mimikatz | 4eb121917e29f0cb44fa3a865608cc962b3d22ef853c0f65c96fb5d41819f08b

General

Target
2026-07-08_24b2c965e5eb04a42b6118c14daf1a0d_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
Size 8.3MB
Sample260708-2j5lbsa14w
SHA256 4eb121917e29f0cb44fa3a865608cc962b3d22ef853c0f65c96fb5d41819f08b
MD5 24b2c965e5eb04a42b6118c14daf1a0d
SHA1 fbc77c909fa4518dd8d3837acf6fd5cb94695d8b
SHA512 9f177301ac564a9261ec45d3487c805dd67ef4ed96bdc47c93598372aa8f2934ff18813a3e665bd81135fabfe3cd99f3e6f13fad7359bd6c2ec3171aac8bbb34
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T15D96F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  2026-07-08_24b2c965e5eb04a42b6118c14daf1a0d_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktools_icedid_mimikatz_qilin_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_wannacry
- Size 8.3MB
- SHA256 4eb121917e29f0cb44fa3a865608cc962b3d22ef853c0f65c96fb5d41819f08b
- MD5 24b2c965e5eb04a42b6118c14daf1a0d
- SHA1 fbc77c909fa4518dd8d3837acf6fd5cb94695d8b
- SHA512 9f177301ac564a9261ec45d3487c805dd67ef4ed96bdc47c93598372aa8f2934ff18813a3e665bd81135fabfe3cd99f3e6f13fad7359bd6c2ec3171aac8bbb34
- SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
- TLSH
  T15D96F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery mimikatz installer adware persistence ransomware spyware
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- UPX dump on OEP (original entry point)
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2