mimikatz | 2026-10-27_efd8030c0dfe39e2f57ca45aac3bd513_amadey_darkgate_elex_glassworm_hacktools_luca-stealer_mimikatz_njrat_qilin_remcos

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_efd8030c0dfe39e2f57ca45aac3bd513_amadey_darkgate_elex_glassworm_hacktools_luca-stealer_mimikatz_njrat_qilin_remcos
Size 1.1MB
Sample261027-2dvtyavy5j
SHA256 f4117b3df37d57676005978fc3f9e32e4510fbb36ba72b2ec277cd8607c6195e
MD5 efd8030c0dfe39e2f57ca45aac3bd513
SHA1 a66682bcf9afa397c506a74fc4660f63630cef76
SHA512 cdfbb92c8fab8f130a93172788a8a63409276dbd9c8deef2fae37d52382087bfaeb38a6acfd6b87978558d213016074e0fed32f397c1cf229da68f9c6effe4da
SSDEEP 24576:QGcuc9ILAxl2fQtAB1x1Kvnjfb9jOzd3KtfZpqzQCOyzLO5k:VG2T4ts1x1UB+9KtHa7
TLSH
T1F6455C417BE64066FAB22D702AF2A616CE7B7DD21835C54F529C854F0EB3A809D39733
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

mimikatz

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
sample	mimikatz

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-27_efd8030c0dfe39e2f57ca45aac3bd513_amadey_darkgate_elex_glassworm_hacktools_luca-stealer_mimikatz_njrat_qilin_remcos

File Explorer

2026-10-27_efd8030c0dfe39e2f57ca45aac3bd513_amadey_darkgate_elex_glassworm_hacktools_luca-stealer_mimikatz_njrat_qilin_remcos

.exe 1.1MB

2026-10-27_efd8030c0dfe39e2f57ca45aac3bd513_amadey_darkgate_elex_glassworm_hacktools_luca-stealer_mimikatz_njrat_qilin_remcos

IMPHASH 0207f2760026981ec9102743763794a4
SHA256 f4117b3df37d57676005978fc3f9e32e4510fbb36ba72b2ec277cd8607c6195e
MD5 efd8030c0dfe39e2f57ca45aac3bd513
SHA1 a66682bcf9afa397c506a74fc4660f63630cef76
SHA512 cdfbb92c8fab8f130a93172788a8a63409276dbd9c8deef2fae37d52382087bfaeb38a6acfd6b87978558d213016074e0fed32f397c1cf229da68f9c6effe4da
SSDEEP 24576:QGcuc9ILAxl2fQtAB1x1Kvnjfb9jOzd3KtfZpqzQCOyzLO5k:VG2T4ts1x1UB+9KtHa7
TLSH
T1F6455C417BE64066FAB22D702AF2A616CE7B7DD21835C54F529C854F0EB3A809D39733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
mimikatz is an open source tool to dump credentials on Windows
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f1:24:cf:78:0c:95:51:a3:d0:2a:cd:b4:be:0f:05:a3:04:a6:a2:57:66:1f:2e:6c:b1:5d:04:1a:bb:3f:44:4e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Roland Zemanovic Self-Signed

Chains

Oct 25, 2026

CN=Roland Zemanovic Self-Signed

Subject

CN=Roland Zemanovic Self-Signed

Serial Number

65:b8:ac:03:2e:cb:de:a4:42:f8:19:5d:de:cb:70:4d

Issuer

CN=Roland Zemanovic Self-Signed

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 25, 2026 - Oct 25, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

625768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CryptReleaseContext CryptGenKey CryptGetProvParam CryptGetHashParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptSetHashParam CryptHashData CryptCreateHash CryptExportKey CryptDecrypt SystemFunction007 CryptDuplicateKey CryptEncrypt CryptAcquireContextW CryptGetKeyParam CryptAcquireContextA CryptDestroyKey GetLengthSid CopySid LsaClose LsaOpenPolicy LsaQueryInformationPolicy CreateWellKnownSid CreateProcessAsUserW CreateProcessWithLogonW RegQueryValueExW RegEnumValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey SystemFunction032 ConvertSidToStringSidW QueryServiceObjectSecurity QueryServiceStatusEx BuildSecurityDescriptorW OpenServiceW StartServiceW FreeSid ControlService SetServiceObjectSecurity DeleteService AllocateAndInitializeSid OpenSCManagerW CloseServiceHandle CreateServiceW IsTextUnicode GetTokenInformation LookupAccountNameW LookupAccountSidW DuplicateTokenEx CheckTokenMembership OpenProcessToken CryptSetProvParam CryptEnumProvidersW ConvertStringSidToSidW LsaFreeMemory IsValidSid GetSidSubAuthority GetSidSubAuthorityCount SetThreadToken SystemFunction006 CryptEnumProviderTypesW CryptGetUserKey OpenEventLogW ClearEventLogW GetNumberOfEventLogRecords CryptSignHashW LsaRetrievePrivateData LsaOpenSecret LsaQueryTrustedDomainInfoByName CryptDeriveKey LsaQuerySecret SystemFunction001 SystemFunction005 SystemFunction013 LsaEnumerateTrustedDomainsEx LookupPrivilegeValueW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerW SetServiceStatus OpenThreadToken LookupPrivilegeNameW EqualSid CredFree CredEnumerateW SystemFunction025 ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction024 CredUnmarshalCredentialW CredIsMarshaledCredentialW A_SHAUpdate A_SHAInit A_SHAFinal

