Loading malware…
SafetyKatz is a Windows credential-dumping tool that combines a modified build of Mimikatz with a .NET PE loader to extract authentication material from LSASS while minimizing direct on-disk exposure of the credential-dumping component. Its core workflow uses the MiniDumpWriteDump API to create an LSASS memory minidump, then loads a customized Mimikatz payload in memory to process that dump and execute credential-access functions including logon password and encryption key extraction, after which the dump file is removed. The tool is commonly described as a .NET/C# adaptation intended for in-memory execution in post-exploitation workflows and red-team operations.
SafetyKatz is associated with publicly available offensive tooling and has been referenced alongside other credential-access utilities used in intrusion sets and red-team arsenals. It has been observed or reported in contexts involving advanced threat activity, including suspected use or variants by Iranian-linked operators and use by APT15 during operations that also involved broader credential theft and post-compromise activity. Because it targets LSASS-derived credential material, it is primarily relevant to Windows enterprise environments, especially Active Directory-centric intrusions where harvested credentials can support privilege escalation, lateral movement, and broader post-exploitation objectives.
The malware’s defining capability is credential theft through offline parsing of an LSASS minidump rather than only interacting with the live process. This design can support defense evasion relative to more direct approaches and makes the tool useful after initial compromise when operators seek rapid access to passwords, hashes, and key material. SafetyKatz is best classified as an infostealer focused on credential access in Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
we speculate the tool might be a variation of the tool SafetyKatz based on the debug.bin dump file the tool creates, which is also the name of the dump file created by SafetyKatz that was previously tied to Iranian threat actors
Mimikatz, Pypykatz, Safetykatz – Publicly available credential-dumping tools...
8 distinct techniques documented for this family, organized by ATT&CK tactic.
favicon.ico corresponds to an encoded and compressed version of safetykatz ... embedded as resources in order to be able to use them with execute-assembly
...runs sekurlsa::logonpasswords and sekurlsa::ekeys on the minidump file, removing the file after execution is complete... mimikatz # deleting C:\Windows\Temp\debug.bin
T1078.003 - Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Customers leveraging the Palo Alto Networks AutoFocus tool can track initially identified samples and tools under the Fireye_RedTeam_Tools, Rubeus, AndrewSpecial, KeeFarce, SafetyKatz, InveighZero, GadgetToJScript, SeatBelt, RuralBishop, SharpView, and SharpZeroLogon tags.
First, the MiniDumpWriteDump Win32 API call is used to create a minidump of LSASS to C:\Windows\Temp\debug.bin. Then @subtee's PELoader is used to load a customized version of Mimikatz that runs sekurlsa::logonpasswords and sekurlsa::ekeys on the minidump file, removing the file after execution is complete.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SafetyKatz is referenced as a C# credential-dumping tool used for DCSync-style or related post-exploitation activity over RPC.
SafetyKatz is a tool that combines Mimikatz functionality with .NET PE Loader for credential dumping and in-memory execution, used for credential theft and lateral movement.
Mimikatz variant used for credential dumping from Windows systems.
Credential dumping tool that creates an LSASS minidump and loads a customized Mimikatz via a .NET PE loader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.