MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mimic


Vendor detections: 15


Intelligence 15 IOCs YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86
SHA3-384 hash: d3403b7dfe5fe0b147d2738a787030b59a5220562db6cc586f5f04955e45a6534adadff5c9db1edff42097e0126645c7
SHA1 hash: 77e84dd6b9af5f604868993387d8c4ee30fed0da
MD5 hash: dd9a743880f9a1d2fa90844304b73e5c
humanhash: alabama-kilo-crazy-leopard
File name:Old2.exe
Download: download sample
Signature Mimic
Create hunting rule
File size:7'997'456 bytes
First seen:2025-05-31 19:00:14 UTC
Last seen:2025-06-01 09:30:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 585b29427ce6c3d0c366c8122ddc838a (1 x Mimic)
ssdeep 196608:jhRTg8UzgC5KwgnITbX+bypnBBEbMs+Kez1A9X:v8/kCynkX+YzSlsCX
Threatray 1 similar samples on MalwareBazaar
TLSH T1378633D66792F2DBDEB4DBFA41724009604EA8BC00B5F5BC569F0C2AA71B10C9BB14D7
TrID 32.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
28.9% (.EXE) Win32 Executable (generic) (4504/4/1)
13.0% (.EXE) OS/2 Executable (generic) (2029/13)
12.8% (.EXE) Generic Win/DOS Executable (2002/3)
12.8% (.EXE) DOS Executable Generic (2000/1)
Magika pebin
Reporter juroots
Tags:88-80-150-179 exe Mimic Ransomware

Intelligence

File Origin
# of uploads :
3
# of downloads :
510
Origin country :
CH CH
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Old2.exe
Verdict:
Malicious activity
Analysis date:
2025-05-31 19:18:26 UTC
Tags:
auto-reg everything tool mimic ransomware themida
Link:
https://app.any.run/tasks/d374bc63-23b5-46c6-a674-b65cd15eb164