cabinet

ord14 ord10 ord13 ord11

crypt32

CertGetNameStringW CryptQueryObject CertEnumCertificatesInStore CertAddCertificateContextToStore CertEnumSystemStore CertAddEncodedCertificateToStore CertFreeCertificateContext CertCloseStore PFXExportCertStoreEx CertSetCertificateContextProperty CertOpenStore CryptUnprotectData CryptBinaryToStringW CryptStringToBinaryA CryptBinaryToStringA CryptStringToBinaryW CryptAcquireCertificatePrivateKey CryptExportPublicKeyInfo CryptFindOIDInfo CryptSignAndEncodeCertificate CertNameToStrW CryptEncodeObject CertFindCertificateInStore CertGetCertificateContextProperty CryptProtectData CryptDecodeObjectEx

cryptdll

CDGenerateRandomBits MD5Init MD5Update CDLocateCheckSum MD5Final CDLocateCSystem

dnsapi

DnsQuery_A DnsFree

fltlib

FilterFindNext FilterFindFirst

netapi32

NetSessionEnum NetStatisticsGet NetShareEnum NetWkstaUserEnum DsEnumerateDomainTrustsW NetServerGetInfo DsGetDcNameW NetApiBufferFree NetRemoteTOD I_NetServerAuthenticate2 I_NetServerReqChallenge I_NetServerTrustPasswordsGet

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit SysFreeString SysAllocString

rpcrt4

RpcMgmtEpEltInqBegin RpcMgmtEpEltInqDone RpcMgmtEpEltInqNextW RpcEpResolveBinding RpcBindingSetAuthInfoW NdrServerCall2 RpcBindingInqAuthClientW RpcBindingSetOption RpcBindingFromStringBindingW RpcStringBindingComposeW RpcBindingSetAuthInfoExW RpcStringFreeW MesHandleFree RpcImpersonateClient RpcRevertToSelf MesEncodeIncrementalHandleCreate MesDecodeIncrementalHandleCreate RpcBindingFree MesIncrementalHandleReset UuidCreate NdrMesTypeEncode2 NdrMesTypeDecode2 NdrMesTypeFree2 NdrMesTypeAlignSize2 RpcBindingVectorFree RpcServerUseProtseqEpW RpcServerUnregisterIfEx RpcBindingToStringBindingW UuidToStringW RpcServerRegisterIf2 RpcMgmtWaitServerListen RpcServerListen RpcServerRegisterAuthInfoW RpcEpUnregister RpcEpRegisterW RpcServerInqBindings RpcMgmtStopServerListening I_RpcBindingInqSecurityContext NdrClientCall2 I_RpcGetCurrentCallHandle

shlwapi

PathCombineW PathCanonicalizeW PathIsRelativeW PathFindFileNameW PathIsDirectoryW

samlib

SamCloseHandle SamConnect SamLookupIdsInDomain SamiChangePasswordUser SamOpenUser SamFreeMemory SamQueryInformationUser SamSetInformationUser SamOpenGroup SamEnumerateDomainsInSamServer SamRidToSid SamOpenAlias SamGetAliasMembership SamEnumerateGroupsInDomain SamGetMembersInGroup SamGetMembersInAlias SamGetGroupsForUser SamOpenDomain SamLookupNamesInDomain SamEnumerateUsersInDomain SamEnumerateAliasesInDomain SamLookupDomainInSamServer

secur32

LsaFreeReturnBuffer FreeContextBuffer LsaCallAuthenticationPackage LsaDeregisterLogonProcess LsaConnectUntrusted DeleteSecurityContext AcquireCredentialsHandleW InitializeSecurityContextW FreeCredentialsHandle LsaLookupAuthenticationPackage EnumerateSecurityPackagesW QueryContextAttributesW

shell32

CommandLineToArgvW

user32

IsCharAlphaNumericW UnregisterClassW GetKeyboardLayout GetClipboardData GetClipboardSequenceNumber TranslateMessage EnumClipboardFormats CloseClipboard ChangeClipboardChain DispatchMessageW OpenClipboard RegisterClassExW SendMessageW GetMessageW DefWindowProcW PostMessageW DestroyWindow SetClipboardViewer CreateWindowExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

hid

HidD_FreePreparsedData HidD_GetPreparsedData HidD_GetAttributes HidD_GetFeature HidD_SetFeature HidP_GetCaps HidD_GetHidGuid

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces

winscard

SCardDisconnect SCardConnectW SCardControl SCardListReadersW SCardGetCardTypeProviderNameW SCardReleaseContext SCardEstablishContext SCardGetAttrib SCardFreeMemory SCardTransmit SCardListCardsW

winsta

WinStationEnumerateW WinStationConnectW WinStationFreeMemory WinStationCloseServer WinStationQueryInformationW WinStationOpenServerW

wldap32

ord96 ord208 ord73 ord13 ord36 ord79 ord41 ord142 ord77 ord145 ord54 ord301 ord304 ord309 ord167 ord133 ord127 ord26 ord27 ord147 ord224 ord203 ord88 ord14 ord140 ord113 ord223 ord157 ord97 ord122 ord139 ord12 ord69 ord310

msasn1

ASN1_CloseModule ASN1_FreeEncoded ASN1BERDotVal2Eoid ASN1_CreateModule ASN1_CloseEncoder ASN1_CreateEncoder ASN1_CreateDecoder ASN1_CloseDecoder

ntdll

NtQuerySystemInformation NtQueryInformationProcess NtQueryObject RtlInitUnicodeString RtlEqualUnicodeString RtlDowncaseUnicodeString RtlFreeUnicodeString RtlUnicodeStringToAnsiString RtlFreeAnsiString RtlGetCurrentPeb RtlCreateUserThread RtlGUIDFromString RtlStringFromGUID NtCompareTokens RtlGetNtVersionNumbers RtlEqualString RtlAppendUnicodeStringToString RtlUpcaseUnicodeString RtlAnsiStringToUnicodeString RtlFreeOemString RtlUpcaseUnicodeStringToOemString NtResumeProcess RtlAdjustPrivilege NtTerminateProcess NtSuspendProcess NtSetSystemEnvironmentValueEx NtQuerySystemEnvironmentValueEx NtEnumerateSystemEnvironmentValuesEx RtlIpv4AddressToStringW RtlIpv6AddressToStringW RtlGetCompressionWorkSpaceSize RtlCompressBuffer

kernel32

IsValidCodePage FindFirstFileExW GetStringTypeW SetStdHandle GetConsoleMode GetConsoleCP LCMapStringW CompareStringW GetFileType GetACP GetModuleHandleExW GetModuleFileNameW GetCommandLineW GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetCurrentThreadId LoadLibraryExA SetFilePointerEx GetProcessId GetComputerNameW ProcessIdToSessionId GetCurrentThread IsWow64Process SetConsoleCursorPosition SetCurrentDirectoryW FillConsoleOutputCharacterW GetTimeZoneInformation GetSystemDirectoryW GetStdHandle GetConsoleScreenBufferInfo SetEvent CreateEventW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection CreatePipe SetHandleInformation GlobalSize SetFileAttributesW SetConsoleTitleW ExitProcess RaiseException ExitThread SetConsoleCtrlHandler GetTickCount QueryPerformanceCounter FormatMessageA GetSystemTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW GetVersionExA WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW MultiByteToWideChar HeapSize HeapValidate GetVersionExW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW InterlockedCompareExchange GetFullPathNameW HeapFree HeapCreate AreFileApisANSI GetDateFormatW GetSystemTimeAsFileTime WideCharToMultiByte SystemTimeToFileTime GetTimeFormatW lstrlenA ClearCommError PurgeComm CreateRemoteThread WaitForSingleObject SetLastError CreateProcessW SetConsoleOutputCP GetConsoleOutputCP MapViewOfFile GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW ReadConsoleW GetOEMCP CreateFileMappingW UnmapViewOfFile VirtualQueryEx VirtualQuery VirtualFreeEx ReadProcessMemory VirtualAllocEx VirtualProtectEx VirtualAlloc VirtualFree VirtualProtect DecodePointer WriteProcessMemory GetComputerNameExW DeviceIoControl OpenProcess DuplicateHandle GetCurrentProcess FlushFileBuffers GetCurrentDirectoryW GetFileAttributesW FindClose ExpandEnvironmentStringsW FindNextFileW GetFileSizeEx FindFirstFileW lstrlenW FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW FileTimeToDosDateTime GetTempFileNameA FileTimeToLocalFileTime DeleteFileA CreateFileA GetTempPathA GetFileInformationByHandle GetCurrentDirectoryA SetFilePointer LocalFree CreateThread CloseHandle TerminateThread GetLastError Sleep CreateFileW LocalAlloc WriteFile ReadFile FileTimeToSystemTime

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_efd8030c0dfe39e2f57ca45aac3bd513_amadey_darkgate_elex_glassworm_hacktools_luca-stealer_mimikatz_njrat_qilin_remcos

PE Signature issue

advapi32

cabinet

crypt32

cryptdll

dnsapi

fltlib

netapi32

ole32

oleaut32

rpcrt4

shlwapi

samlib

secur32

shell32

user32

userenv

version

hid

setupapi

winscard

winsta

wldap32

msasn1

ntdll

kernel32

generic