MALICIOUS — CUIDADO_bmtv-lock_encryptador_etc_DANGER_danger.zip
MALICIOUS — CUIDADO_bmtv-lock_encryptador_etc_DANGER_danger.zip is a zip sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mimikatz family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
dc429fc2be832453ebcfa6738714471ab3eb3259a00d326d5118c6c546a5ecd0 - SHA-1:
96a9bdf20e757a49615afb0ccb9581d7f3a3cea3 - MD5:
b91ea0c38b022b50cd7bcbab80070c4f - ssdeep:
393216:bjeHshV5yGuwnpbYkz3z8KjrJL7W/oEtWEsAKBQ0IFVtycZ2gTTcmucEEXWxEHO/:2HsL5ypw/FJLawQWRgl92gTIf08F+xs - TLSH:
T16C733374242D34DAEAB4DB316DD5073D68DB27A7174B1C6A24C4F843368E3A1CBE9188 - Submitted as: CUIDADO_bmtv-lock_encryptador_etc_DANGER_danger.zip
- File type: zip · Size: 21749951 bytes
- Verdict: malicious (99/100) · Family: Mimikatz
Detections (5 of 55 engines)
- capa (capabilities): capability:credential-access
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Win.Dropper.Mimikatz-9778171-1
- Microsoft Defender: flagged
- Kaspersky (KVRT): HEUR:Trojan-Ransom.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Mimikatz-9778171-1 (rule
Win.Dropper.Mimikatz-9778171-1) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged flagged (rule
flagged) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan-Ransom.Win32.Generic (rule
HEUR:Trojan-Ransom.Win32.Generic) - engine signal, weight 0.55, confidence 0.85 - access stored credentials (rule
access stored credentials) - capa signal, weight 0.50, confidence 0.80 - capa (capabilities) flagged capability:credential-access (rule
capability:credential-access) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-blob (rule
high-entropy-blob) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
- Archive contains executables: Advanced_IP_Scanner_2.5.4594.1.exe, FB831A56_lock.exe, mimikaz.exe, pp.exe - static signal, weight 0.25, confidence 0.50
Archive contents (4 executables)
This zip carries 4 extracted members, each analyzed as its own sample:
- Advanced_IP_Scanner_2.5.4594.1.exe -
26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193b - FB831A56_lock.exe -
e6ec7749e3d0f750fa53b5a7619d1e5af57673d236338b3a020d0f534ec5c15d - mimikaz.exe -
61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1 - pp.exe -
078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
Embedded domains
- l.gg
- 1y.sg
- o.ly
- k.cf
- o.in
- p.cn
- u.ga
- v4.au
- g.uk
- 5.gg
- n.io
File paths
- Y:\:^
- Y:\%b
- L:\e
- o:\0\
- v:\DT
- m:\yK
- k:\Zw
- p:\]3
- j:\zz
- g:\%g
- g:\~
More Mimikatz samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report