MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mimic

Vendor detections: 14

Intelligence 14 IOCs YARA 25 File information Comments

SHA256 hash:	b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc
SHA3-384 hash:	ba0089ea8304660f83caadf763c5ceab0fa172b287359866ee5c059da2cd17258d16f187867ac9285fec8378e938b7cc
SHA1 hash:	09ef304885e654bc8ad29ce51c989d13f07e7e0b
MD5 hash:	d9c0acff321c0bbfaf27cb440e6ee9be
humanhash:	moon-mexico-juliet-september
File name:	000_PP0_100-43.exe
Download:	download sample
Signature	Mimic Create hunting rule
File size:	2'393'600 bytes
First seen:	2026-05-31 13:33:52 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5db996f530c574ab3c34e6ed3f1396a6 (1 x Mimic)
ssdeep	49152:5lhR5no/qrf5EQlRUhNAw6IN0ny2C7OoZGtPENNCrRH96x9k484:5lhRuiVhG/o80ny2CnZGaHCv6
Threatray	17 similar samples on MalwareBazaar
TLSH	T16BB5D002FBC28172E193467491B6A77F8A3ABA249734C5C797D01D7989313C36A3F3A5
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Alex_sev
Tags:	Encoder exe filecoder Mimic Ransom Ransomware

Intelligence

File Origin

# of uploads :

# of downloads :

504

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

000_PP0_100-43.exe

Verdict:

No threats detected

Analysis date:

2026-05-31 13:32:08 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/53be60f9-5a6c-4628-9a2e-760f9285f06e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/68606/

Detection(s):

Win.Ransomware.Mimic-10002067-0

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a1c38575a2e3b5e58e48d68

Tags:

ransomware shellcode dropper

Result

Verdict:

Malware

Maliciousness:

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug base64 crypto evasive evasive expand fingerprint keylogger lolbin microsoft_visual_cc packed ransomware ransomware reconnaissance

Link:

https://www.filescan.io/uploads/6a1c38db099ef368af111670/reports/3739e2b0-b369-4e60-a0e3-c0fb15192713/overview

Verdict:

Malicious

Labled as:

Gen:Ransom.REntS.Generic

Link:

https://www.hybrid-analysis.com/sample/b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-31T10:42:00Z UTC

Last seen:

2026-06-01T23:23:00Z UTC

Hits:

~10

Detections:

Trojan-Ransom.Win32.Mimic.sb HEUR:Trojan-Ransom.Win32.Mimic.gen HEUR:Trojan-Ransom.Win32.Generic

Link:

https://opentip.kaspersky.com/b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc/results?tab=lookup

Malware family:

Mimic Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1feb25a4-717a-47d6-b8eb-ac3cb18f8f18

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc/

Threat name:

Win32.Ransomware.REntS

Status:

Malicious

First seen:

2026-05-31 13:32:18 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 36 (77.78%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ws57m3d547qx3ihwzn5i43yvtovpe5c6ob2cumatfri2jij6nd6a._file

Verdict:

malicious

Label(s):

mimicransomware

Mimic

2423f6e4b6f015042c4de4a4ad457629b7c4737ec19352abac9dd6136ba46d68

Mimic

9f6a696876fee8b811db8889bf4933262f4472ad41daea215d2e39bd537cf32f

Mimic

b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc

Mimic

b600e06f14e29b03f0b1456723a430b5024816518d704a831dde2dc9597ce9c9

Mimic

e160d7d21c917344f010e58dcfc1e19bec6297c294647a06ce60efc7420d3b13

Mimic

error

Mimic

+ 7 additional samples on MalwareBazaar

Result

Malware family:

mimic

Score:

10/10

Tags:

family:mimic ransomware

Link:

https://tria.ge/reports/260531-qt7b5abx2m/

Unpacked files

SH256 hash:

b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc

MD5 hash:

d9c0acff321c0bbfaf27cb440e6ee9be

SHA1 hash:

09ef304885e654bc8ad29ce51c989d13f07e7e0b

Detections:

triage_mimic_ransomware

triage_red_ransomware

Link:

https://www.unpac.me/results/630ba094-eb65-4dcd-9626-8f1960f578e6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b4bbf66c7de7e17da0f6cb7a8e6f159baaf2745e70742a30132c51a4a13e68fc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_Sandworm_ArguePatch_Apr_2022_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:	https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Detect_Mimic_Ransomware Create hunting rule
Author:	@MalGamy12
Description:	Detect_Mimic_Ransomware

Rule name:	EXE_Ransomware_Mimic Create hunting rule
Author:	Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell
Description:	Detects Mimic ransomware samples based on the strings matched

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_ClearWinLogs Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing commands for clearing Windows Event Logs

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	INDICATOR_SUSPICIOUS_GENRansomware Create hunting rule
Author:	ditekSHen
Description:	Detects command variations typically used by ransomware

Rule name:	INDICATOR_SUSPICIOUS_USNDeleteJournal Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in ransomware

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/68606/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample