mimikatz | 2026-08-23_9586276aafed5b85d5bfe51aa4deaefa_glassworm_icedid_mimikatz_njrat_vidar

General

Target
2026-08-23_9586276aafed5b85d5bfe51aa4deaefa_glassworm_icedid_mimikatz_njrat_vidar
Size 1.4MB
Sample260824-ff4zqsyscv
SHA256 8b03361814a723512ee94d7d61cf8382f020c9255acf3d1e3a2b99da8acead24
MD5 9586276aafed5b85d5bfe51aa4deaefa
SHA1 2d70352524583824468b1cbdaa6ba758fc86ae77
SHA512 92200c64f5c16d7440f2f13099e6995ad5edc6cd1602ef6acc0a1881f9fba67aa2447b809b0f56312d079df8db7e17dedbb5a0a95cec01803650eba6bd16e2f9
SSDEEP 24576:gh4GctM0vcouF3IAblMqNJrTZyBpNBywcxk0oG/la0Tdaza:00ul/ZyBpNBy0G/
TLSH
T19F652911A7E90098F5B76BB1DEB2A506DBB378921930C38F01A88A5F1F73F515D29732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_9586276aafed5b85d5bfe51aa4deaefa_glassworm_icedid_mimikatz_njrat_vidar

File Explorer

2026-08-23_9586276aafed5b85d5bfe51aa4deaefa_glassworm_icedid_mimikatz_njrat_vidar

.exe 1.4MB

2026-08-23_9586276aafed5b85d5bfe51aa4deaefa_glassworm_icedid_mimikatz_njrat_vidar

SHA256 8b03361814a723512ee94d7d61cf8382f020c9255acf3d1e3a2b99da8acead24
MD5 9586276aafed5b85d5bfe51aa4deaefa
SHA1 2d70352524583824468b1cbdaa6ba758fc86ae77
SHA512 92200c64f5c16d7440f2f13099e6995ad5edc6cd1602ef6acc0a1881f9fba67aa2447b809b0f56312d079df8db7e17dedbb5a0a95cec01803650eba6bd16e2f9
SSDEEP 24576:gh4GctM0vcouF3IAblMqNJrTZyBpNBywcxk0oG/la0Tdaza:00ul/ZyBpNBy0G/
TLSH
T19F652911A7E90098F5B76BB1DEB2A506DBB378921930C38F01A88A5F1F73F515D29732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

796240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

generic

count=8, id=241, version=40116,

count=140, id=243, version=40116,

count=15, id=242, version=40116,

count=1, id=199, version=41118,

count=19, id=260, version=26706,

count=8, id=259, version=26706,

count=2, id=257, version=34120,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=3, id=135, version=30729,

count=39, id=261, version=26706,

count=10, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=608, id=1, productName=Unmarked objects,

count=114, id=264, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,

Sharing