MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MimiKatz

Vendor detections: 8

Intelligence 8 IOCs YARA 27 File information Comments

SHA256 hash:	7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5
SHA3-384 hash:	61072c17a5dae1c10a4b88c9892f6469a7bdf5c70dd4e84a8731ac42f736b8952e8514b86957ad52d6a44ce01e3baf2d
SHA1 hash:	4112ef95386ea4d1131be7c600d49a310e9d8f5b
MD5 hash:	d2d3e1f8023b12fb89e400c7e8ecd7db
humanhash:	california-nineteen-xray-north
File name:	mimikatz_trunk.zip
Download:	download sample
Signature	MimiKatz Create hunting rule
File size:	1'206'166 bytes
First seen:	2023-07-05 11:47:16 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:YH9iKnN1lvn928lSnigsGXLwVOoEP2qMkKDYLUPMzahK:+X5vn9HlSigsGbwVOoAlRaYLUUr
TLSH	T14F45339B666BD02AF84D79AC6CFE12AFF17482EC70C6E45644E04090ABF391E5F13487
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	JAMESWT_WT
Tags:	45-83-107-75--8080 mimikatz zip

Intelligence

File Origin

# of uploads :

# of downloads :

166

Origin country :

File Archive Information

This file archive contains 8 file(s), sorted by their relevance:

File name:	mimilove.exe
File size:	25'088 bytes
SHA256 hash:	cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef
MD5 hash:	c67f3497c310c01018f599b3eebae99e
MIME type:	application/x-dosexec
Signature	MimiKatz

File name:	kiwi_passwords.yar
File size:	2'834 bytes
SHA256 hash:	25b0c720edf459b98346692d52c094abc92bae6b9e1309b7ab6f11057d605e21
MD5 hash:	21cb5b54ab42c19f66a10e839f789d64
MIME type:	text/plain
Signature	MimiKatz

File name:	mimikatz.exe
File size:	1'355'264 bytes
SHA256 hash:	61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
MD5 hash:	29efd64dd3c7fe1e2b022b7ad73a1ba5
MIME type:	application/x-dosexec
Signature	MimiKatz

File name:	mimidrv.sys
File size:	37'208 bytes
SHA256 hash:	d30f51bfd62695df96ba94cde14a7fae466b29ef45252c6ad19d57b4a87ff44e
MD5 hash:	3e528207ca374123f63789195a4aedde
MIME type:	application/x-dosexec
Signature	MimiKatz

File name:	README.md
File size:	5'211 bytes
SHA256 hash:	c905322e2b68c1fdc30cef2be3d94ea12a9df3ec08faba25c1a16f58892bc68d
MD5 hash:	389833fb7cb7ceb525e914f0f36f2d40
MIME type:	text/plain
Signature	MimiKatz

File name:	mimicom.idl
File size:	2'850 bytes
SHA256 hash:	51d45e6c5df6b43b17afc863794f34000d32fb37cd7c3664efc5bd99039ac3df
MD5 hash:	ca47e27329203c266372d04475db2c57
MIME type:	text/plain
Signature	MimiKatz

File name:	mimispool.dll
File size:	10'752 bytes
SHA256 hash:	66928c3316a12091995198710e0c537430dacefac1dbe78f12a331e1520142bd
MD5 hash:	c6cc0def7d584f431d69126c1cc33a20
MIME type:	application/x-dosexec
Signature	MimiKatz

File name:	mimilib.dll
File size:	37'376 bytes
SHA256 hash:	aef6ce3014add838cf676b57957d630cd2bb15b0c9193cf349bcffecddbc3623
MD5 hash:	67651e9d2da634adedbe216948d5f752
MIME type:	application/x-dosexec
Signature	MimiKatz

Vendor Threat Intelligence

Detection(s):

Win.Tool.Mimikatz-9862656-0

Win.Tool.Mimikatz-9862659-0

Win.Dropper.Mimikatz-9778171-1

Win.Trojan.Mimikatz-6466236-0

Win.Tool.Mimikatz-9741197-0

TwinWave.MimiKatz.x64.20191220.UNOFFICIAL

SecuriteInfo.com.Variant.Mimikatz.10.13505.30150.UNOFFICIAL

SecuriteInfo.com.Variant.Mimikatz.10.19521.23015.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

