Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 03110e7d05f64c49a35a3e60d049f2b0
Sha1 02ae841fd24f49c44e0343150f8a37ecd1d41c6b
Sha256 b05a874ccc1a00c90295be982d116a40b10e26aeaa304219fc27b5b5f0f74a67
Sha384 98c29f1fa3ddf4770f3eaabdd20f44ea01844b3b321dd7f901e9304fdccbc7390b39f90aaa2a4d1b14d1c00341a4d0d9
Sha512 78e04867d49f5c918357eed69a61ed426176dc1dd1b1783009ed62ce9588d89b45cb9ad34442ef7022c97d5a25e2d27fedc34b0f74df4244b00409fe9c097947
SSDeep 192:xg3WPDtyTQSBTXo96ingCTCRGXl+TtMbUbg8LSBTGzbhozbhI3CuFdFilIGNYGJy:xA5waJ
TLSH 0F3583017DD91DB9133A1CC93ACB4E42C9F20E57112B739F924EEF69A4A1DD0796138E
03110e7d05f64c49a35a3e60d049f2b0
Malicious
[PowerShell Command]
Malicious
[PowerShell Command].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
03110e7d05f64c49a35a3e60d049f2b0.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Command #1]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path scr:vbs~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes
Path scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
03110e7d05f64c49a35a3e60d049f2b0
Malicious
[PowerShell Command]
Malicious
[PowerShell Command].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
03110e7d05f64c49a35a3e60d049f2b0.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Command #1]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
03110e7d05f64c49a35a3e60d049f2b0 › 03110e7d05f64c49a35a3e60d049f2b0.deobfuscated.vbs › [Command #1]
Deobfuscated PowerShell UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
03110e7d05f64c49a35a3e60d049f2b0 › 03110e7d05f64c49a35a3e60d049f2b0.deobfuscated.vbs › [Command #1] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
03110e7d05f64c49a35a3e60d049f2b0 › 03110e7d05f64c49a35a3e60d049f2b0.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