MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 320a2103e7dba828db31a8ec2f42ae301ecf1a666e42ac1dfeb7c3ae81e3d6eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MimiKatz


Vendor detections: 10


Intelligence 10 IOCs YARA 33 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 320a2103e7dba828db31a8ec2f42ae301ecf1a666e42ac1dfeb7c3ae81e3d6eb
SHA3-384 hash: 7e678afb25723314fa2a8039a51682c928dd97b13c142657f728438881ded72b130300c53036e88ff5561574c6646ccb
SHA1 hash: 25919bcacb25d0aec63b8767c60fdc0a44ac74e9
MD5 hash: 0a29c95bfbc8b14ee85c7c7481eeda5a
humanhash: oranges-high-december-lithium
File name:win32-telegram.msi
Download: download sample
Signature MimiKatz
Create hunting rule
File size:65'857'536 bytes
First seen:2026-01-23 04:17:28 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 1572864:xucq/mvvgkLE5KRLBMzBe56lhyI0KnaY4M/xhC:xXZvgshiT3yKaY4M/
TLSH T12CE7333175CE8374E5BE92705561DF2E92F53ED007B080EB83E4A86B5E369C1493AB63
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter zhuzhu0009
Tags:mimikatz msi

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
JP JP
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/5848e31b-70bd-4339-93df-aff6ee9e122c/
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6972f6a0bcad3327ec07e035
Tags:
remo blic hype
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm CAB cmd evasive expired-cert farfli fingerprint fingerprint fingerprint installer keylogger lolbin lolbin netsh obfuscated overlay packed schtasks wix
Link:
https://www.filescan.io/uploads/6972f69455805a763ff1b764/reports/132a0361-1a60-41d1-8790-88b13ab66783/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/320a2103e7dba828db31a8ec2f42ae301ecf1a666e42ac1dfeb7c3ae81e3d6eb
Verdict:
Malicious
File Type:
msi
First seen:
2026-01-23T01:33:00Z UTC
Last seen:
2026-01-23T18:48:00Z UTC
Hits:
~10
Detections:
Trojan-Spy.Win32.Agent.sb Trojan.Win32.Yakes Backdoor.Win32.Lotok.sbc Trojan.Win32.Zenpak.sb Trojan.Win32.Shella.kz Trojan.Win32.Agentb.bxom HEUR:Backdoor.Win32.nimpl.a Backdoor.Win32.Zegost.sb Backdoor.Win32.Gulpix.sb Backdoor.Win32.Farfli.sb
Link:
https://opentip.kaspersky.com/320a2103e7dba828db31a8ec2f42ae301ecf1a666e42ac1dfeb7c3ae81e3d6eb/results?tab=lookup
Score:
76%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/320a2103e7dba828db31a8ec2f42ae301ecf1a666e42ac1dfeb7c3ae81e3d6eb
Gathering data
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/320a2103e7dba828db31a8ec2f42ae301ecf1a666e42ac1dfeb7c3ae81e3d6eb
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-01-23 04:18:39 UTC
File Type:
Binary (Archive)
Extracted files:
879
AV detection:
5 of 24 (20.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gifcca7h3oucrwzrvdwc6qvogapm6gtgnzbkyhp6w7b25apd23vq._file
Verdict:
malicious
Label(s):
fatalrat
Create hunting rule
hiddengh0st
Create hunting rule
Similar samples:
error
MimiKatz
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/260123-ew8r7ahx4a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Enumerates connected drives
Loads dropped DLL
Malware family:
HiddenGh0st
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/320a2103e7db/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:cert_blocklist_5f78149eb4f75eb17404a8143aaeaed7
Create hunting rule
Author:ReversingLabs
Description:Certificate used for digitally signing malware.
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_MSI_LATAM_Banker_From_LatAm
Create hunting rule
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Hidden
Create hunting rule
Author:@bartblaze
Description:Identifies Hidden Windows driver, used by malware such as PurpleFox.
Reference:https://github.com/JKornev/hidden
Rule name:INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
Create hunting rule
Author:ditekSHen
Description:Detects executables calling ClearMyTracksByProcess
Rule name:INDICATOR_TOOL_RTK_HiddenRootKit
Create hunting rule
Author:ditekSHen
Description:Detects the Hidden public rootkit
Rule name:JKornevHidden
Create hunting rule
Author:Still
Description:attempts to match the strings found in JKornev's Hidden rootkit
Rule name:MALWARE_Win_FatalRAT
Create hunting rule
Author:ditekSHen
Description:Detects FatalRAT
Rule name:MALWARE_Win_PCRat
Create hunting rule
Author:ditekSHen
Description:Detects PCRat / Gh0st
Rule name:MALWARE_Win_Zegost
Create hunting rule
Author:ditekSHen
Description:Detects Zegost
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:Mimikatz_Strings
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Mimikatz strings
Reference:not set
Rule name:Mimikatz_Strings_RID2DA0
Create hunting rule
Author:Florian Roth
Description:Detects Mimikatz strings
Reference:not set
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:Windows_Shellcode_Rdi_eee75d2c
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Gh0st_ee6de6bc
Create hunting rule
Author:Elastic Security
Description:Identifies a variant of Gh0st Rat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments