mimikatz | 2026-08-07_83569dadec082d347c3c0a5982a3e158_fabookie_glassworm_hacktools_mimikatz_qilin

General

Target
2026-08-07_83569dadec082d347c3c0a5982a3e158_fabookie_glassworm_hacktools_mimikatz_qilin
Size 1.2MB
Sample260807-l43dpssekh
SHA256 371d11716fc1109fe3d633392d263342620a30e64dcdebd75225cde036623074
MD5 83569dadec082d347c3c0a5982a3e158
SHA1 0600088bbd4e7028c7b5f496881cf99d9f9b9c32
SHA512 c0d1aadd7905965844729a84d4091eec484c4c33827abc5ce43d0a88b8d3e401034ce2cff41ed61012b73a82ca7ebd24b80541d1a710e38748d66503e93f518a
SSDEEP 24576:lLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0CUNF:lLZo1jFyjFJhmf4YlH8
TLSH
T1A1554A05B7E92068F1B79AB19EF29517DBB378D51434C30F02A88A5B1F73F619929332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_83569dadec082d347c3c0a5982a3e158_fabookie_glassworm_hacktools_mimikatz_qilin

File Explorer

2026-08-07_83569dadec082d347c3c0a5982a3e158_fabookie_glassworm_hacktools_mimikatz_qilin

.exe 1.2MB

2026-08-07_83569dadec082d347c3c0a5982a3e158_fabookie_glassworm_hacktools_mimikatz_qilin

SHA256 371d11716fc1109fe3d633392d263342620a30e64dcdebd75225cde036623074
MD5 83569dadec082d347c3c0a5982a3e158
SHA1 0600088bbd4e7028c7b5f496881cf99d9f9b9c32
SHA512 c0d1aadd7905965844729a84d4091eec484c4c33827abc5ce43d0a88b8d3e401034ce2cff41ed61012b73a82ca7ebd24b80541d1a710e38748d66503e93f518a
SSDEEP 24576:lLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0CUNF:lLZo1jFyjFJhmf4YlH8
TLSH
T1A1554A05B7E92068F1B79AB19EF29517DBB378D51434C30F02A88A5B1F73F619929332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
UPX dump on OEP (original entry point)
mimikatz is an open source tool to dump credentials on Windows
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

773388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

generic

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=63, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=47, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=634, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=99, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,

Sharing