🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MimiKatz


Vendor detections: 12


Intelligence 12 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072
SHA3-384 hash: aaca94b895f32da5fea040638288b10674b6e1c1cb582d9e8191de568f238d182125fc0a5a455b66042bd379feeda69d
SHA1 hash: 07b35a3b431e653ddcf36cecd49793d538e2aa79
MD5 hash: fec27228340485485f6902f8759bbd62
humanhash: wolfram-blue-fish-magazine
File name:f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072.exe
Download: download sample
Signature MimiKatz
Create hunting rule
File size:13'782'016 bytes
First seen:2026-09-08 02:44:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8dac155865a010dc953bf586eeb8bec7 (1 x MimiKatz)
ssdeep 49152:FDQJE+1A++B+O93+xG96G9Cb3NmGUdO7m9buq7M9c0zVG/mr4/YaX2:2qVruQ9Cb3N3noo6CVCdQam
TLSH T143D6F156A3A414FAD1B7C139C9538613E7B2BC560320DBDF03A09A692F337D56E3AB11
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter whack_sh
Tags:exe mimikatz whack.sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-09-08 02:47:12 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a5c1f46d-1189-40c9-b9fa-3807101f3640

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/84467/
Detection(s):
Win.Malware.Lazy-10034378-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Launching a process
Creating a process with a hidden window
Сreating synchronization primitives
Running batch commands
Creating a window
Using the Windows Management Instrumentation requests
Searching for the window
Connection attempt
Sending a custom TCP request
DNS request
Launching a tool to kill processes
Deleting of the original file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug crypto fingerprint microsoft_visual_cc overlay packed reconnaissance
Link:
https://www.filescan.io/uploads/6a9f768133870a4f52b0948f/reports/81a520d9-4ead-4f38-a24b-c13a2e61e301/overview
Verdict:
Malicious
Labled as:
Yogi.Generic
Link:
https://www.hybrid-analysis.com/sample/f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072
Malware family:
Mimikatz
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/7de87ad6-aebe-420d-9272-008eb580f2e1
Result
Threat name:
Mimikatz
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1969679
Signature
Deletes itself after installation
Excessive usage of taskkill to terminate processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries DNS domain through GetComputerNameExW (potential sandbox evasion)
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Mimikatz
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1969679 Sample: 3j4S3AoEpl.exe Startdate: 08/09/2026 Architecture: WINDOWS Score: 88 46 keyauth.win 2->46 58 Multi AV Scanner detection for submitted file 2->58 60 Yara detected Mimikatz 2->60 62 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->62 64 Joe Sandbox ML detected suspicious sample 2->64 9 3j4S3AoEpl.exe 3 2->9         started        signatures3 process4 file5 42 C:\Users\user\Desktop\6xbtcL6qxlDk.exe, PE32+ 9->42 dropped 44 C:\Users\...\6xbtcL6qxlDk.exe:Zone.Identifier, ASCII 9->44 dropped 12 6xbtcL6qxlDk.exe 2 9->12         started        16 conhost.exe 9->16         started        process6 dnsIp7 48 keyauth.win 104.26.0.5, 443, 49715, 49720 CLOUDFLARENET-CloudflareIncUS Canada 12->48 50 127.0.0.1 unknown unknown 12->50 66 Multi AV Scanner detection for dropped file 12->66 68 Suspicious powershell command line found 12->68 18 powershell.exe 15 12->18         started        21 cmd.exe 1 12->21         started        23 cmd.exe 1 12->23         started        25 25 other processes 12->25 signatures8 process9 signatures10 54 Deletes itself after installation 18->54 27 conhost.exe 18->27         started        56 Excessive usage of taskkill to terminate processes 21->56 29 taskkill.exe 1 21->29         started        31 taskkill.exe 1 23->31         started        33 certutil.exe 3 1 25->33         started        36 taskkill.exe 1 25->36         started        38 taskkill.exe 1 25->38         started        40 16 other processes 25->40 process11 signatures12 52 Queries DNS domain through GetComputerNameExW (potential sandbox evasion) 33->52
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/fec27228340485485f6902f8759bbd62
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072/
Threat name:
Win64.Trojan.Yogi
Create hunting rule
Status:
Malicious
First seen:
2026-08-24 06:47:44 UTC
File Type:
PE+ (Exe)
Extracted files:
35
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7hkt7xgbfvki43e32okwilzq2kzmnkneebf4bfelvx4kprlrybza._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
defense_evasion execution
Link:
https://tria.ge/reports/260908-c8swdsbp7z/
Behaviour
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
Launches sc.exe
Deletes itself
Executes dropped EXE
Stops running service(s)
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072
MD5 hash:
fec27228340485485f6902f8759bbd62
SHA1 hash:
07b35a3b431e653ddcf36cecd49793d538e2aa79
Link:
https://www.unpac.me/results/e673a57c-911a-4481-b043-af28f2a32fca/
SH256 hash:
80c27522a95b613ff81b9c9dc68ffce85581c48caf88d6337c7a5bd9efe3076e
MD5 hash:
9c09f71e66e4f610dda9375c1a0846fe
SHA1 hash:
684cc2d8f16edfc106bc32a78973da39a0fb1704
Detections:
hacktool_windows_mimikatz_modules
Create hunting rule
Link:
https://www.unpac.me/results/e673a57c-911a-4481-b043-af28f2a32fca/
SH256 hash:
f0eb38592b897cef2ec0f0943e60e060802a2a8dbf72dc48728ce8cd37be922b
MD5 hash:
1ce0fa7948be4b620f5d4e8aafd623d4
SHA1 hash:
ce31d16f97cc8085778773bfa636b19d84865c05
Link:
https://www.unpac.me/results/e673a57c-911a-4481-b043-af28f2a32fca/
SH256 hash:
03aefd40698cafbd48138784f362fb9a36f726fb50f262ca40695729f7b553ca
MD5 hash:
083c6c05ac5875d0b6e997e894ca07bc
SHA1 hash:
69d0116998e8a70db5852fccb86d45975ce88a9a
Link:
https://www.unpac.me/results/e673a57c-911a-4481-b043-af28f2a32fca/
Malware family:
KernelDrUtil
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f9d53fdcc12d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:INDICATOR_SUSPICIOUS_References_SecTools
Create hunting rule
Author:ditekSHen
Description:Detects executables referencing many IR and analysis tools
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:test_rule_vldslv
Create hunting rule
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:Windows_Generic_Threat_dcc622a4
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

MimiKatz

Executable exe f9d53fdcc12d548e6c9bd395642f30d2b2c6a9a4204bc0948badf8a7c571c072

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/84467/

Comments