Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 046249e8a4e3b13a208a8011685401d4
Sha1 f25a738a481d866ec7ccf129014e087ac7ac7d7e
Sha256 4ccb3a4627d38a95caf94f5eca8c7f5aa20f635ab9d57a207d7f96f34d39c68e
Sha384 8f3571c7625c838e3ba17cf8fc1f93220b2993d766fc607a46583eb2ecb6cd8a2563fc66dc3e04f4a8dcf14957088054
Sha512 e342c7b8a0f2d33c08b5f61be5f6a95fadfebddc798cc839e448f10c8bca3b116f1598f0300b56a9cd5bd03ec58d504e88960cf3b888361d9bc75f4e5889d9a8
SSDeep 192:Mbu0RPmmIGrvtwMF8mEhINrccL0I3EzzBGCI08PBcKBwUfAOMnHx4P6:Ma0Rt5rmMOmELBlzzQ86BcKBTYPH+C
TLSH 1A452DC2DD90BC5B6504B489985E7B0CC1DB74D097F8E652E33E9400BB398999C63AFB
046249e8a4e3b13a208a8011685401d4
Malicious
[PowerShell Command]
Malicious
[PowerShell Command].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
046249e8a4e3b13a208a8011685401d4.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Command #1]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path scr:vbs~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes
Path scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
046249e8a4e3b13a208a8011685401d4
Malicious
[PowerShell Command]
Malicious
[PowerShell Command].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
046249e8a4e3b13a208a8011685401d4.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Command #1]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
046249e8a4e3b13a208a8011685401d4 › 046249e8a4e3b13a208a8011685401d4.deobfuscated.vbs › [Command #1]
Deobfuscated PowerShell UNKNWOWNmalicious
Invokehuhuhuhuhuhuhuhuhuhuhu
046249e8a4e3b13a208a8011685401d4 › 046249e8a4e3b13a208a8011685401d4.deobfuscated.vbs › [Command #1] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
046249e8a4e3b13a208a8011685401d4 › 046249e8a4e3b13a208a8011685401d4.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