Malicious
PowerShell
MD5: 0887858347e192419c1990714bc4a7a7
Size: 61.22 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
61.22 KB · 61,220 B
First seen
2026-09-29 08:30 · 26 days ago
Last seen
2026-09-29 08:30 · 26 days ago
Last analysis
2026-09-29 08:30 · 26 days ago
Hashes
MD5
0887858347e192419c1990714bc4a7a7
Sha1
c53bdf80e67eda65554d8addb1b351660a88d738
Sha256
5d4242262fb4b13a8ee8c13d040dbe3820b6729d9d5924d48b78f3df53f3f94a
Sha384
426a9c39da3e3fff0563c1aebd47e65cdf9543a83c4da08cf5fb02faa2836dd8add1760592eb88591e7a126888576a55
Sha512
ce2056712d6877a1b2eaf4fc962a24da59240362c7284d779aed596676bcbda0fd086e7fac3782a9ef6dadac0eb9d3c60eee08123c0b36aa4015e89c4a23f81f
SSDeep
768:L7Gz9piF0fn9sTAVlGAOBmVtmYpY54oc2SeLPBRSPPCRiVwVYyjF7aJxMsyZTDkS:mJXfWIcR541qLPpDvjldVaKzvjGm3
TLSH
1A53D047AF219639CB621261EE8B188FE9E75317100995A9394C09180FF0FFD93F1EAD
Detection
Symbol obfuscation
Medium
16 malicious · 18 files
PS10887858347e192419c1990714bc4a7a7T1027 · T1059 · T1105
VBS0887858347e192419c1990714bc4a7a7.deobfuscated.vbsT1027 · T1105 · T1059.001
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
PS1[PowerShell Command]T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1105 · T1059.001
BIN[Base64-Block]
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
scr:ps1~T1027~T1059~T1059.001~T1059.005~T1105>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:ps1~T1027~T1059~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Trace COM ordonnée
UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ping huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential