mimikatz | 2026-10-24_3fa261d2044a0ca6e75e501d04ab78bd_fabookie_glassworm_hacktools_mimikatz_qilin

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-24_3fa261d2044a0ca6e75e501d04ab78bd_fabookie_glassworm_hacktools_mimikatz_qilin
Size 1.2MB
Sample261025-3qsqsattex
SHA256 bab1c054cf747fa6c253a8e519a8ed3afcbc9fad92591d7415eb095938f183e2
MD5 3fa261d2044a0ca6e75e501d04ab78bd
SHA1 71f949fff6ffbeab6758631e63e30a67514371d1
SHA512 cad24307bf3d70a4c6d8cc01d3350ebb90cf9a13f6accc40478af85de167293c527664eab3ba61a3f6f33b923c5285a020a2a3dbcb2ef8e8ccb572fb1b5efa9d
SSDEEP 24576:zLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0yIpz:zLZo1jFyjFJhmf4YlHW
TLSH
T17E452941A7E90068F1B79AB59EF29117DBB378D61534C30F02A8CB5B1F73B619929332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-24_3fa261d2044a0ca6e75e501d04ab78bd_fabookie_glassworm_hacktools_mimikatz_qilin

File Explorer

2026-10-24_3fa261d2044a0ca6e75e501d04ab78bd_fabookie_glassworm_hacktools_mimikatz_qilin

.exe 1.2MB

2026-10-24_3fa261d2044a0ca6e75e501d04ab78bd_fabookie_glassworm_hacktools_mimikatz_qilin

IMPHASH 1355327f6ca3430b3ddbe6e0acda71ea
SHA256 bab1c054cf747fa6c253a8e519a8ed3afcbc9fad92591d7415eb095938f183e2
MD5 3fa261d2044a0ca6e75e501d04ab78bd
SHA1 71f949fff6ffbeab6758631e63e30a67514371d1
SHA512 cad24307bf3d70a4c6d8cc01d3350ebb90cf9a13f6accc40478af85de167293c527664eab3ba61a3f6f33b923c5285a020a2a3dbcb2ef8e8ccb572fb1b5efa9d
SSDEEP 24576:zLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0yIpz:zLZo1jFyjFJhmf4YlHW
TLSH
T17E452941A7E90068F1B79AB59EF29117DBB378D61534C30F02A8CB5B1F73B619929332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
mimikatz is an open source tool to dump credentials on Windows
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

773388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptSetHashParam CryptGetHashParam CryptExportKey CryptAcquireContextW CryptSetKeyParam CryptGetKeyParam CryptReleaseContext CryptDuplicateKey CryptAcquireContextA CryptGetProvParam CryptImportKey SystemFunction007 CryptEncrypt CryptCreateHash CryptGenKey CryptDestroyKey CryptDecrypt CryptDestroyHash CryptHashData CopySid GetLengthSid LsaQueryInformationPolicy LsaOpenPolicy LsaClose CreateWellKnownSid CreateProcessWithLogonW CreateProcessAsUserW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegSetValueExW SystemFunction032 ConvertSidToStringSidW CreateServiceW CloseServiceHandle DeleteService OpenSCManagerW SetServiceObjectSecurity OpenServiceW BuildSecurityDescriptorW QueryServiceObjectSecurity StartServiceW AllocateAndInitializeSid QueryServiceStatusEx FreeSid ControlService IsTextUnicode OpenProcessToken GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory GetSidSubAuthority GetSidSubAuthorityCount IsValidSid SetThreadToken CryptEnumProviderTypesW SystemFunction006 CryptGetUserKey OpenEventLogW GetNumberOfEventLogRecords ClearEventLogW SystemFunction001 CryptDeriveKey SystemFunction005 LsaQueryTrustedDomainInfoByName CryptSignHashW LsaOpenSecret LsaQuerySecret SystemFunction013 LsaRetrievePrivateData LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW LookupPrivilegeNameW OpenThreadToken CredFree CredEnumerateW SystemFunction025 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction024 CredIsMarshaledCredentialW CredUnmarshalCredentialW A_SHAFinal A_SHAInit A_SHAUpdate

cabinet

ord11 ord14 ord10 ord13

crypt32

CertFindCertificateInStore CertEnumSystemStore CertEnumCertificatesInStore CertAddCertificateContextToStore CryptDecodeObjectEx CertAddEncodedCertificateToStore CertOpenStore CertFreeCertificateContext CertCloseStore CertSetCertificateContextProperty PFXExportCertStoreEx CryptUnprotectData CryptBinaryToStringW CryptBinaryToStringA CryptStringToBinaryW CryptExportPublicKeyInfo CryptFindOIDInfo CryptAcquireCertificatePrivateKey CertNameToStrW CryptStringToBinaryA CertGetCertificateContextProperty CryptSignAndEncodeCertificate CryptEncodeObject CryptProtectData CryptQueryObject CertGetNameStringW

