mimikatz | 2026-07-03_90e5f0a7f8ee41f4bb69970ce6720555_glassworm_hacktools_mimikatz_qilin

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_90e5f0a7f8ee41f4bb69970ce6720555_glassworm_hacktools_mimikatz_qilin
Size 1.4MB
Sample260703-s948tact2x
SHA256 9b8f8c4ec8aa53c2a201bc613c033930bca576a1d99ec0b2c5cc275c0de4adaa
MD5 90e5f0a7f8ee41f4bb69970ce6720555
SHA1 c68d6e2f6b5ce0f7dfdf9b54593a0e7e38dad08c
SHA512 743703c746a407a44f7c6934dac9ded463ca0b7bb7dc2efa349bb2f84ada987d888afc757e948303882262c5aba9137760dbcbeebf9d812119c77315d534efd8
SSDEEP 24576:6fga0McLH5kU2t/HlncQqX+ze1IvP/sK6os2Gk+1KRZn:6fGMNJpHlcpa0IvP/sK6b2Gjm
TLSH
T19F65175267E91098F1B76BB19EF29506DBB378D21830C34F01A88A5F1F73A619D2D732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_90e5f0a7f8ee41f4bb69970ce6720555_glassworm_hacktools_mimikatz_qilin

File Explorer

2026-07-03_90e5f0a7f8ee41f4bb69970ce6720555_glassworm_hacktools_mimikatz_qilin

.exe 1.4MB

2026-07-03_90e5f0a7f8ee41f4bb69970ce6720555_glassworm_hacktools_mimikatz_qilin

SHA256 9b8f8c4ec8aa53c2a201bc613c033930bca576a1d99ec0b2c5cc275c0de4adaa
MD5 90e5f0a7f8ee41f4bb69970ce6720555
SHA1 c68d6e2f6b5ce0f7dfdf9b54593a0e7e38dad08c
SHA512 743703c746a407a44f7c6934dac9ded463ca0b7bb7dc2efa349bb2f84ada987d888afc757e948303882262c5aba9137760dbcbeebf9d812119c77315d534efd8
SSDEEP 24576:6fga0McLH5kU2t/HlncQqX+ze1IvP/sK6os2Gk+1KRZn:6fGMNJpHlcpa0IvP/sK6b2Gjm
TLSH
T19F65175267E91098F1B76BB19EF29506DBB378D21830C34F01A88A5F1F73A619D2D732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1446128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

868KB

Virtual Size

868KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

426KB

Virtual Size

425KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

29KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.stub

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_90e5f0a7f8ee41f4bb69970ce6720555_glassworm_hacktools_mimikatz_qilin

generic