mimikatz | 7cff930a0cb0a131d967695c7e064a98092bf0f0f99713527c06696285b90f3a

General

Target
2026-07-06_8fca2669c59e5f45eeaa622e950ead21_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
Size 8.1MB
Sample260707-csfk5afz7v
SHA256 7cff930a0cb0a131d967695c7e064a98092bf0f0f99713527c06696285b90f3a
MD5 8fca2669c59e5f45eeaa622e950ead21
SHA1 d20a27c0273f9f40c9617825dd57fc6eeb9a20d1
SHA512 acbf1cd9e20641dc95c23566dce62033a083a481663786f23d796158652dcc1905ba66b18df302fc6d1a96835059fb0d653237ddac489997174a140d57790d0c
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T10F86F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-06_8fca2669c59e5f45eeaa622e950ead21_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
- Size 8.1MB
- SHA256 7cff930a0cb0a131d967695c7e064a98092bf0f0f99713527c06696285b90f3a
- MD5 8fca2669c59e5f45eeaa622e950ead21
- SHA1 d20a27c0273f9f40c9617825dd57fc6eeb9a20d1
- SHA512 acbf1cd9e20641dc95c23566dce62033a083a481663786f23d796158652dcc1905ba66b18df302fc6d1a96835059fb0d653237ddac489997174a140d57790d0c
- SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
- TLSH
  T10F86F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery mimikatz installer adware persistence spyware
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Custom signature
  
  UPX dump on OEP (original entry point)
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2