90%

Tags:

anti-vm hacktool hacktool mikatz mimikatz windows

Link:

https://www.filescan.io/uploads/64a55874e1a5d9d48068f7c0/reports/4abdfd69-e3bc-4bfb-8a1a-d31d36375941/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5/

Threat name:

Win32.Hacktool.Mimikatz

Status:

Malicious

First seen:

2022-09-19 22:46:00 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

31 of 38 (81.58%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=plgnc6piu2zpzed6p2gqq7csu72ibbefe4slapjfx26k3inmxssq._file

Result

Malware family:

mimikatz

Score:

10/10

Tags:

family:mimikatz

Link:

https://tria.ge/reports/230705-n31vlade8w/

Behaviour

mimikatz is an open source tool to dump credentials on Windows

Mimikatz

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7accd179e8a6b2fc907e7e8d087c52a7f48084852724b03d25bebcada1acbca5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	crime_generic_DLL_exports_Sep2021_1 Create hunting rule
Author:	Nils Kuhnert
Description:	Triggers on malicious DLLs distributed along LNK files in ISO attachments.

Rule name:	HKTL_mimikatz_icon Create hunting rule
Author:	Arnim Rupp
Description:	Detects mimikatz icon in PE file
Reference:	https://blog.gentilkiwi.com/mimikatz

Rule name:	HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mimikatz SkeletonKey in Memory
Reference:	https://twitter.com/sbousseaden/status/1292143504131600384?s=12

Rule name:	HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1_RID3752 Create hunting rule
Author:	Florian Roth
Description:	Detects Mimikatz SkeletonKey in Memory
Reference:	https://twitter.com/sbousseaden/status/1292143504131600384?s=12

Rule name:	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing SQL queries to confidential data stores. Observed in infostealers

Rule name:	INDICATOR_TOOL_EXP_PetitPotam01 Create hunting rule
Author:	ditekSHen
Description:	Detect tool potentially exploiting/attempting PetitPotam

Rule name:	INDICATOR_TOOL_PWS_Mimikatz Create hunting rule
Author:	ditekSHen
Description:	Detects Mimikatz

Rule name:	mimikatz Create hunting rule
Author:	Benjamin DELPY (gentilkiwi)
Description:	mimikatz

Rule name:	Mimikatz_Generic Create hunting rule
Author:	Still
Description:	attempts to match all variants of Mimikatz

Rule name:	Mimikatz_Gen_Strings Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mimikatz by using some special strings
Reference:	Internal Research

Rule name:	Mimikatz_Gen_Strings_RID2F19 Create hunting rule
Author:	Florian Roth
Description:	Detects Mimikatz by using some special strings
Reference:	Internal Research

Rule name:	mimikatz_kiwikey Create hunting rule
Author:	SBousseaden
Description:	hunt for default mimikatz kiwikey

Rule name:	mimikatz_memssp_hookfn Create hunting rule
Author:	SBousseaden
Description:	hunt for default mimikatz memssp module both ondisk and in memory artifacts

Rule name:	Mimikatz_Strings Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mimikatz strings
Reference:	not set

Rule name:	Mimikatz_Strings_RID2DA0 Create hunting rule
Author:	Florian Roth
Description:	Detects Mimikatz strings
Reference:	not set

Rule name:	Powerkatz_DLL_Generic Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Reference:	PowerKatz Analysis

Rule name:	Powerkatz_DLL_Generic_RID2F2F Create hunting rule
Author:	Florian Roth
Description:	Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Reference:	PowerKatz Analysis

Rule name:	Windows_Hacktool_Mimikatz_1388212a Create hunting rule

Rule name:	Windows_Hacktool_Mimikatz_1388212a Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Hacktool_Mimikatz_674fd079 Create hunting rule
Description:	Detection for default mimikatz memssp module

Rule name:	Windows_Hacktool_Mimikatz_674fd079 Create hunting rule
Author:	Elastic Security
Description:	Detection for default mimikatz memssp module

Rule name:	win_mimikatz_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.mimikatz.

Rule name:	win_mimikatz_w0 Create hunting rule
Author:	Benjamin DELPY (gentilkiwi)
Description:	mimikatz

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample