mimikatz | f1e90edc60c94d8e1a9b8774885f75f0b69b0e8abc5f845ced12944f00902dec

Target
petya.zip
Size 318KB
Sample261113-15d5tsht3w
SHA256 f1e90edc60c94d8e1a9b8774885f75f0b69b0e8abc5f845ced12944f00902dec
MD5 9cb3577e06ef2906926d162b8251b45a
SHA1 a6ce9cb66ba433f4e999ca227a96659420aa6038
SHA512 43489c398dea568058af26df684001e778336c7999ab28e925c568f77973a62f39653aebb9d336e2026944e5ed795d6dc1738d0983663258d50161ca6f014389
SSDEEP 6144:V2ZJSTbjiOFzDnroolHyxIqBsFwgfrmJRvOFEJ9bHbKbyNFipcAoAJML:YZIT6S70olHoIYsFwGmJRO6PbHbdmqAW
TLSH
T18C642378F9698EBA6178CB01B72CF8A6D91671A784C25DC382F381DA650F4F32535E31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  petya.zip
- Size 318KB
- SHA256 f1e90edc60c94d8e1a9b8774885f75f0b69b0e8abc5f845ced12944f00902dec
- MD5 9cb3577e06ef2906926d162b8251b45a
- SHA1 a6ce9cb66ba433f4e999ca227a96659420aa6038
- SHA512 43489c398dea568058af26df684001e778336c7999ab28e925c568f77973a62f39653aebb9d336e2026944e5ed795d6dc1738d0983663258d50161ca6f014389
- SSDEEP 6144:V2ZJSTbjiOFzDnroolHyxIqBsFwgfrmJRvOFEJ9bHbKbyNFipcAoAJML:YZIT6S70olHoIYsFwGmJRO6PbHbdmqAW
- TLSH
  T18C642378F9698EBA6178CB01B72CF8A6D91671A784C25DC382F381DA650F4F32535E31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.bin
- Size 353KB
- SHA256 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
- MD5 71b6a493388e7d0b40c83ce903bc6b04
- SHA1 34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d
- SHA512 072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f
- SSDEEP 6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs2:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUG
- TLSH
  T1BC74126171C341B2F1F38A3455CAB75B8FFDE06687B065CECA2B1A0A1821746F739297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery execution mimikatz persistence spyware stealer
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral3 behavioral4
- Target
  ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6.bin
- Size 13KB
- SHA256 ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6
- MD5 0487382a4daf8eb9660f1c67e30f8b25
- SHA1 736752744122a0b5ee4b95ddad634dd225dc0f73
- SHA512 e1e7d81d54efd526139ea8ac792ed2035c8e70f040319c0b65f723431d31077c7a6927553890c99151f2354f51c4020ed94e0e2e5d56386c2fc4828e95869106
- SSDEEP 192:ScIsmNvaHz65bP/U/njs3NH0Z0UvDVE6Az6XVHBycT6iLMUpJ2seCYHlfeb:SPXTmnjs3BU9A27BNLMUTb
- TLSH
  T18F529D68AD033441237891ED54BE93A6241C919142B7D5ECFE0CE6DC6BE257B81F8CDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  fe2e5d0543b4c8769e401ec216d78a5a3547dfd426fd47e097df04a5f7d6d206_OFkNP1kKL9.bin
- Size 6KB
- SHA256 fe2e5d0543b4c8769e401ec216d78a5a3547dfd426fd47e097df04a5f7d6d206
- MD5 415fe69bf32634ca98fa07633f4118e1
- SHA1 101cc1cb56c407d5b9149f2c3b8523350d23ba84
- SHA512 e40ad6adcbdfc47ebf0745aed10a5c6c64d5759a0164dbd7ffb64439deffe710c26a8fd91e8d205f3b2f0c417d70d4e82d5f91874bc6f8bbc9ff123b72c2e692
- SSDEEP 48:3aT4qf+8xWmXLEEPjH3UNTaOOHG0WomFS/bOhkWTl:3w/xWjFazGMrzQ
- TLSH
  T195D10F34648504E5FA5FC15434AFB9E22470F2DB77CC675053BCC530B6E2ADB6A4408C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8