mimikatz | f1e90edc60c94d8e1a9b8774885f75f0b69b0e8abc5f845ced12944f00902dec

Target
petya.zip
Size 318KB
Sample261114-kq38eact7k
SHA256 f1e90edc60c94d8e1a9b8774885f75f0b69b0e8abc5f845ced12944f00902dec
MD5 9cb3577e06ef2906926d162b8251b45a
SHA1 a6ce9cb66ba433f4e999ca227a96659420aa6038
SHA512 43489c398dea568058af26df684001e778336c7999ab28e925c568f77973a62f39653aebb9d336e2026944e5ed795d6dc1738d0983663258d50161ca6f014389
SSDEEP 6144:V2ZJSTbjiOFzDnroolHyxIqBsFwgfrmJRvOFEJ9bHbKbyNFipcAoAJML:YZIT6S70olHoIYsFwGmJRO6PbHbdmqAW
TLSH
T18C642378F9698EBA6178CB01B72CF8A6D91671A784C25DC382F381DA650F4F32535E31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  petya.zip
- Size 318KB
- SHA256 f1e90edc60c94d8e1a9b8774885f75f0b69b0e8abc5f845ced12944f00902dec
- MD5 9cb3577e06ef2906926d162b8251b45a
- SHA1 a6ce9cb66ba433f4e999ca227a96659420aa6038
- SHA512 43489c398dea568058af26df684001e778336c7999ab28e925c568f77973a62f39653aebb9d336e2026944e5ed795d6dc1738d0983663258d50161ca6f014389
- SSDEEP 6144:V2ZJSTbjiOFzDnroolHyxIqBsFwgfrmJRvOFEJ9bHbKbyNFipcAoAJML:YZIT6S70olHoIYsFwGmJRO6PbHbdmqAW
- TLSH
  T18C642378F9698EBA6178CB01B72CF8A6D91671A784C25DC382F381DA650F4F32535E31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.bin.gz
- Size 306KB
- SHA256 3419e0d470f83569be0927128b3e5f992800ceb8f9019fc44763876ed6d8000c
- MD5 b2303c3eb127d1ce6906d21d9d2d07a5
- SHA1 700620e0f8efc992ac38cf32adc1010fee982217
- SHA512 4776400cc7d8107122992dce745dc2fa26c90edde6c0f5ec43272f5a21f9a516430765a225dad2c41a33b8d61f50e525973c6d38ca1189d9b49f068c05e73c04
- SSDEEP 6144:9SuBf/w62PIghu6aEZjAetG333VhNqn9CqnOqzoKZ0H3ni91dQYdCdU0y:D462BPNGIYqnOqzoKZQ3CdQYIUz
- TLSH
  T1746423B0B7FA6E407DC4CA1DFFC269AD51798437872561900572A24B0E6432F7B2A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745_98STJd8lju.bin
- Size 353KB
- SHA256 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
- MD5 71b6a493388e7d0b40c83ce903bc6b04
- SHA1 34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d
- SHA512 072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f
- SSDEEP 6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs2:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUG
- TLSH
  T1BC74126171C341B2F1F38A3455CAB75B8FFDE06687B065CECA2B1A0A1821746F739297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery execution mimikatz persistence spyware stealer
- Family: Mimikatz
  mimikatz is an open source tool to dump credentials on Windows.
  mimikatz
- mimikatz is an open source tool to dump credentials on Windows
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral5 behavioral6
- Target
  ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6.bin.gz
- Size 9KB
- SHA256 4340f4c633a53d45de440293d1f09f839467cc4734f499b466e9c58ee7493020
- MD5 65d9d04ea080e04e9d0aebf55aecd5d0
- SHA1 0fb30f6072c72fa5a77c796bfe9dfd164b67eda5
- SHA512 d93150b254cfbab05610d9bef81bacbd1ef418cb36f4057550fa5f79314bdd654878d4b050616f5773c69371a65c15a218ecacaac40b62709b442dce669e3c89
- SSDEEP 192:YAZona+6XwSgIta9pXfZRXSQ2X+A6W2K0prxy/SJam3BKBd:MnPSgwaDXSQk6M0JHIm3u
- TLSH
  T15722C0419A35C17BC249713683FC5642AB08DAE47F8103ABF44553AF599DF721AB21C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6.bin
- Size 13KB
- SHA256 ee29b9c01318a1e23836b949942db14d4811246fdae2f41df9f0dcd922c63bc6
- MD5 0487382a4daf8eb9660f1c67e30f8b25
- SHA1 736752744122a0b5ee4b95ddad634dd225dc0f73
- SHA512 e1e7d81d54efd526139ea8ac792ed2035c8e70f040319c0b65f723431d31077c7a6927553890c99151f2354f51c4020ed94e0e2e5d56386c2fc4828e95869106
- SSDEEP 192:ScIsmNvaHz65bP/U/njs3NH0Z0UvDVE6Az6XVHBycT6iLMUpJ2seCYHlfeb:SPXTmnjs3BU9A27BNLMUTb
- TLSH
  T18F529D68AD033441237891ED54BE93A6241C919142B7D5ECFE0CE6DC6BE257B81F8CDE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  fe2e5d0543b4c8769e401ec216d78a5a3547dfd426fd47e097df04a5f7d6d206_OFkNP1kKL9.bin.gz
- Size 1KB
- SHA256 d975bc89371be98a80f9979e4a3c517590029e61ff36605b48b883c723024bde
- MD5 51c028cd5f3afe9bf179d81def8d7a8e
- SHA1 838499bb7b7e7a9a212536fb9f3024dff29ad769
- SHA512 78ea2f6e2fb3fa5deab9ee79adac21b0e1671f0e0a7622abfd6870039588bc4ac8bf068bdf8dd9d364e314074a3adb55fae8532504e0f90786527404f8a8be1e
- TLSH
  T14311E9F94647447D8719CFF0984C8093C0509582334F467D6F560980D105E7D319C35B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  fe2e5d0543b4c8769e401ec216d78a5a3547dfd426fd47e097df04a5f7d6d206_OFkNP1kKL9.bin
- Size 6KB
- SHA256 fe2e5d0543b4c8769e401ec216d78a5a3547dfd426fd47e097df04a5f7d6d206
- MD5 415fe69bf32634ca98fa07633f4118e1
- SHA1 101cc1cb56c407d5b9149f2c3b8523350d23ba84
- SHA512 e40ad6adcbdfc47ebf0745aed10a5c6c64d5759a0164dbd7ffb64439deffe710c26a8fd91e8d205f3b2f0c417d70d4e82d5f91874bc6f8bbc9ff123b72c2e692
- SSDEEP 48:3aT4qf+8xWmXLEEPjH3UNTaOOHG0WomFS/bOhkWTl:3w/xWjFazGMrzQ
- TLSH
  T195D10F34648504E5FA5FC15434AFB9E22470F2DB77CC675053BCC530B6E2ADB6A4408C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14