cryptdll

MD5Init MD5Update MD5Final CDLocateCSystem CDGenerateRandomBits CDLocateCheckSum

dnsapi

DnsFree DnsQuery_A

fltlib

FilterFindFirst FilterFindNext

netapi32

NetServerGetInfo NetStatisticsGet NetShareEnum DsEnumerateDomainTrustsW DsGetDcNameW NetApiBufferFree NetRemoteTOD NetSessionEnum NetWkstaUserEnum I_NetServerAuthenticate2 I_NetServerTrustPasswordsGet I_NetServerReqChallenge

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString

rpcrt4

RpcMgmtEpEltInqNextW RpcMgmtEpEltInqBegin I_RpcGetCurrentCallHandle NdrClientCall2 RpcMgmtEpEltInqDone RpcBindingFromStringBindingW RpcStringBindingComposeW MesEncodeIncrementalHandleCreate RpcBindingSetAuthInfoExW RpcBindingInqAuthClientW RpcBindingSetOption RpcImpersonateClient RpcBindingFree RpcStringFreeW RpcRevertToSelf MesDecodeIncrementalHandleCreate MesHandleFree MesIncrementalHandleReset NdrMesTypeDecode2 NdrMesTypeAlignSize2 NdrMesTypeFree2 NdrMesTypeEncode2 RpcServerUnregisterIfEx I_RpcBindingInqSecurityContext RpcServerInqBindings RpcServerListen RpcMgmtWaitServerListen RpcEpRegisterW RpcMgmtStopServerListening RpcBindingToStringBindingW RpcServerRegisterIf2 RpcServerRegisterAuthInfoW RpcBindingVectorFree UuidToStringW RpcServerUseProtseqEpW RpcEpUnregister NdrServerCall2 RpcEpResolveBinding UuidCreate

shlwapi

PathIsDirectoryW PathCanonicalizeW PathCombineW PathFindFileNameW PathIsRelativeW

samlib

SamEnumerateGroupsInDomain SamiChangePasswordUser SamSetInformationUser SamGetGroupsForUser SamConnect SamGetMembersInGroup SamRidToSid SamGetMembersInAlias SamEnumerateAliasesInDomain SamGetAliasMembership SamOpenGroup SamQueryInformationUser SamCloseHandle SamEnumerateDomainsInSamServer SamFreeMemory SamEnumerateUsersInDomain SamOpenUser SamLookupDomainInSamServer SamLookupNamesInDomain SamLookupIdsInDomain SamOpenDomain SamOpenAlias

secur32

QueryContextAttributesW FreeContextBuffer LsaConnectUntrusted LsaLookupAuthenticationPackage LsaDeregisterLogonProcess DeleteSecurityContext LsaCallAuthenticationPackage FreeCredentialsHandle EnumerateSecurityPackagesW AcquireCredentialsHandleW InitializeSecurityContextW LsaFreeReturnBuffer

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW GetKeyboardLayout DispatchMessageW DefWindowProcW SetClipboardViewer SendMessageW GetClipboardSequenceNumber OpenClipboard CreateWindowExW ChangeClipboardChain GetClipboardData RegisterClassExW TranslateMessage EnumClipboardFormats PostMessageW UnregisterClassW GetMessageW CloseClipboard DestroyWindow

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

hid

HidD_GetFeature HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes HidD_FreePreparsedData HidP_GetCaps HidD_SetFeature

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList

winscard

SCardControl SCardTransmit SCardDisconnect SCardGetAttrib SCardEstablishContext SCardFreeMemory SCardListReadersW SCardReleaseContext SCardGetCardTypeProviderNameW SCardListCardsW SCardConnectW

winsta

WinStationCloseServer WinStationOpenServerW WinStationFreeMemory WinStationConnectW WinStationQueryInformationW WinStationEnumerateW

wldap32

ord122 ord14 ord88 ord157 ord133 ord27 ord147 ord167 ord26 ord127 ord224 ord113 ord309 ord54 ord142 ord77 ord13 ord208 ord145 ord36 ord79 ord41 ord73 ord310 ord203 ord69 ord139 ord97 ord223 ord304 ord12 ord96 ord301 ord140

