mimikatz | 2026-08-25_f201b5d8e2ba212286805f59f04bac5a_cobalt-strike_glassworm_hacktools_icedid_mimikatz_njrat_qilin_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_f201b5d8e2ba212286805f59f04bac5a_cobalt-strike_glassworm_hacktools_icedid_mimikatz_njrat_qilin_satacom_vidar
Size 1.3MB
Sample260826-c4bfjs1gpf
SHA256 d1e79746887d79b40186da4bf7dc8f1c4071cf5496b123e9c3c6fb7f9d369959
MD5 f201b5d8e2ba212286805f59f04bac5a
SHA1 acad7fab82b28f05b5a7c3e283eadf6b2b4da535
SHA512 32f4b55b0a3824b83960b40186537874c93ca64b170703860db669142c819c333bf216871a4ce534d90ab9b3dbb3dc9ca244657bda3616946478824c38b83ce8
SSDEEP 24576:bRNCm1+tem7W0+edJIER3+CV9Y5FtrF7USZh1WDO:keR4JPLjY5FtrNpZh
TLSH
T15655495167E90098F6B75AB09EF29906DBB378D22974C34F01A88A5F1F73E518D2D332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_f201b5d8e2ba212286805f59f04bac5a_cobalt-strike_glassworm_hacktools_icedid_mimikatz_njrat_qilin_satacom_vidar

File Explorer

2026-08-25_f201b5d8e2ba212286805f59f04bac5a_cobalt-strike_glassworm_hacktools_icedid_mimikatz_njrat_qilin_satacom_vidar

.exe 1.3MB

2026-08-25_f201b5d8e2ba212286805f59f04bac5a_cobalt-strike_glassworm_hacktools_icedid_mimikatz_njrat_qilin_satacom_vidar

IMPHASH f554fa9af928f091418227822ac5d639
SHA256 d1e79746887d79b40186da4bf7dc8f1c4071cf5496b123e9c3c6fb7f9d369959
MD5 f201b5d8e2ba212286805f59f04bac5a
SHA1 acad7fab82b28f05b5a7c3e283eadf6b2b4da535
SHA512 32f4b55b0a3824b83960b40186537874c93ca64b170703860db669142c819c333bf216871a4ce534d90ab9b3dbb3dc9ca244657bda3616946478824c38b83ce8
SSDEEP 24576:bRNCm1+tem7W0+edJIER3+CV9Y5FtrF7USZh1WDO:keR4JPLjY5FtrNpZh
TLSH
T15655495167E90098F6B75AB09EF29906DBB378D22974C34F01A88A5F1F73E518D2D332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

753980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptReleaseContext CryptGenKey CryptGetProvParam CryptGetHashParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptSetHashParam CryptHashData CryptCreateHash CryptExportKey CryptDecrypt SystemFunction007 CryptDuplicateKey CryptEncrypt CryptAcquireContextW CryptGetKeyParam CryptAcquireContextA CryptDestroyKey GetLengthSid CopySid LsaClose LsaOpenPolicy LsaQueryInformationPolicy CreateWellKnownSid CreateProcessAsUserW CreateProcessWithLogonW RegQueryValueExW RegEnumValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey SystemFunction032 ConvertSidToStringSidW QueryServiceObjectSecurity QueryServiceStatusEx BuildSecurityDescriptorW OpenServiceW StartServiceW FreeSid ControlService SetServiceObjectSecurity DeleteService AllocateAndInitializeSid OpenSCManagerW CloseServiceHandle CreateServiceW IsTextUnicode GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership OpenProcessToken CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory IsValidSid GetSidSubAuthority GetSidSubAuthorityCount SetThreadToken SystemFunction006 CryptEnumProviderTypesW CryptGetUserKey OpenEventLogW ClearEventLogW GetNumberOfEventLogRecords CryptSignHashW LsaRetrievePrivateData LsaOpenSecret LsaQueryTrustedDomainInfoByName CryptDeriveKey LsaQuerySecret SystemFunction001 SystemFunction005 SystemFunction013 LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus OpenThreadToken LookupPrivilegeNameW CredFree CredEnumerateW SystemFunction025 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction024 CredUnmarshalCredentialW CredIsMarshaledCredentialW A_SHAInit A_SHAFinal A_SHAUpdate

cabinet

ord14 ord10 ord13 ord11

crypt32

CertGetNameStringW CryptQueryObject CertEnumCertificatesInStore CertAddCertificateContextToStore CertEnumSystemStore CertAddEncodedCertificateToStore CertFreeCertificateContext CertCloseStore PFXExportCertStoreEx CertSetCertificateContextProperty CertOpenStore CryptUnprotectData CryptBinaryToStringW CryptBinaryToStringA CryptStringToBinaryW CryptAcquireCertificatePrivateKey CryptExportPublicKeyInfo CryptFindOIDInfo CryptSignAndEncodeCertificate CertNameToStrW CryptEncodeObject CertFindCertificateInStore CertGetCertificateContextProperty CryptProtectData CryptDecodeObjectEx CryptStringToBinaryA

cryptdll

MD5Update MD5Init MD5Final CDLocateCheckSum CDLocateCSystem CDGenerateRandomBits

dnsapi

DnsQuery_A DnsFree

fltlib

FilterFindFirst FilterFindNext

netapi32

DsEnumerateDomainTrustsW NetServerGetInfo NetRemoteTOD NetSessionEnum NetStatisticsGet NetShareEnum NetWkstaUserEnum NetApiBufferFree DsGetDcNameW I_NetServerAuthenticate2 I_NetServerReqChallenge I_NetServerTrustPasswordsGet

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantInit

rpcrt4

RpcMgmtEpEltInqBegin RpcMgmtEpEltInqDone UuidCreate RpcEpResolveBinding I_RpcGetCurrentCallHandle NdrServerCall2 NdrClientCall2 I_RpcBindingInqSecurityContext RpcMgmtEpEltInqNextW RpcServerInqBindings RpcBindingInqAuthClientW RpcBindingSetOption RpcBindingFromStringBindingW RpcStringBindingComposeW RpcBindingSetAuthInfoExW RpcStringFreeW MesHandleFree RpcImpersonateClient RpcRevertToSelf MesEncodeIncrementalHandleCreate MesDecodeIncrementalHandleCreate RpcBindingFree RpcMgmtStopServerListening MesIncrementalHandleReset NdrMesTypeEncode2 NdrMesTypeDecode2 NdrMesTypeFree2 NdrMesTypeAlignSize2 RpcBindingVectorFree RpcServerUseProtseqEpW RpcServerUnregisterIfEx RpcBindingToStringBindingW UuidToStringW RpcServerRegisterIf2 RpcMgmtWaitServerListen RpcServerListen RpcServerRegisterAuthInfoW RpcEpUnregister RpcEpRegisterW

shlwapi

PathCombineW PathCanonicalizeW PathIsRelativeW PathFindFileNameW PathIsDirectoryW

samlib

SamOpenUser SamOpenGroup SamSetInformationUser SamQueryInformationUser SamFreeMemory SamLookupDomainInSamServer SamCloseHandle SamConnect SamLookupIdsInDomain SamiChangePasswordUser SamRidToSid SamOpenAlias SamGetAliasMembership SamEnumerateGroupsInDomain SamGetMembersInGroup SamGetMembersInAlias SamGetGroupsForUser SamEnumerateDomainsInSamServer SamOpenDomain SamLookupNamesInDomain SamEnumerateUsersInDomain SamEnumerateAliasesInDomain

secur32

LsaFreeReturnBuffer FreeContextBuffer QueryContextAttributesW LsaCallAuthenticationPackage LsaDeregisterLogonProcess DeleteSecurityContext AcquireCredentialsHandleW InitializeSecurityContextW FreeCredentialsHandle LsaLookupAuthenticationPackage EnumerateSecurityPackagesW LsaConnectUntrusted

shell32

CommandLineToArgvW

user32

GetKeyboardLayout IsCharAlphaNumericW SendMessageW GetClipboardSequenceNumber TranslateMessage GetClipboardData EnumClipboardFormats CloseClipboard ChangeClipboardChain DispatchMessageW OpenClipboard RegisterClassExW UnregisterClassW CreateWindowExW GetMessageW DefWindowProcW PostMessageW DestroyWindow SetClipboardViewer

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

hid

HidD_GetFeature HidD_GetAttributes HidP_GetCaps HidD_GetPreparsedData HidD_FreePreparsedData HidD_GetHidGuid HidD_SetFeature

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces

winscard

SCardDisconnect SCardConnectW SCardControl SCardListReadersW SCardListCardsW SCardReleaseContext SCardEstablishContext SCardGetAttrib SCardFreeMemory SCardTransmit SCardGetCardTypeProviderNameW

winsta

WinStationEnumerateW WinStationConnectW WinStationFreeMemory WinStationCloseServer WinStationQueryInformationW WinStationOpenServerW

wldap32

ord88 ord310 ord73 ord13 ord36 ord79 ord41 ord142 ord77 ord145 ord54 ord301 ord304 ord309 ord167 ord133 ord127 ord26 ord27 ord147 ord157 ord224 ord203 ord97 ord122 ord139 ord12 ord69 ord96 ord223 ord113 ord140 ord14 ord208

msasn1

ASN1_CreateEncoder ASN1_CloseModule ASN1_FreeEncoded ASN1BERDotVal2Eoid ASN1_CreateModule ASN1_CloseEncoder ASN1_CreateDecoder ASN1_CloseDecoder

ntdll

RtlCompressBuffer NtQueryInformationProcess NtQueryObject RtlInitUnicodeString RtlEqualUnicodeString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlUnicodeStringToAnsiString RtlFreeAnsiString RtlGetCurrentPeb RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlAppendUnicodeStringToString RtlUpcaseUnicodeString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtTerminateProcess NtSuspendProcess NtSetSystemEnvironmentValueEx NtQuerySystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW RtlGetCompressionWorkSpaceSize NtQuerySystemInformation

kernel32

GetACP IsValidCodePage FindFirstFileExW SetStdHandle GetConsoleMode GetConsoleCP LCMapStringW CompareStringW GetFileType GetModuleHandleExW TerminateProcess GetModuleFileNameW GetCommandLineW GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCurrentThreadId LoadLibraryExA SetFilePointerEx GetProcessId GetComputerNameW ProcessIdToSessionId GetCurrentThread SetConsoleCursorPosition SetCurrentDirectoryW FillConsoleOutputCharacterW GetTimeZoneInformation GetSystemDirectoryW GetStdHandle GetConsoleScreenBufferInfo SetEvent CreateEventW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection CreatePipe SetHandleInformation GetModuleHandleW GlobalSize SetFileAttributesW lstrlenA GetOEMCP ExitProcess RaiseException SetConsoleCtrlHandler GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTime FreeLibrary GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo HeapReAlloc DeleteFileW WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW MultiByteToWideChar HeapSize HeapValidate CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI GetDateFormatW GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetTimeFormatW ClearCommError PurgeComm CreateRemoteThread WaitForSingleObject SetLastError CreateProcessW SetConsoleOutputCP GetConsoleOutputCP MapViewOfFile WriteConsoleW ReadConsoleW GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW SetConsoleTitleW GetCPInfo CreateFileMappingW UnmapViewOfFile VirtualQueryEx VirtualQuery VirtualFreeEx ReadProcessMemory VirtualAllocEx VirtualProtectEx VirtualAlloc VirtualFree RtlUnwind VirtualProtect WriteProcessMemory GetComputerNameExW DeviceIoControl OpenProcess DuplicateHandle GetCurrentProcess FlushFileBuffers GetCurrentDirectoryW GetFileAttributesW FindClose ExpandEnvironmentStringsW FindNextFileW GetFileSizeEx FindFirstFileW lstrlenW FileTimeToDosDateTime GetTempFileNameA FileTimeToLocalFileTime DeleteFileA CreateFileA GetTempPathA GetFileInformationByHandle GetCurrentDirectoryA SetFilePointer LocalFree CreateThread CloseHandle TerminateThread GetLastError Sleep CreateFileW LocalAlloc WriteFile ReadFile FileTimeToSystemTime

Name

.text

Size

861KB

Virtual Size

860KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

399KB

Virtual Size

398KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_f201b5d8e2ba212286805f59f04bac5a_cobalt-strike_glassworm_hacktools_icedid_mimikatz_njrat_qilin_satacom_vidar

advapi32

cabinet

crypt32

cryptdll

dnsapi

fltlib

netapi32

ole32

oleaut32

rpcrt4

shlwapi

samlib

secur32

shell32

user32

userenv

version

hid

setupapi

winscard

winsta

wldap32

msasn1

ntdll

kernel32

generic