MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mimikatz


Vendor detections: 18


Intelligence 18 IOCs YARA 37 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7
SHA3-384 hash: a3be6ab7ec83d198d99a3e400e4283fa12aac666a2b287bd630b381c4c9d3c1d2aed79496c97b02989a53dbfec90433c
SHA1 hash: c9fb7f8a4c6b7b12b493a99a8dc6901d17867388
MD5 hash: 465d5d850f54d9cde767bda90743df30
humanhash: nitrogen-hawaii-freddie-yankee
File name:file
Download: download sample
Signature Mimikatz
Create hunting rule
File size:1'263'880 bytes
First seen:2024-12-10 20:25:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 18353e2ca55d79f0bc0fa69907f387fc (1 x Mimikatz)
ssdeep 24576:rcNpUB3HpYXyYTqXAgwBpK5xNcS7wV+LVQ/zReUzuSmV:rcLwWuwqBe4xQ7ReUi1
Threatray 12 similar samples on MalwareBazaar
TLSH T1B8451941A7E940A8F1B79AB59EF19117DBB378D51834C30F02A88B5B1F73F619D29322
TrID 60.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
17.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
10.9% (.EXE) Win64 Executable (generic) (10522/11/4)
5.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
2.1% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
dhash icon e1cd969ac674f863 (19 x MimiKatz)
Reporter jstrosch
Tags:exe mimikatz signed X64

Code Signing Certificate

Organisation:Open Source Developer, Benjamin Delpy
Issuer:Certum Code Signing CA SHA2
Algorithm:sha256WithRSAEncryption
Valid from:2019-12-05T23:00:00Z
Valid to:2020-12-04T23:00:00Z
Serial number: 10a92b2ac8aa8476b6c7232ec0a9e6fa
Intelligence: 9 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 340ca8eabf97af90d540acf6802728fa1d841d9aeecc065a33fcf9e89d16e62e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
jstrosch
Found at hxxp://89.197.154[.]116/mimikatz.exe by #subcrawl

Intelligence

File Origin
# of uploads :
1
# of downloads :
461
Origin country :
CA CA
Vendor Threat Intelligence
Malware family:
mimikatz
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2024-12-10 20:34:31 UTC
Tags:
mimikatz tools
Link:
https://app.any.run/tasks/1756c563-59a3-421b-9c75-dc0a3a04e445

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
Win.Tool.Mimikatz-9862700-0
Create hunting rule

