Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 0247d3a0d65aa018da4000ae4ea34580
Sha1 26785447db3050571ab04c272dfed9131d8794d6
Sha256 f20336855326e3517749ac93d3881b0d131a678ceb5fcbee0d55ad8c289a48e4
Sha384 c2bf7679d3d23cc6ff86d5745b63dd6a17ec9d323b4be5d49fe76a35d57fa0daacaaeffd3f4c115b3347ff0f45647064
Sha512 3231231d8c43b78c01430da568370bd75f9ecb2f15cab23d6cd42aee3f2910a224acf849f3a1050232bc55c3fa314ca540ec759dd9fcbd3732497a53621ef65a
SSDeep 24:9UASbH0nN/0nbB305z//HSePz58MDhl5UmkObW3sW8xHT6oeByK9vSylDIC:9U3bHsNeF3mz/qeP5hwT31uHT6PByKou
TLSH 3321EA67CD658622E90F83333EC953F2612F06947864C614D7DD8307495A2B06F845B0
0247d3a0d65aa018da4000ae4ea34580
Malicious
photov_658760869456.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_850241884482.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$u6oqohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
0247d3a0d65aa018da4000ae4ea34580
Malicious
photov_658760869456.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_850241884482.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
0247d3a0d65aa018da4000ae4ea34580 › photov_658760869456.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$u6oqohuhuhuhuhuhuhuhuhuhuhu
0247d3a0d65aa018da4000ae4ea34580 › photov_658760869456.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