Malicious
Malicious

092d9c22f3d74528ab4a8d46a23fcdcf

PowerShell
MD5: 092d9c22f3d74528ab4a8d46a23fcdcf
Size: 10.63 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 092d9c22f3d74528ab4a8d46a23fcdcf
Sha1 fe6e890e6aeb4995b5d1defe61a2ca16c6b5f4b8
Sha256 37a9ec32272ae8633b64231ba323de25df4190e901ef2544afd99356b3fe49b0
Sha384 1ce081e626d286375d405e36c03c6e90110a15a15a0bfa8fea6fcc36436b4c394847f106d8eebbf9a37eefc5c1100c78
Sha512 f35b9663672194f43a42fb23d5f5e0aa9f71043d2d1830b1cb2352f7b67988593434f8b85c97da8918b0af4d1c7069eabbca72636d7b8a98fe0c8187804f25ef
SSDeep 96:mLq6sZT0peQdFzKsxIjlZWLtCIJfumM8aqjwIutTrF2PHT:ikZIpeQPKsKytCyfk8CtEPHT
TLSH F8225FD551CB23089AC5991F862C99D7F75D67D83823CB9574D6BAC48EA3D2C80DB0CC
092d9c22f3d74528ab4a8d46a23fcdcf
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001>scr:vbs>scr:ps1~T1027~T1059.001~T1105
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
$psCmdhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"" $phuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
" "."huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
". '$dhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
092d9c22f3d74528ab4a8d46a23fcdcf
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
$psCmdhuhuhuhuhuhuhuhuhuhuhu
092d9c22f3d74528ab4a8d46a23fcdcf › [Base64-Block] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
092d9c22f3d74528ab4a8d46a23fcdcf › [Base64-Block] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"" $phuhuhuhuhuhuhuhuhuhuhu
092d9c22f3d74528ab4a8d46a23fcdcf › [Base64-Block] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
" "."huhuhuhuhuhuhuhuhuhuhu
092d9c22f3d74528ab4a8d46a23fcdcf › [Base64-Block] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
". '$dhuhuhuhuhuhuhuhuhuhuhu
092d9c22f3d74528ab4a8d46a23fcdcf › [Base64-Block] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