mimic | b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc[.]zip

Resubmissions

16/10/2026, 17:27

261016-v1lffshz7l10

16/10/2026, 17:25

261016-vzr7lsaf4910

16/10/2026, 14:00

261016-ra2szazt8r10

Sharing

Copy URL Twitter E-mail

General

Target
b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc.zip
Size 1.3MB
Sample261016-vzr7lsaf49
SHA256 318bcf3b739d4eaca2b293c73d5c27804ed0bccdebba8183a70e53439fb45ccf
MD5 604eabd64b30fc61a45afee7c4517f14
SHA1 3e3d4c433a016c26052268077f586c09a303ec22
SHA512 496065c6aba1e540214453b39f90c6eb2898114fc14156561b900e7d4ef81a8be2a5eb83f99a903539aef7bcd862343e2f9a14663de6648ce31404a3cb21e042
SSDEEP 24576:ehPg3xvoVoy1TIbfougZQSGX1vOWrcHYVbQNK0VGanR3nZTQvaQVCHozm1cOq6i+:mP+xTyhmAlxGX1vtrc4QhDZZMvP4Hfce
TLSH
T1325533362F43AC5E46F9C25416BB9B326907CE7DF1D019D0F90CB20C9A1AED729CD169
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware mimic

Malware Config

Signatures

Family: Mimic
Ransomware family was first exploited in the wild in 2022.
ransomware mimic

Detects Mimic ransomware 1 IoCs

resource	yara_rule
static1/unpack001/b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc.exe	family_mimic

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc.exe

File Explorer

b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc.zip

.zip 1.3MB
b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc.exe

.exe 2.3MB

b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc.zip

SHA256 318bcf3b739d4eaca2b293c73d5c27804ed0bccdebba8183a70e53439fb45ccf
MD5 604eabd64b30fc61a45afee7c4517f14
SHA1 3e3d4c433a016c26052268077f586c09a303ec22
SHA512 496065c6aba1e540214453b39f90c6eb2898114fc14156561b900e7d4ef81a8be2a5eb83f99a903539aef7bcd862343e2f9a14663de6648ce31404a3cb21e042
SSDEEP 24576:ehPg3xvoVoy1TIbfougZQSGX1vOWrcHYVbQNK0VGanR3nZTQvaQVCHozm1cOq6i+:mP+xTyhmAlxGX1vtrc4QhDZZMvP4Hfce
TLSH
T1325533362F43AC5E46F9C25416BB9B326907CE7DF1D019D0F90CB20C9A1AED729CD169
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc.exe

IMPHASH 5db996f530c574ab3c34e6ed3f1396a6
SHA256 b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc
MD5 d9c0acff321c0bbfaf27cb440e6ee9be
SHA1 09ef304885e654bc8ad29ce51c989d13f07e7e0b
SHA512 dfe7a3d228108cb9693d6bd1dfa16cd4b41e086d2247362331dee2f7bb3f83735dbeaab3cc42fb48b3b585026a2b6af702f27bd444364305df8b85d9ee6c3f4e
SSDEEP 49152:5lhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCrRH96x9k484:5lhRuiVhG/o80ny2CnZGaHCv6
TLSH
T16BB5D002FBC28172E193467491B6A77F8A3ABA249734C5C797D01D7989313C36A3F3A5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects Mimic ransomware
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

