mimikatz | 2026-06-27_047d250c9fa1d749b989ad1e57e72f22_hacktools_mimikatz_qilin

General

Target
2026-06-27_047d250c9fa1d749b989ad1e57e72f22_hacktools_mimikatz_qilin
Size 530KB
Sample260629-mlrd6aay8v
SHA256 a498fcd797ffb3bdddcc6f0299a4936d2812f8572fed41aeb548071e1d508b06
MD5 047d250c9fa1d749b989ad1e57e72f22
SHA1 2c42ae4c285240b9453ce1cf5b0b1c944822696d
SHA512 8772af9a663f3e48e99c9cd70244f098b200a3c111cb6b33cefca374687025969fd845758328420c43f7171211f76f8b899a38bff3d1e432127d9904d86dfddd
SSDEEP 12288:4QKhhikj9dsuQqXmeXr8Zf01Mer4F3452b5s/mfa:5KhikjnsuQqWIr8Zf9e0251
TLSH
T1ACB4238FBE182863E3241D350BC4573159166F4F2AE422FA723866C828EEE71775243F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
static1/unpack001/out.upx	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
static1/unpack001/out.upx	mimikatz

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_047d250c9fa1d749b989ad1e57e72f22_hacktools_mimikatz_qilin
unpack001/out.upx

File Explorer

2026-06-27_047d250c9fa1d749b989ad1e57e72f22_hacktools_mimikatz_qilin

.exe 530KB
out.upx

.exe 1.2MB

2026-06-27_047d250c9fa1d749b989ad1e57e72f22_hacktools_mimikatz_qilin

SHA256 a498fcd797ffb3bdddcc6f0299a4936d2812f8572fed41aeb548071e1d508b06
MD5 047d250c9fa1d749b989ad1e57e72f22
SHA1 2c42ae4c285240b9453ce1cf5b0b1c944822696d
SHA512 8772af9a663f3e48e99c9cd70244f098b200a3c111cb6b33cefca374687025969fd845758328420c43f7171211f76f8b899a38bff3d1e432127d9904d86dfddd
SSDEEP 12288:4QKhhikj9dsuQqXmeXr8Zf01Mer4F3452b5s/mfa:5KhikjnsuQqWIr8Zf9e0251
TLSH
T1ACB4238FBE182863E3241D350BC4573159166F4F2AE422FA723866C828EEE71775243F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

1277264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

generic

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=63, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=47, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=634, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=99, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

out.upx

SHA256 05a46cb18f79e6b5200d8c3b013cff67fc88b8435496f27e58fdd7c2d5f85bc8
MD5 dc931e41c689b8871c2171efa32545b7
SHA1 dd369230bf81d66cf1b34deee093e684887e2a29
SHA512 ba54733cfc8843fdcab9c14d7c9db6c47bc880df6832a1a7a4c09f1cc0813074c9c157793b388ee2e15a1540f732533b0260a77785873899efe3ab25284c3651
SSDEEP 24576:sLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0Plq:sLZo1jFyjFJhmf4YlH
TLSH
T1B8452902A7E94078F1B79AB09EF29517DBB378D515B4C30F02A48A5B1F73B619939332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
UPX dump on OEP (original entry point)
mimikatz is an open source tool to dump credentials on Windows
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

773388