Malicious
ZIP Archive
MD5: 020d532eb18b6507dd4c471d3999d91e
Size: 64.88 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
64.88 KB · 64,877 B
First seen
2026-07-17 08:01 · 3 months ago
Last seen
2026-07-17 08:01 · 3 months ago
Last analysis
2026-07-17 17:41 · 3 months ago
Hashes
MD5
020d532eb18b6507dd4c471d3999d91e
Sha1
5b0d6983ff5e83d805e814b9db886e877ad572be
Sha256
aa030433b4bb9cce7eef168738c6b9210809ae523b2853edd6d220ef0e0bb56b
Sha384
6963a1aa99b42d17044c98aa02fce5e11d6f3fb16196c900e40b54e48febec3a20758fac76d14cea173deef80746e2d9
Sha512
0854162dd6f6d581511ba380fc425910bfff5cb3b518e601df3b00e84b38a1a30b797e11257d5f3122a9614c7fd9166398fd5ec21f59e099b368eefd8ccf5c10
SSDeep
1536:Ejx4t9urfow8sKdauUh+o0CM6N0PT2ASifncRt9s/O:EKCfhKdaugX02N0K6KtP
TLSH
8F5302578891E2A1C73B98F445CE759F500AAA2118062F8A7ECC89373F9DD770B20B4F
12 malicious · 16 files
ZIP020d532eb18b6507dd4c471d3999d91eT1027 · T1059.001
BINN5 menu fix
JSac_bridge.js
TSdiscord-rpc.ts
INIn5-settings.ini
JSotherstuff.js
PS1runtemp.obf.batT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:ps1~T1027~T1059.001
Shape
arc:zip>scr:ps1
malicious
2 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
$s
"=huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$s = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$s=[Thuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential