mimikatz | 2026-10-01_578d34424e467618a2669b5cd2d130e2_fabookie_glassworm_hacktools_mimikatz_qilin

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_578d34424e467618a2669b5cd2d130e2_fabookie_glassworm_hacktools_mimikatz_qilin
Size 1.3MB
Sample261002-rm5emazcqa
SHA256 084b808f9d9cc1d615d49b9b28c826b642a13d913b1054b738e8974fe92a91a8
MD5 578d34424e467618a2669b5cd2d130e2
SHA1 326a142cd70771ca80fad4acf41b677c64cdb930
SHA512 beab70fb6898f75f832d823a7d4d171e2203d987aa26454c0940cb1d1f155e403e7a096e60e7e38090c5a5c72ec6114c6206d6bfea86c16d876c1a9987f5149f
SSDEEP 24576:yCgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODRsG:yCI7XBE2IuF64rIlmdii
TLSH
T18F552901A7E90098F1B79AB59EF29516DBB378D61834C30F02A88A5F1F73F519D29732
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_578d34424e467618a2669b5cd2d130e2_fabookie_glassworm_hacktools_mimikatz_qilin

File Explorer

2026-10-01_578d34424e467618a2669b5cd2d130e2_fabookie_glassworm_hacktools_mimikatz_qilin

.exe 1.3MB

2026-10-01_578d34424e467618a2669b5cd2d130e2_fabookie_glassworm_hacktools_mimikatz_qilin

IMPHASH 55ee500bb4bdfc49f27a98ae456d8edf
SHA256 084b808f9d9cc1d615d49b9b28c826b642a13d913b1054b738e8974fe92a91a8
MD5 578d34424e467618a2669b5cd2d130e2
SHA1 326a142cd70771ca80fad4acf41b677c64cdb930
SHA512 beab70fb6898f75f832d823a7d4d171e2203d987aa26454c0940cb1d1f155e403e7a096e60e7e38090c5a5c72ec6114c6206d6bfea86c16d876c1a9987f5149f
SSDEEP 24576:yCgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODRsG:yCI7XBE2IuF64rIlmdii
TLSH
T18F552901A7E90098F1B79AB59EF29516DBB378D61834C30F02A88A5F1F73F519D29732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

825576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction033 SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory GetSidSubAuthority GetSidSubAuthorityCount IsValidSid SetThreadToken CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaSetSecret SystemFunction023 LsaOpenSecret LsaQuerySecret LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW LookupPrivilegeNameW OpenThreadToken EqualSid CredFree CredEnumerateW SystemFunction026 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction027 SystemFunction041 CredIsMarshaledCredentialW CredUnmarshalCredentialW A_SHAFinal A_SHAInit A_SHAUpdate

cabinet

ord11 ord14 ord10 ord13

crypt32

CryptSignAndEncodeCertificate CertEnumSystemStore CertEnumCertificatesInStore CertAddCertificateContextToStore CryptDecodeObjectEx CryptStringToBinaryA CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CryptStringToBinaryW CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptBinaryToStringA CryptExportPublicKeyInfo CryptFindOIDInfo CryptAcquireCertificatePrivateKey CertNameToStrW CertFindCertificateInStore CertGetCertificateContextProperty CertGetNameStringW CryptEncodeObject CryptProtectData CryptQueryObject

cryptdll

MD5Init MD5Final CDLocateCSystem CDGenerateRandomBits CDLocateCheckSum MD5Update

dnsapi

DnsFree DnsQuery_A

fltlib

FilterFindFirst FilterFindNext

mpr

WNetCancelConnection2W WNetAddConnection2W

netapi32

NetStatisticsGet DsGetDcNameW NetApiBufferFree NetRemoteTOD NetSessionEnum NetServerGetInfo DsEnumerateDomainTrustsW NetShareEnum NetWkstaUserEnum I_NetServerAuthenticate2 I_NetServerTrustPasswordsGet I_NetServerReqChallenge

odbc32

ord75 ord9 ord43 ord24 ord31 ord111 ord141 ord13

ole32

CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoUninitialize CoCreateInstance

oleaut32

SysAllocString VariantInit SysFreeString VariantClear

rpcrt4

RpcBindingFree RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW RpcEpUnregister NdrServerCall2 NdrClientCall2 UuidCreate RpcEpResolveBinding RpcBindingSetObject RpcBindingSetAuthInfoW RpcMgmtEpEltInqDone RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle

shlwapi

UrlUnescapeW PathIsDirectoryW PathFindFileNameW PathIsRelativeW PathCombineW PathCanonicalizeW