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/6576/
Detection(s):
SecuriteInfo.com.Trojan.Encoder.38543.29040.1205.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=683b53ed668438e362e91255
Tags:
autoit emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for analyzing tools
Searching for the window
Creating a file
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Adding an access-denied ACE
Running batch commands
Creating a window
Searching for synchronization primitives
Launching a process
Connection attempt
Modifying a system file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun with the shell\open\command registry branches
Changing the Windows explorer settings
Blocking the User Account Control
Enabling autorun
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypt microsoft_visual_cc mimic obfuscated packed packed packer_detected ransomware themidawinlicense virus xpack
Link:
https://www.filescan.io/uploads/683b51d6e336a33801e124de/reports/395a869d-bad9-4f0d-87dd-ed964d73d6d4/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86
Malware family:
ChromePolish
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/41a5b75e-3173-4108-8b65-db03c18ad155
Result
Threat name:
Mimic
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1703055
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Connects to many different private IPs (likely to spread or exploit)
Connects to many different private IPs via SMB (likely to spread or exploit)
Contains functionality to detect sleep reduction / modifications
Creates a Image File Execution Options (IFEO) Debugger entry
Creates an undocumented autostart registry key
Creates multiple autostart registry keys
Disable UAC(promptonsecuredesktop)
Disables UAC (registry)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies Group Policy settings
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Self deletion via cmd or bat file
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses powercfg.exe to modify the power settings
Yara detected Mimic Ransomware
Yara detected RansomwareGeneric18
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1703055 Sample: Old2.exe Startdate: 31/05/2025 Architecture: WINDOWS Score: 100 101 Malicious sample detected (through community Yara rule) 2->101 103 Antivirus / Scanner detection for submitted sample 2->103 105 Multi AV Scanner detection for dropped file 2->105 107 6 other signatures 2->107 14 Old2.exe 2 39 2->14         started        18 svcrhost.exe 16 2->18         started        20 svcrhost.exe 5 2->20         started        process3 file4 87 C:\Users\user\Desktop\xdel.exe, PE32 14->87 dropped 89 C:\Users\user\Desktopverything32.dll, PE32 14->89 dropped 91 C:\Users\user\Desktopverything.exe, PE32 14->91 dropped 93 7 other malicious files 14->93 dropped 175 Query firmware table information (likely to detect VMs) 14->175 177 Creates an undocumented autostart registry key 14->177 179 Self deletion via cmd or bat file 14->179 181 Creates multiple autostart registry keys 14->181 22 svcrhost.exe 5 14->22         started        25 cmd.exe 1 14->25         started        183 Connects to many different private IPs via SMB (likely to spread or exploit) 18->183 185 Connects to many different private IPs (likely to spread or exploit) 18->185 187 Hides threads from debuggers 18->187 27 svcrhost.exe 18->27         started        29 svcrhost.exe 18->29         started        31 svcrhost.exe 18->31         started        33 cmd.exe 18->33         started        189 Tries to detect sandboxes / dynamic malware analysis system (registry check) 20->189 191 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 20->191 signatures5 process6 signatures7 133 Antivirus detection for dropped file 22->133 135 Multi AV Scanner detection for dropped file 22->135 137 Query firmware table information (likely to detect VMs) 22->137 149 2 other signatures 22->149 35 svcrhost.exe 5 22->35         started        139 Uses ping.exe to sleep 25->139 141 Uses ping.exe to check the status of other devices and networks 25->141 38 fsutil.exe 1 25->38         started        41 conhost.exe 25->41         started        43 PING.EXE 1 25->43         started        143 Hides threads from debuggers 27->143 145 Tries to detect sandboxes / dynamic malware analysis system (registry check) 27->145 147 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 27->147 45 conhost.exe 33->45         started        process8 file9 117 Query firmware table information (likely to detect VMs) 35->117 119 Hides threads from debuggers 35->119 121 Tries to detect sandboxes / dynamic malware analysis system (registry check) 35->121 123 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 35->123 47 svcrhost.exe 5 35->47         started        85 C:\Users\user\Desktop\Old2.exe, data 38->85 dropped signatures10 process11 signatures12 193 Query firmware table information (likely to detect VMs) 47->193 195 Hides threads from debuggers 47->195 197 Tries to detect sandboxes / dynamic malware analysis system (registry check) 47->197 199 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 47->199 50 svcrhost.exe 5 47->50         started        process13 signatures14 109 Query firmware table information (likely to detect VMs) 50->109 111 Hides threads from debuggers 50->111 113 Tries to detect sandboxes / dynamic malware analysis system (registry check) 50->113 115 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 50->115 53 svcrhost.exe 5 50->53         started        process15 signatures16 125 Query firmware table information (likely to detect VMs) 53->125 127 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 53->127 129 Hides threads from debuggers 53->129 131 2 other signatures 53->131 56 svcrhost.exe 32 18 53->56         started        process17 dnsIp18 95 192.168.2.100 unknown unknown 56->95 97 192.168.2.101 unknown unknown 56->97 99 98 other IPs or domains 56->99 159 Query firmware table information (likely to detect VMs) 56->159 161 Creates an undocumented autostart registry key 56->161 163 Creates multiple autostart registry keys 56->163 165 6 other signatures 56->165 60 cmd.exe 56->60         started        62 svcrhost.exe 56->62         started        65 svcrhost.exe 56->65         started        67 14 other processes 56->67 signatures19 process20 signatures21 69 DC.exe 60->69         started        73 conhost.exe 60->73         started        167 Query firmware table information (likely to detect VMs) 62->167 169 Hides threads from debuggers 62->169 171 Tries to detect sandboxes / dynamic malware analysis system (registry check) 62->171 173 Tries to detect process monitoring tools (Task Manager, Process Explorer etc.) 65->173 75 conhost.exe 67->75         started        77 conhost.exe 67->77         started        79 conhost.exe 67->79         started        process22 file23 83 C:\Windows\System32behaviorgraphroupPolicy\gpt.ini, ASCII 69->83 dropped 151 Multi AV Scanner detection for dropped file 69->151 153 Allocates memory in foreign processes 69->153 155 Modifies Group Policy settings 69->155 157 Contains functionality to detect sleep reduction / modifications 69->157 81 DC.exe 69->81         started        signatures24 process25
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86/
Threat name:
Win32.Hacktool.DefenderControl
Create hunting rule
Status:
Malicious
First seen:
2025-05-10 11:10:05 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
25 of 36 (69.44%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cakxjgpva42s4n5dcm4tyjgvajashrne2vl7yueqss5nizjn3sda._file
Verdict:
malicious
Label(s):
admintool_powerrun
Create hunting rule
Similar samples:
10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86
Mimic
error
Mimic
Result
Malware family:
mimic
Create hunting rule
Score:
  10/10
Tags:
family:mimic defense_evasion discovery evasion execution persistence ransomware themida trojan
Link:
https://tria.ge/reports/250531-xny7wsgk2s/
Behaviour
Checks SCSI registry key(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System policy modification
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Command and Scripting Interpreter: PowerShell
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Adds Run key to start application
Checks whether UAC is enabled
Enumerates connected drives
Power Settings
Checks BIOS information in registry
Executes dropped EXE
Loads dropped DLL
Modifies system executable filetype association
Themida packer
Deletes System State backups
Event Triggered Execution: Image File Execution Options Injection
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Modifies boot configuration data using bcdedit
Detects Mimic ransomware
Mimic
Mimic family
UAC bypass
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/82894b7f-2e3f-4331-9113-73518c6e30ba
Unpacked files
SH256 hash:
10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86
MD5 hash:
dd9a743880f9a1d2fa90844304b73e5c
SHA1 hash:
77e84dd6b9af5f604868993387d8c4ee30fed0da
Link:
https://www.unpac.me/results/822cf078-390e-479a-97cd-071ee2b287e7/
SH256 hash:
c95d85240dcc5bd21111a54f0099d4929b7c4aa9a3dd8e9a3e46108e318dab4e
MD5 hash:
e64b61d8bab0f669e99478a4ac0381b0
SHA1 hash:
ea901ed2d6f48fc894955a4ce50d748f86c252a2
Detections:
Detect_Mimic_Ransomware
Create hunting rule
INDICATOR_EXE_Packed_Themida
Create hunting rule
INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
INDICATOR_SUSPICIOUS_USNDeleteJournal
Create hunting rule
Link:
https://www.unpac.me/results/822cf078-390e-479a-97cd-071ee2b287e7/
SH256 hash:
17761109c6028abc1bb183d6b200daab3c8eca241797fe562ca25a020e38c354
MD5 hash:
50b928a80a1c984012a4461433b15ccf
SHA1 hash:
61aaba67299be9a060a2a8dc30ea26b63b7573bc
Link:
https://www.unpac.me/results/822cf078-390e-479a-97cd-071ee2b287e7/
SH256 hash:
3e5118d54e5ceff61341baee13839f3cb79ec3533cb99591698f551273cd1f85
MD5 hash:
149771b42c70e468397aedf1ec56824e
SHA1 hash:
65a1eb47b02030223964d862dc992499570d97c7
Link:
https://www.unpac.me/results/822cf078-390e-479a-97cd-071ee2b287e7/
SH256 hash:
2aae82d3f537383f5b6183c7ea4b86867ac4e434b4274efdf9a019fdffc99a15
MD5 hash:
f686fbdabcaeb077f8e068df6ea789e3
SHA1 hash:
71d14f1854049de246f566a6df69cf4f0f57ffac
Link:
https://www.unpac.me/results/822cf078-390e-479a-97cd-071ee2b287e7/
SH256 hash:
7144db3a2d73a1927c4eec18e890e273eb76f146c20e8ec553668508aff01029
MD5 hash:
9ed7cf457034e76d2ac94fb066a23dfd
SHA1 hash:
e18a04a06b328908604765fb519888aad42ff490
Detections:
AutoIT_Compiled
Create hunting rule
INDICATOR_TOOL_PET_DefenderControl
Create hunting rule
Link:
https://www.unpac.me/results/822cf078-390e-479a-97cd-071ee2b287e7/
Parent samples :
3a0ab5c065a213ec77176d5a29720d5b7254a89625b6caa53507c8456f0be456
10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86
SH256 hash:
dcb842f5e0da9d486cad34d4b809dcaadf9ec4d6991fdb22bdc9aea66489ad1a
MD5 hash:
c02a029c978f13b753c6b578b1588c75
SHA1 hash:
e125d59451e7f467bfd329a00a506decbcd91d83
Link:
https://www.unpac.me/results/822cf078-390e-479a-97cd-071ee2b287e7/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Sandworm_ArguePatch_Apr_2022_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Mimic_Ransomware
Create hunting rule
Author:@MalGamy12
Description:Detect_Mimic_Ransomware
Rule name:EXE_Ransomware_Mimic
Create hunting rule
Author:Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
Description:Detects Mimic ransomware samples based on the strings matched
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HUNTING_SUSP_TLS_SECTION
Create hunting rule
Author:chaosphere
Description:Detect PE files with .tls section that can be used for anti-debugging
Reference:Practical Malware Analysis - Chapter 16
Rule name:INDICATOR_EXE_Packed_Themida
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with Themida
Rule name:INDICATOR_SUSPICIOUS_ClearWinLogs
Create hunting rule
Author:ditekSHen
Description:Detects executables containing commands for clearing Windows Event Logs
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:INDICATOR_SUSPICIOUS_GENRansomware
Create hunting rule
Author:ditekSHen
Description:Detects command variations typically used by ransomware
Rule name:INDICATOR_SUSPICIOUS_USNDeleteJournal
Create hunting rule
Author:ditekSHen
Description:Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:Win32_Ransomware_Elpaco
Create hunting rule
Author:ReversingLabs
Description:Yara rule that detects Elpaco ransomware.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mimic

Executable exe 10157499f507352e37a313393c24d5024123c5a4d557fc509094bad4652ddc86

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/6576/
  
URLhaus
https://urlhaus.abuse.ch/url/3556093/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_TRUST_INFORequires Elevated Execution (uiAccess:None)high
Reviews
IDCapabilitiesEvidence
NET_SHARE_APICan access Network ShareNETAPI32.dll::NetShareEnum
WIN_BASE_USER_APIRetrieves Account InformationADVAPI32.dll::LookupAccountSidW
WIN_BCRYPT_APICan Encrypt Filesbcrypt.dll::BCryptGenRandom
WIN_NETWORK_APISupports Windows NetworkingMPR.dll::WNetOpenEnumW

Comments