General
- Target 2026-07-12_4894aa7a25b42692bdc0c0c44026342a_glassworm_mimikatz_qilin
- Size 122KB
- Sample260712-qperbaaw8j
- SHA256 f0d15b68e33bd16c97b8aed7064e6e3d6f8bf8dd6f9bbbff4240731790a969b4
- MD5 4894aa7a25b42692bdc0c0c44026342a
- SHA1 17733a3cf94464834faeddc663d7a68303445e72
- SHA512 0a85e6d5dd1c96ac11edec972c21ba97743d04e66668c2ff9da0bbffba74adedff68ca27ee1f41549eeb32b5b8ed7ef4014fc6bfa7f20379882ee3d4d458ade8
- SSDEEP 3072:QribNVa1J5Os68j2RoiKPx8YQFOXSoejiFQYUJ272oCHSp0rscd9BbXf3TrPO:QrWIXVSBbXf3TjO
- TLSH T1E8C3C5E17AD95CD9EE65623C14D6E233763CBED04A134F1BD5205A321B23FC12ED928A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-12_4894aa7a25b42692bdc0c0c44026342a_glassworm_mimikatz_qilin.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_4894aa7a25b42692bdc0c0c44026342a_glassworm_mimikatz_qilin.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-12_4894aa7a25b42692bdc0c0c44026342a_glassworm_mimikatz_qilin
- Size 122KB
- SHA256 f0d15b68e33bd16c97b8aed7064e6e3d6f8bf8dd6f9bbbff4240731790a969b4
- MD5 4894aa7a25b42692bdc0c0c44026342a
- SHA1 17733a3cf94464834faeddc663d7a68303445e72
- SHA512 0a85e6d5dd1c96ac11edec972c21ba97743d04e66668c2ff9da0bbffba74adedff68ca27ee1f41549eeb32b5b8ed7ef4014fc6bfa7f20379882ee3d4d458ade8
- SSDEEP 3072:QribNVa1J5Os68j2RoiKPx8YQFOXSoejiFQYUJ272oCHSp0rscd9BbXf3TrPO:QrWIXVSBbXf3TjO
- TLSH T1E8C3C5E17AD95CD9EE65623C14D6E233763CBED04A134F1BD5205A321B23FC12ED928A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detects ransomware indicator
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application