samlib

SamEnumerateAliasesInDomain SamQueryInformationUser SamCloseHandle SamEnumerateDomainsInSamServer SamFreeMemory SamEnumerateUsersInDomain SamOpenUser SamLookupDomainInSamServer SamLookupNamesInDomain SamLookupIdsInDomain SamOpenDomain SamConnect SamSetInformationUser SamiChangePasswordUser SamEnumerateGroupsInDomain SamGetGroupsForUser SamGetMembersInGroup SamGetMembersInAlias SamRidToSid SamGetAliasMembership SamOpenGroup SamOpenAlias

secur32

FreeContextBuffer LsaLookupAuthenticationPackage LsaFreeReturnBuffer LsaDeregisterLogonProcess QueryContextAttributesW InitializeSecurityContextW AcquireCredentialsHandleW EnumerateSecurityPackagesW FreeCredentialsHandle DeleteSecurityContext LsaCallAuthenticationPackage LsaConnectUntrusted

shell32

CommandLineToArgvW

user32

SetClipboardViewer DefWindowProcW GetClipboardSequenceNumber OpenClipboard CreateWindowExW GetClipboardData RegisterClassExW TranslateMessage EnumClipboardFormats PostMessageW DispatchMessageW GetKeyboardLayout IsCharAlphaNumericW SendMessageW UnregisterClassW DestroyWindow CloseClipboard GetMessageW ChangeClipboardChain

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_GetFeature HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidD_SetFeature HidP_GetCaps HidD_FreePreparsedData

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

winscard

SCardReleaseContext SCardListCardsW SCardGetCardTypeProviderNameW SCardListReadersW SCardFreeMemory SCardEstablishContext SCardControl SCardConnectW SCardTransmit SCardDisconnect SCardGetAttrib

winsta

WinStationCloseServer WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW WinStationEnumerateW

wldap32

ord36 ord79 ord145 ord73 ord310 ord208 ord13 ord77 ord142 ord54 ord41 ord309 ord304 ord301 ord127 ord26 ord167 ord147 ord133 ord157 ord88 ord14 ord122 ord140 ord203 ord69 ord139 ord97 ord223 ord12 ord113 ord224 ord96 ord27

msasn1

ASN1_CreateModule ASN1_CloseEncoder ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder ASN1_CloseDecoder ASN1BERDotVal2Eoid

ntdll

strtol _strcmpi strstr towupper _wcstoui64 wcsncmp wcstol strchr strcspn strncmp memmove _wcsnicmp strtoul wcsstr wcschr wcsrchr _stricmp _vscwprintf _wcsicmp strrchr _vsnprintf log memcmp RtlUnicodeStringToAnsiString RtlFreeAnsiString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtQueryDirectoryObject NtResumeProcess NtOpenDirectoryObject RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW wcstoul __chkstk

kernel32

lstrlenA GetDateFormatW SystemTimeToFileTime ClearCommError CreateRemoteThread WaitForSingleObject CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualAllocEx VirtualProtectEx RtlVirtualUnwind SetFilePointerEx GetProcessId GetComputerNameW IsWow64Process VirtualAlloc SetLastError ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW lstrlenW GetProcAddress LoadLibraryW GetModuleHandleW FreeLibrary DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc GetLastError CreateFileW ReadFile TerminateThread WriteFile FileTimeToSystemTime Sleep VirtualProtect WideCharToMultiByte GetTimeFormatW GetFullPathNameW GetFullPathNameA HeapReAlloc GetFileSize CreateMutexW HeapCompact SetEndOfFile HeapAlloc QueryPerformanceCounter HeapFree UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap FormatMessageA FormatMessageW GetVersionExW HeapDestroy GetSystemTimeAsFileTime GetFileAttributesA HeapCreate HeapValidate MultiByteToWideChar GetTempPathW HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess ExitThread RaiseException SetConsoleCtrlHandler SetConsoleTitleW SetFileAttributesW GlobalSize SetHandleInformation CreatePipe InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent CreateEventW GetSystemDirectoryW SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetCurrentDirectoryW GetCurrentThread ProcessIdToSessionId RtlLookupFunctionEntry RtlCaptureContext TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentThreadId PurgeComm

msvcrt

calloc isdigit _fmode _commode __setusermatherr isspace mbtowc __mb_cur_max isleadbyte isxdigit localeconv _snprintf __set_app_type _itoa wctomb ferror iswctype wcstombs ?terminate@@YAXXZ __badioinfo __pioinfo _read _lseeki64 _write _isatty ungetc _amsg_exit _initterm fclose _setmode vwprintf exit _cexit _exit _XcptFilter __wgetmainargs __C_specific_handler memset memcpy _iob getchar _wpgmptr fgetws realloc _msize malloc _vscprintf _errno free _wcsdup vfwprintf fflush _wfopen wprintf _fileno

Name

.text

Size

830KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

414KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

26KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=62, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=3, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=51, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=670, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=114, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,