Malicious
Malicious

020d532eb18b6507dd4c471d3999d91e

ZIP Archive
MD5: 020d532eb18b6507dd4c471d3999d91e
Size: 64.88 KB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 020d532eb18b6507dd4c471d3999d91e
Sha1 5b0d6983ff5e83d805e814b9db886e877ad572be
Sha256 aa030433b4bb9cce7eef168738c6b9210809ae523b2853edd6d220ef0e0bb56b
Sha384 6963a1aa99b42d17044c98aa02fce5e11d6f3fb16196c900e40b54e48febec3a20758fac76d14cea173deef80746e2d9
Sha512 0854162dd6f6d581511ba380fc425910bfff5cb3b518e601df3b00e84b38a1a30b797e11257d5f3122a9614c7fd9166398fd5ec21f59e099b368eefd8ccf5c10
SSDeep 1536:Ejx4t9urfow8sKdauUh+o0CM6N0PT2ASifncRt9s/O:EKCfhKdaugX02N0K6KtP
TLSH 8F5302578891E2A1C73B98F445CE759F500AAA2118062F8A7ECC89373F9DD770B20B4F
020d532eb18b6507dd4c471d3999d91e
Malicious
N5 menu fix
Malicious
ac_bridge.js
discord-rpc.ts
n5-settings.ini
otherstuff.js
runtemp.obf.bat
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>scr:ps1~T1027~T1059.001
Shape arc:zip>scr:ps1
malicious 2 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
$s "=huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$s = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
020d532eb18b6507dd4c471d3999d91e
Malicious
N5 menu fix
Malicious
ac_bridge.js
discord-rpc.ts
n5-settings.ini
otherstuff.js
runtemp.obf.bat
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
$s "=huhuhuhuhuhuhuhuhuhuhu
020d532eb18b6507dd4c471d3999d91e › N5 menu fix › runtemp.obf.bat › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$s = [huhuhuhuhuhuhuhuhuhuhu
020d532eb18b6507dd4c471d3999d91e › N5 menu fix › runtemp.obf.bat › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
020d532eb18b6507dd4c471d3999d91e › N5 menu fix › runtemp.obf.bat › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
020d532eb18b6507dd4c471d3999d91e › N5 menu fix › runtemp.obf.bat › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
020d532eb18b6507dd4c471d3999d91e › N5 menu fix › runtemp.obf.bat › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