msasn1

ASN1_CreateModule ASN1BERDotVal2Eoid ASN1_CloseEncoder ASN1_CreateDecoder ASN1_FreeEncoded ASN1_CloseModule ASN1_CreateEncoder ASN1_CloseDecoder

ntdll

RtlFreeAnsiString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlInitUnicodeString RtlEqualUnicodeString NtQueryObject RtlCompressBuffer RtlGetCompressionWorkSpaceSize NtQuerySystemInformation RtlGetCurrentPeb NtQueryInformationProcess RtlUnicodeStringToAnsiString RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlUpcaseUnicodeString RtlAppendUnicodeStringToString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtSuspendProcess NtTerminateProcess NtQuerySystemEnvironmentValueEx RtlCreateUserThread NtSetSystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW

kernel32

GetFullPathNameA GetFullPathNameW GetTimeFormatW WideCharToMultiByte GetSystemTimeAsFileTime SystemTimeToFileTime GetDateFormatW PurgeComm ClearCommError RtlVirtualUnwind SetFilePointerEx GetProcessId CreateRemoteThread WaitForSingleObject SetLastError CreateProcessW SetConsoleOutputCP GetConsoleOutputCP CreateFileMappingW UnmapViewOfFile MapViewOfFile WriteProcessMemory VirtualAllocEx VirtualProtectEx VirtualAlloc ReadProcessMemory VirtualFreeEx VirtualQueryEx VirtualFree VirtualQuery GetComputerNameExW DeviceIoControl DuplicateHandle OpenProcess GetCurrentProcess ExpandEnvironmentStringsW FindNextFileW FindClose GetCurrentDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesW FindFirstFileW lstrlenW DeleteFileA GetTempPathA GetFileInformationByHandle FileTimeToLocalFileTime GetCurrentDirectoryA GetTempFileNameA SetFilePointer CreateFileA FileTimeToDosDateTime CreateThread LocalFree CloseHandle LocalAlloc HeapReAlloc CreateFileW ReadFile TerminateThread WriteFile FileTimeToSystemTime Sleep VirtualProtect CreateMutexW HeapCompact SetEndOfFile FreeLibrary HeapAlloc QueryPerformanceCounter HeapFree UnlockFile FlushViewOfFile LockFile WaitForSingleObjectEx OutputDebugStringW GetTickCount UnlockFileEx GetProcessHeap FormatMessageA LoadLibraryW GetFileSize FormatMessageW GetVersionExW HeapDestroy GetFileAttributesA HeapCreate HeapValidate MultiByteToWideChar GetTempPathW GetProcAddress HeapSize LockFileEx GetDiskFreeSpaceW LoadLibraryA CreateFileMappingA GetDiskFreeSpaceA GetSystemInfo GetFileAttributesExW OutputDebugStringA GetVersionExA DeleteFileW GetCurrentProcessId GetSystemTime AreFileApisANSI ExitProcess RaiseException SetConsoleCtrlHandler SetConsoleTitleW lstrlenA GlobalSize GetModuleHandleW SetHandleInformation CreatePipe InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection SetEvent CreateEventW GetSystemDirectoryW GetCurrentThreadId SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlCaptureContext GetLastError RtlLookupFunctionEntry SetConsoleCursorPosition GetTimeZoneInformation GetStdHandle FillConsoleOutputCharacterW GetConsoleScreenBufferInfo GetComputerNameW ProcessIdToSessionId GetCurrentThread SetCurrentDirectoryW

msvcrt

isspace isdigit calloc mbtowc _lseeki64 _write isleadbyte isxdigit localeconv _snprintf _itoa wctomb ferror iswctype wcstombs _isatty ungetc ?terminate@@YAXXZ __badioinfo __pioinfo _read log __mb_cur_max vwprintf __set_app_type _fmode _commode _errno free _wcsdup _vsnprintf strrchr _wcsicmp vfwprintf _vscwprintf fflush _wfopen wprintf _fileno _iob memcmp _setmode fclose _stricmp wcsrchr wcschr strtoul _wcsnicmp wcsstr _vscprintf memmove strncmp malloc _msize strcspn realloc fgetws wcstoul wcstol towupper _wpgmptr strstr strchr _wcstoui64 wcsncmp getchar memcpy memset __C_specific_handler __wgetmainargs _XcptFilter _exit _cexit exit _initterm _amsg_exit __setusermatherr

generic

count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,

count=63, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,

count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=2, id=132, productName=VS2008 build 21022, version=21022,

count=47, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,

count=634, id=1, productName=Unmarked objects,

count=1, id=126, version=50727,

count=99, id=137, version=30729,

count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,

count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,