1276327

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenProcess Wow64RevertWow64FsRedirection SetCurrentDirectoryW ExitProcess SetUnhandledExceptionFilter HeapFree HeapAlloc GetProcessHeap CancelIo CreateTimerQueueTimer DeleteTimerQueue GetQueuedCompletionStatus PostQueuedCompletionStatus lstrcatW lstrcpyW CreateIoCompletionPort CreateTimerQueue GetCurrentProcess SetProcessShutdownParameters LocalAlloc GetCurrentThread LocalFree GetSystemWindowsDirectoryW QueryDosDeviceW SetPriorityClass RemoveDirectoryW GetVersionExW K32GetProcessImageFileNameW DuplicateHandle CreateToolhelp32Snapshot GetExitCodeThread ProcessIdToSessionId Process32NextW K32GetProcessMemoryInfo Process32FirstW GetNativeSystemInfo LoadLibraryW Module32FirstW GetWindowsDirectoryW GetProcAddress WTSGetActiveConsoleSessionId CreateProcessW GetModuleHandleW CreateRemoteThread Module32NextW QueryFullProcessImageNameW K32GetMappedFileNameW CreateFileMappingW GetTickCount IsWow64Process VirtualQueryEx GetExitCodeProcess InitializeCriticalSectionEx RaiseException DecodePointer GetComputerNameExW GlobalMemoryStatusEx ReadProcessMemory GetStdHandle GetEnvironmentVariableW GetFileType SetLastError InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW QueryPerformanceCounter GetSystemTimeAsFileTime FormatMessageW DeleteFiber ConvertFiberToThread FreeLibrary WideCharToMultiByte GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW WriteConsoleW HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocalTime DeleteCriticalSection GetFileInformationByHandle SetFileAttributesW GetFileAttributesW InitializeCriticalSection LeaveCriticalSection SetErrorMode CreateThread MapViewOfFile CreateEventA CreateFileMappingA ResetEvent SetEvent UnmapViewOfFile ReleaseMutex CreateMutexA CreateMutexW WaitForMultipleObjects lstrcmpW GetCurrentProcessId Sleep CreateEventW WaitForSingleObject FindClose lstrlenW FindNextFileW ReadFile FindFirstFileW AllocConsole GetConsoleWindow SetConsoleCP GetFileTime GetDriveTypeW FindNextVolumeW GetSystemTime GetVolumePathNamesForVolumeNameW CopyFileW SystemTimeToFileTime FindVolumeClose DeleteFileW GetDiskFreeSpaceExW ExitThread SetFileTime FindFirstVolumeW GetLogicalDrives GetVolumeInformationW CreateDirectoryW GetConsoleOutputCP FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe SetConsoleCtrlHandler ResumeThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect lstrcmpiW MultiByteToWideChar lstrcpynW GetFileSizeEx GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW EncodePointer SwitchToThread TryEnterCriticalSection AreFileApisANSI GetFullPathNameW FindFirstFileExW GetCurrentDirectoryW QueryPerformanceFrequency GetStringTypeW TerminateProcess Wow64DisableWow64FsRedirection EnterCriticalSection GetCommandLineW LockResource CreateFileW SizeofResource FlushFileBuffers MoveFileW SetFilePointerEx CloseHandle GetLastError SetEndOfFile DeviceIoControl WriteFile LoadLibraryA

user32

GetMessageW wvsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxW ShowWindow PeekMessageW RegisterHotKey SendMessageTimeoutW FindWindowW wsprintfW PostMessageW UnregisterHotKey

advapi32

CloseServiceHandle RevertToSelf GetTokenInformation OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteValueW ConvertSidToStringSidW SetSecurityInfo RegGetValueW InitializeAcl OpenProcessToken RegSetValueExW RegCreateKeyExW LookupPrivilegeNameW RegCloseKey GetSecurityDescriptorDacl AdjustTokenPrivileges GetSecurityDescriptorSacl LookupPrivilegeValueW QueryServiceStatusEx DuplicateTokenEx CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource EqualSid CreateWellKnownSid GetUserNameW LookupAccountSidW OpenSCManagerW ControlService EnumDependentServicesW ChangeServiceConfigW OpenServiceW EnumServicesStatusW SetThreadToken

shell32

SHEmptyRecycleBinW SHCreateItemFromParsingName CommandLineToArgvW

ole32

CoInitializeEx CoTaskMemFree CoGetObject CoCreateInstance CoInitialize CoInitializeSecurity CoUninitialize CoSetProxyBlanket

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

ws2_32

setsockopt WSAGetLastError inet_ntop getsockopt gethostname inet_ntoa WSAAddressToStringW socket WSAStartup WSASocketW send WSASetLastError htons shutdown gethostbyname closesocket WSAIoctl bind WSACleanup recv

shlwapi

PathStripPathW StrStrW PathFileExistsW PathRemoveExtensionW PathGetArgsW PathFindExtensionW StrStrIA PathRemoveFileSpecW StrStrIW

iphlpapi

GetIpNetTable GetAdaptersInfo

netapi32

NetShareEnum NetApiBufferFree

mpr

WNetOpenEnumW WNetCloseEnum WNetGetConnectionW WNetEnumResourceW

rstrtmgr

RmShutdown RmStartSession RmGetList RmRegisterResources RmEndSession

everything32

Everything_GetNumResults Everything_SetRequestFlags Everything_Exit Everything_CleanUp Everything_GetLastError Everything_QueryW Everything_GetResultFullPathNameW Everything_SetSearchW Everything_SetSort Everything_DeleteRunHistory Everything_IsDBLoaded Everything_GetResultSize

bcrypt

BCryptGenRandom