MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86e69b16379a3aa41a658af413ea71364341da11e2f7d724dcefeac6eaa504ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MimiKatz


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86e69b16379a3aa41a658af413ea71364341da11e2f7d724dcefeac6eaa504ec
SHA3-384 hash: 9060898751d8645ff4d615a49019f7379ab17b7b6a38df05c46236e7742b8aaee3dbdefcf3a1ebc41953cf80e54c01e8
SHA1 hash: e1576fdb246ad87c9403ede37c7006f397822fab
MD5 hash: f6af8bc93dce19394a82f59d045056d4
humanhash: thirteen-salami-dakota-red
File name:点‍击安‍装纸‍飞‍机-简‍体中文语言包 (3).exe
Download: download sample
Signature MimiKatz
Create hunting rule
File size:3'811'402 bytes
First seen:2022-05-16 13:07:13 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1ff847646487d56f85778df99ff3728a (4 x RedLineStealer, 3 x Nitol, 2 x Gh0stRAT)
ssdeep 98304:Q06FOznLo0+Dd6uxc8M0thVtcFO+U6QdK8KIWx:Q3F6n80W6uG8M+zcFbU691x
Threatray 22 similar samples on MalwareBazaar
TLSH T1F5062383F6C2C071E86500B944669AB60E766D3257BAD5F36FD07D2ABE702D0EB31247
TrID 68.5% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
10.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.2% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
3.6% (.EXE) Win64 Executable (generic) (10523/12/4)
2.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon dc39333333353536 (1 x Gh0stRAT, 1 x MimiKatz)
Reporter obfusor
Tags:exe mimikatz RAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
点‍击安‍装纸‍飞‍机-简‍体中文语言包 (3).exe
Verdict:
No threats detected
Analysis date:
2022-05-16 23:15:46 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7346d34d-2a9c-4c39-a5ee-62e9cea80242

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/271143/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for synchronization primitives
Creating a window
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/18014/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CheckCmdLine
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware obfuscated overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/62824c8acc43366302ce0d39/reports/e8b52197-5ce1-42ea-a14c-cf7f00fbf87d/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2c07c39c-7bd6-4ca7-88ef-3f51dfbcf252
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/994941
Signature
Antivirus detection for dropped file
Machine Learning detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86e69b16379a3aa41a658af413ea71364341da11e2f7d724dcefeac6eaa504ec/
Verdict:
unknown
Similar samples:
0e3e35413de5649d66d3ae80a50c0d441f906343b0261b755a8cb72cd3e5efa2
MimiKatz
47c57530b5b6de027182a6e4fed09bdae9e57cebc090fb52ce948d72e75ca663
MimiKatz
4e825059cdc8c2116ff7737eead0e6482a2cbf0a5790deadd89202a4058765bd
MimiKatz
725f81ee466371300ed43441bc35239089dd5283b8831193699b091fb2ad928c
MimiKatz
72df0397893e1ac981063fbcc0ad048543ba7143ba824f2bb0aa5dfb61538ce6
MimiKatz
85ac0e8244160430f8ca3d4fb031180ccf656a2d524a8fc2c828379c1c7b9e5f
MimiKatz
94b06e33dfece175f9a41ecf6e1ae4aefbe23ec591e8302eeadf8bbe26f23354
MimiKatz
9aa78623c847c8344516bc815b9c055db994d9ee28c59a0102e1024b9706dbce
MimiKatz
d3c87bbd2121958c5beb20738999cf1d6938237d92fd98d19ba0bda2effde25a
MimiKatz
fb6eae45c38c680a2580247feed29592f40ab479339244c58b7f3397e773fbcd
MimiKatz
+ 12 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220516-qc7xbsfbdj/
Unpacked files
SH256 hash:
a68da61104ab7335ffd24ce3d21388ca25e3ba85d607f1c613dd74aa916b68e2
MD5 hash:
37f83679e14176363835673f5b2d1851
SHA1 hash:
86f3af839e02e75d8a31b476f34f3569263729f5
Link:
https://www.unpac.me/results/22892b49-0bd2-4986-9523-36c000b6d07f/
SH256 hash:
b72faa4e0606b0f5e8576ecb42e81a1e684f579eafed74f5eb2b9c158ab5799a
MD5 hash:
3488c418b85d6a0b8f4f54be297047fc
SHA1 hash:
b74fc0525019c23c39455b9fbdb5ee62c93ed128
Link:
https://www.unpac.me/results/22892b49-0bd2-4986-9523-36c000b6d07f/
SH256 hash:
131b5f5e179e8e4ef4252616e0372184db70bc3a5095ae7902698ec2095048ef
MD5 hash:
2d2ae412ba2048089cdd0864b79b7f8c
SHA1 hash:
19a4878e62b4b5ba860166d106c5c8a45e4e2055
Link:
https://www.unpac.me/results/22892b49-0bd2-4986-9523-36c000b6d07f/
SH256 hash:
86e69b16379a3aa41a658af413ea71364341da11e2f7d724dcefeac6eaa504ec
MD5 hash:
f6af8bc93dce19394a82f59d045056d4
SHA1 hash:
e1576fdb246ad87c9403ede37c7006f397822fab
Link:
https://www.unpac.me/results/22892b49-0bd2-4986-9523-36c000b6d07f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86e69b16379a3aa41a658af413ea71364341da11e2f7d724dcefeac6eaa504ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_PCRat
Create hunting rule
Author:ditekSHen
Description:Detects PCRat / Gh0st
Rule name:Mimikatz_Strings
Create hunting rule
Author:Florian Roth
Description:Detects Mimikatz strings
Reference:not set
Rule name:Mimikatz_Strings_RID2DA0
Create hunting rule
Author:Florian Roth
Description:Detects Mimikatz strings
Reference:not set

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/271143/

Comments