user@threatcheck.sh ~ threat-analysis
bash
$ analyze-threat HackTool:Win32/Mimikatz!pz
HackTool:Win32/Mimikatz!pz - Windows Defender threat signature analysis

HackTool:Win32/Mimikatz!pz - Windows Defender Threat Analysis

$ cat analysis.txt
=== THREAT ANALYSIS REPORT ===
Threat Name: HackTool:Win32/Mimikatz!pz
Classification:
Type:HackTool
Platform:Win32
Family:Mimikatz
Detection Type:Concrete
Known malware family with identified signatures
Suffix:!pz
Packed or compressed to evade detection
Confidence:Very High
False-Positive Risk:Low

Concrete signature match: Hack Tool - Tool used to exploit vulnerabilities for 32-bit Windows platform, family Mimikatz

Summary:

This threat is a concrete detection of HackTool:Win32/Mimikatz, a powerful credential-dumping tool. It is designed to steal sensitive information by extracting passwords, hashes, and authentication tickets from system memory, as well as saved credentials from applications like web browsers, email clients, and remote access tools.

Severity:
Critical
VDM Static Detection:
Relevant strings associated with this threat:
 - Mgithub.com/clymb3r/PowerShell/blob/master/Invoke-Mimikatz/Invoke-Mimikatz.ps1 (PEHSTR)
 - tinyurl.com/mnq854e (PEHSTR)
 - fXRb.T (SNID)
 - AppData\Roaming\FileZilla.dat (PEHSTR_EXT)
 - AppData\Local\Microsoft\Credential (PEHSTR_EXT)
 - Application Data\Thunderbird\Profiles (PEHSTR_EXT)
 - AppData\Roaming\Thunderbird\Profiles (PEHSTR_EXT)
 - AppData\Roaming\Mozilla\Firefox\Profiles (PEHSTR_EXT)
 - Application Data\Mozilla\Firefox\Profiles (PEHSTR_EXT)
 - Outlook\Profiles\Outlook (PEHSTR_EXT)
 - SOFTWARE\RealVNC\WinVNC4 (PEHSTR_EXT)
 - SOFTWARE\TightVNC\Server (PEHSTR_EXT)
 - uvnc bvba\UltraVNC\UltraVNC.ini (PEHSTR_EXT)
 - AppData\Roaming\Opera Software\Opera Stable\Login Data (PEHSTR_EXT)
 - Software\Microsoft\Internet Explorer\IntelliForms\Storage2 (PEHSTR_EXT)
 - Local Settings\Application Data\Google\Chrome\User Data\Default\ (PEHSTR_EXT)
 - Appdata\Local\Google\Chrome\User Data\Default\ (PEHSTR_EXT)
 - Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook (PEHSTR_EXT)
 - SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\ (PEHSTR_EXT)
 - AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat (PEHSTR_EXT)
 - mimikatz  (PEHSTR_EXT)
 - mimikatz (PEHSTR)
 - powershell_reflective_mimikatz (PEHSTR)
 - powerkatz.dll (PEHSTR)
 - blog.gentilkiwi.com/mimikatz (PEHSTR)
 - powershell_reflective_mimikatz (PEHSTR_EXT)
 - .writeprocessmemory.invoke (PEHSTR_EXT)
 - /user: (PEHSTR_EXT)
 - /domain: (PEHSTR_EXT)
 - /ntlm: (PEHSTR_EXT)
 - log mimikatz input/output to file (PEHSTR_EXT)
 - /mimikatz (PEHSTR_EXT)
 - \\.\pipe\kekeo_tsssp_endpoint (PEHSTR_EXT)
 - software\policies\microsoft\windows\credentialsdelegation (PEHSTR_EXT)
 - system\currentcontrolset\control\lsa\credssp\policydefaults (PEHSTR_EXT)
 - mimikatz.exe (PEHSTR_EXT)
 - Executing Mimikatz (PEHSTR_EXT)
 - sekurlsa::tickets /export (PEHSTR_EXT)
 - /user (PEHSTR_EXT)
 - /domain (PEHSTR_EXT)
 - @.kirbi (PEHSTR_EXT)
 - mimikatz (PEHSTR_EXT)
 - powerkatz.dll (PEHSTR_EXT)
 - blog.gentilkiwi.com/mimikatz (PEHSTR_EXT)
 - LoadMimiByCommand (PEHSTR_EXT)
 - MimikatzDelegate (PEHSTR_EXT)
 - start gg.lnk (PEHSTR_EXT)
 - start procdump.exe -accepteula -ma lsass.exe lsass.dmp (PEHSTR_EXT)
 - expand mim mimi.exe (PEHSTR_EXT)
 - mimi.exestop (PEHSTR_EXT)
 - shaykhelislamov/Documents/Codetest/testproject/main/exec.go (PEHSTR_EXT)
 - cmd /c C:\Users\Public\Documents\ (PEHSTR_EXT)
 - cmd.exe /c taskkill /f /t /im (PEHSTR_EXT)
 - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System (PEHSTR_EXT)
 - ://department.microsoftmiddlename.tk/ (PEHSTR_EXT)
 - 87.251.log (PEHSTR_EXT)
 - urlmon.dll (PEHSTR_EXT)
 - //department.microsoftmiddlename.tk/picturess/ (PEHSTR_EXT)
 - RDSv1.dll (PEHSTR_EXT)
 - C:/Users/Public/Documents/RDSv1.dll (PEHSTR_EXT)
 - ice_types.secrets.mimikatz.MimikatzResult (PEHSTR_EXT)
 - mimidrv.sys (PEHSTR_EXT)
 - get_MimikatzPE (PEHSTR)
 - set_MimikatzPE (PEHSTR)
 - cmd.exe /V:on /C reg delete HKLM\Software\CommandTmp /f (PEHSTR_EXT)
 - Please input ip. eg, /ip:xx.XXX.xx.x or /ip:xxx.com (PEHSTR_EXT)
 - spread.Cryptohijack (PEHSTR_EXT)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)
Known malware which is associated with this threat:
Filename: mimikatz_4.exe
4a7f71479e004b53c391b7899d720c9a8c6c18a9c0bfbcb40f521ad2a6345c3f
02/12/2025
→VirusTotal↓Download Sample
0792293d87093254f4402c9e942af9c71497992f414d7a53984b43bf83137fbe
02/12/2025
→VirusTotal↓Download Sample
Remediation Steps:
Isolate the affected host from the network immediately to prevent lateral movement. Reset all user passwords and service accounts that have been used on the system. Investigate for further signs of compromise and identify the initial access vector.
=== END REPORT ===
$ reanalyze-threat
This analysis was last updated on 02/12/2025. Do you want to analyze it again?
$ ls available-commands/
→ cd /home
user@threatcheck.sh:~$ ▊