Win.Dropper.Mimikatz-9778171-1
Create hunting rule

Win.Trojan.Mimikatz-6466236-2
Create hunting rule

TwinWave.MimiKatz.x64.20191220.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6758a4e2ba01dca62669926e
Tags:
infosteal mimikatz emotet
Result
Verdict:
Malware
Maliciousness:
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto explorer fingerprint greyware hacktool lolbin microsoft_visual_cc mimikatz powerkatz regedit remote skeletonkey
Link:
https://www.filescan.io/uploads/6758a3e265406d1ff351bf62/reports/e8132657-334c-40e0-89da-b6e78ac882dc/overview
Verdict:
Malicious
Labled as:
Trojan.Mimikatz.Marte..Generic
Link:
https://www.hybrid-analysis.com/sample/cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/878203bf-56c6-450e-9cb7-ca1899e3acdd
Result
Threat name:
Mimikatz
Create hunting rule
Detection:
malicious
Classification:
troj.expl
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/515585
Behaviour
Behavior Graph:
n/a
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7/
Threat name:
Win64.Hacktool.Mimikatz
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 07:38:01 UTC
File Type:
PE+ (Exe)
Extracted files:
6
AV detection:
36 of 38 (94.74%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zmkvhi6iral6jtdxjjnjh6ivr5tylpjycvch2bfwyp2mfrfsd3lq._file
Verdict:
malicious
Label(s):
mimikatz
Create hunting rule
Similar samples:
417c70e912ee8b64ae8ace9044c5ce86f5679b38dc87cb6934c7fdb11d4b0632
Mimikatz
5ea61a39ffd3f7b295a5dbb84f1d7dff63bf7b72e0c072ea15f0ac0e434012f4
Mimikatz
cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7
Mimikatz
d55c12594e0814ae3e2730ccd38bc61f3e2ce948911be016f6119cfab8397c30
Mimikatz
da22c3632239f33fc51ca0b7617c606d60f3b1dd3a225b01febed0602553fe15
Mimikatz
ebce499de915d8837bdbd47be0ac19cd6382d52904951fac75484947dfd88aab
Mimikatz
error
Mimikatz
+ 2 additional samples on MalwareBazaar
Result
Malware family:
mimikatz
Create hunting rule
Score:
  10/10
Tags:
family:mimikatz
Link:
https://tria.ge/reports/241210-y7t8qasnbj/
Verdict:
Malicious
Tags:
red_team_tool mimikatz trojan dll powerkatz Win.Tool.Mimikatz-9862700-0
YARA:
hacktool_windows_mimikatz_copywrite hacktool_windows_mimikatz_modules Windows_Hacktool_Mimikatz_1388212a Windows_Hacktool_Mimikatz_674fd079 Mimikatz_Gen_Strings mimikatz Mimikatz_Strings HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1 HKTL_mimikatz_icon INDICATOR_TOOL_PWS_Mimikatz Mimikatz_Kiwikey Powerkatz_DLL_Generic
Link:
https://app.threat.zone/submission/f5c50079-bb65-4176-9155-5f80c0822f75
Unpacked files
SH256 hash:
cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7
MD5 hash:
465d5d850f54d9cde767bda90743df30
SHA1 hash:
c9fb7f8a4c6b7b12b493a99a8dc6901d17867388
Detections:
win_mimikatz_w0
Create hunting rule
win_mimikatz_auto
Create hunting rule
Link:
https://www.unpac.me/results/0275e1d2-c703-4c07-bf6c-76328e9652a4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:HackTool_Producers
Create hunting rule
Description:Hacktool Producers String
Rule name:HKTL_mimikatz_icon
Create hunting rule
Author:Arnim Rupp
Description:Detects mimikatz icon in PE file
Reference:https://blog.gentilkiwi.com/mimikatz
Rule name:HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Mimikatz SkeletonKey in Memory
Reference:https://twitter.com/sbousseaden/status/1292143504131600384?s=12
Rule name:HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1_RID3752
Create hunting rule
Author:Florian Roth
Description:Detects Mimikatz SkeletonKey in Memory
Reference:https://twitter.com/sbousseaden/status/1292143504131600384?s=12
Rule name:INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
Create hunting rule
Author:ditekSHen
Description:Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Rule name:INDICATOR_TOOL_PWS_Mimikatz
Create hunting rule
Author:ditekSHen
Description:Detects Mimikatz
Rule name:mimikatz
Create hunting rule
Author:Benjamin DELPY (gentilkiwi)
Description:mimikatz
Rule name:Mimikatz_Generic
Create hunting rule
Author:Still
Description:attempts to match all variants of Mimikatz
Rule name:Mimikatz_Gen_Strings
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Mimikatz by using some special strings
Reference:Internal Research
Rule name:Mimikatz_Gen_Strings_RID2F19
Create hunting rule
Author:Florian Roth
Description:Detects Mimikatz by using some special strings
Reference:Internal Research
Rule name:mimikatz_kiwikey
Create hunting rule
Author:SBousseaden
Description:hunt for default mimikatz kiwikey
Rule name:mimikatz_memssp_hookfn
Create hunting rule
Author:SBousseaden
Description:hunt for default mimikatz memssp module both ondisk and in memory artifacts
Rule name:Mimikatz_Samples_2014b_Family_2
Create hunting rule
Author:Florian Roth with the help of YarGen Rule Generator
Description:Mimikatz pwassword dumper samples from the second half of 2014
Rule name:Mimikatz_Strings
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Mimikatz strings
Reference:not set
Rule name:Mimikatz_Strings_RID2DA0
Create hunting rule
Author:Florian Roth
Description:Detects Mimikatz strings
Reference:not set
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Powerkatz_DLL_Generic
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Reference:PowerKatz Analysis
Rule name:Powerkatz_DLL_Generic_RID2F2F
Create hunting rule
Author:Florian Roth
Description:Detects Powerkatz - a Mimikatz version prepared to run in memory via Powershell (overlap with other Mimikatz versions is possible)
Reference:PowerKatz Analysis
Rule name:RansomPyShield_Antiransomware
Create hunting rule
Author:XiAnzheng
Description:Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Hacktool_Mimikatz_1388212a
Create hunting rule
Rule name:Windows_Hacktool_Mimikatz_1388212a
Create hunting rule
Author:Elastic Security
Rule name:Windows_Hacktool_Mimikatz_674fd079
Create hunting rule
Description:Detection for default mimikatz memssp module
Rule name:Windows_Hacktool_Mimikatz_674fd079
Create hunting rule
Author:Elastic Security
Description:Detection for default mimikatz memssp module
Rule name:win_mimikatz_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.mimikatz.
Rule name:win_mimikatz_w0
Create hunting rule
Author:Benjamin DELPY (gentilkiwi)
Description:mimikatz

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mimikatz

Executable exe cb1553a3c88817e4cc774a5a93f9158f6785bd3815447d04b6c3f4c2c4b21ed7

(this sample)

  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
Reviews
IDCapabilitiesEvidence
AUTH_APIManipulates User AuthorizationADVAPI32.dll::AllocateAndInitializeSid
ADVAPI32.dll::ConvertSidToStringSidW
ADVAPI32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW
ADVAPI32.dll::ConvertStringSidToSidW
ADVAPI32.dll::CopySid
ADVAPI32.dll::CreateWellKnownSid
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
DNS_APIPerforms DNS callsDNSAPI.dll::DnsQuery_A
DP_APIUses DP APICRYPT32.dll::CryptProtectData
CRYPT32.dll::CryptUnprotectData
KERNEL_APIManipulates Windows Kernel & Driversntdll.dll::RtlInitUnicodeString
NET_SHARE_APICan access Network ShareNETAPI32.dll::NetSessionEnum
NETAPI32.dll::NetShareEnum
NETAPI32.dll::NetStatisticsGet
RPC_APICan Execute Remote ProceduresRPCRT4.dll::MesDecodeIncrementalHandleCreate
RPCRT4.dll::MesEncodeIncrementalHandleCreate
RPCRT4.dll::MesHandleFree
RPCRT4.dll::MesIncrementalHandleReset
RPCRT4.dll::RpcBindingFree
RPCRT4.dll::RpcBindingFromStringBindingW
SECURITY_BASE_APIUses Security Base APIADVAPI32.dll::CheckTokenMembership
ADVAPI32.dll::DuplicateTokenEx
ADVAPI32.dll::GetTokenInformation
SS_APIUses SS APISecur32.dll::AcquireCredentialsHandleW
Secur32.dll::DeleteSecurityContext
Secur32.dll::QueryContextAttributesW
WIN32_PROCESS_APICan Create Process and ThreadsADVAPI32.dll::CreateProcessAsUserW
KERNEL32.dll::CreateRemoteThread
ADVAPI32.dll::CreateProcessWithLogonW
KERNEL32.dll::CreateProcessW
ADVAPI32.dll::OpenProcessToken
KERNEL32.dll::OpenProcess
WIN_BASE_APIUses Win Base APIntdll.dll::NtTerminateProcess
KERNEL32.dll::TerminateProcess
ntdll.dll::NtQueryInformationProcess
ntdll.dll::NtQuerySystemInformation
KERNEL32.dll::LoadLibraryW
KERNEL32.dll::LoadLibraryA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::FillConsoleOutputCharacterW
KERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetConsoleCursorPosition
KERNEL32.dll::SetConsoleOutputCP
KERNEL32.dll::SetConsoleTitleW
KERNEL32.dll::GetConsoleOutputCP
KERNEL32.dll::GetConsoleScreenBufferInfo
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileMappingW
KERNEL32.dll::CreateFileA
KERNEL32.dll::CreateFileW
KERNEL32.dll::CreateFileMappingA
KERNEL32.dll::DeleteFileA
KERNEL32.dll::DeleteFileW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::GetComputerNameW
ADVAPI32.dll::LookupAccountNameW
ADVAPI32.dll::LookupAccountSidW
ADVAPI32.dll::LookupPrivilegeNameW
ADVAPI32.dll::LookupPrivilegeValueW
WIN_CRED_APICan Manipute Windows CredentialsADVAPI32.dll::CredEnumerateW
ADVAPI32.dll::CredIsMarshaledCredentialW
ADVAPI32.dll::CredUnmarshalCredentialW
WIN_CRYPT_APIUses Windows Crypt APICRYPT32.dll::CertAddCertificateContextToStore
CRYPT32.dll::CertAddEncodedCertificateToStore
CRYPT32.dll::CertEnumCertificatesInStore
CRYPT32.dll::CertFindCertificateInStore
CRYPT32.dll::CertFreeCertificateContext
CRYPT32.dll::CertGetCertificateContextProperty
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegOpenKeyExW
ADVAPI32.dll::RegQueryInfoKeyW
ADVAPI32.dll::RegQueryValueExW
ADVAPI32.dll::RegSetValueExW
WIN_SCARD_APISupports Windows Smart CardWinSCard.dll::SCardConnectW
WinSCard.dll::SCardControl
WinSCard.dll::SCardDisconnect
WinSCard.dll::SCardEstablishContext
WinSCard.dll::SCardGetAttrib
WinSCard.dll::SCardGetCardTypeProviderNameW
WIN_SVC_APICan Manipulate Windows ServicesADVAPI32.dll::ControlService
ADVAPI32.dll::CreateServiceW
ADVAPI32.dll::OpenSCManagerW
ADVAPI32.dll::OpenServiceW
ADVAPI32.dll::QueryServiceStatusEx
ADVAPI32.dll::RegisterServiceCtrlHandlerW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::OpenClipboard
USER32.dll::CreateWindowExW

Comments