoleCursorPosition EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateEventW SetEvent GetStdHandle GetConsoleScreenBufferInfo GetCurrentThread ProcessIdToSessionId IsWow64Process GetComputerNameW GetProcessId SetFilePointerEx LoadLibraryExA QueryPerformanceCounter GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent

vcruntime140

memmove memcmp memcpy memset __current_exception_context __current_exception strstr strchr wcsstr wcschr wcsrchr __C_specific_handler strrchr

api-ms-win-crt-stdio-l1-1-0

getchar _setmode __stdio_common_vswscanf fgetws __p__commode __stdio_common_vfwprintf __stdio_common_vsscanf fclose _wfopen _set_fmode fflush __acrt_iob_func __stdio_common_vsprintf_s __stdio_common_vswprintf_s __stdio_common_vswprintf __stdio_common_vsprintf _fileno

api-ms-win-crt-string-l1-1-0

wcscat_s _wcsdup wcstok_s _stricmp _wcsnicmp towupper wcscpy_s _wcsicmp wcsncmp

api-ms-win-crt-heap-l1-1-0

realloc malloc _set_new_mode free

api-ms-win-crt-convert-l1-1-0

strtol strtoul _wcstoui64 wcstol wcstoul

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _seh_filter_exe _set_app_type _configure_wide_argv terminate _crt_atexit _register_onexit_function _initialize_onexit_table _get_wide_winmain_command_line _initterm _register_thread_local_exe_atexit_callback _c_exit _cexit _initterm_e _exit exit __p__wpgmptr

api-ms-win-crt-math-l1-1-0

__setusermatherr log

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-15_f1fd8d8da682d150ba7fd857ac7c982d_glassworm_mimikatz

advapi32

cabinet

fltlib

gdi32

mpr

odbc32

ole32

oleaut32

rpcrt4

shlwapi

shell32

user32

version

hid

setupapi

winscard

winsta

msasn1

ntdll

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic