mimikatz | 2026-08-25_968555e36b32a99e411bf8da0c2372fc_glassworm_icedid_mimikatz_njrat_vidar

General

Target
2026-08-25_968555e36b32a99e411bf8da0c2372fc_glassworm_icedid_mimikatz_njrat_vidar
Size 1.3MB
Sample260826-t734easfle
SHA256 b1cc52d418d9c046a0bce15882df692ba9f95f188dd4049c059f3a0b191a4aa5
MD5 968555e36b32a99e411bf8da0c2372fc
SHA1 72341635318729b1270bf7b41a5b83de12fc6fe7
SHA512 3abb930e620d8b9b7faba0d6fc34f0a409e4040fe241379ab4ad23bcfd844fc1689938993db1f363604e2fa4d8edf0f2e927422d8e4d853d58c1be0b0c7f687e
SSDEEP 24576:nGi0LNiTp3w1bThVzbD9CJ+/vFYC8ZoXX0NZ3T8oIm7J/y:uCpCbHF+Sn0NZpIm7
TLSH
T11F553A51A3E80198F5B79BB5CAB29506DBB378921930C34F02A8CA5F1F73B515E2D732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_968555e36b32a99e411bf8da0c2372fc_glassworm_icedid_mimikatz_njrat_vidar

File Explorer

2026-08-25_968555e36b32a99e411bf8da0c2372fc_glassworm_icedid_mimikatz_njrat_vidar

.exe 1.3MB

2026-08-25_968555e36b32a99e411bf8da0c2372fc_glassworm_icedid_mimikatz_njrat_vidar

SHA256 b1cc52d418d9c046a0bce15882df692ba9f95f188dd4049c059f3a0b191a4aa5
MD5 968555e36b32a99e411bf8da0c2372fc
SHA1 72341635318729b1270bf7b41a5b83de12fc6fe7
SHA512 3abb930e620d8b9b7faba0d6fc34f0a409e4040fe241379ab4ad23bcfd844fc1689938993db1f363604e2fa4d8edf0f2e927422d8e4d853d58c1be0b0c7f687e
SSDEEP 24576:nGi0LNiTp3w1bThVzbD9CJ+/vFYC8ZoXX0NZ3T8oIm7J/y:uCpCbHF+Sn0NZpIm7
TLSH
T11F553A51A3E80198F5B79BB5CAB29506DBB378921930C34F02A8CA5F1F73B515E2D732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

789912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

generic

count=8, id=241, version=40116,

count=140, id=243, version=40116,

count=15, id=242, version=40116,

count=1, id=199, version=41118,

count=19, id=260, version=26706,

count=8, id=259, version=26706,

count=2, id=257, version=34120,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=3, id=135, version=30729,

count=39, id=261, version=26706,

count=10, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=607, id=1, productName=Unmarked objects,

count=114, id=264, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,

Sharing