Malicious
PowerShell
MD5: 092d9c22f3d74528ab4a8d46a23fcdcf
Size: 10.63 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
10.63 KB · 10,633 B
First seen
2026-08-04 00:30 · 2 months ago
Last seen
2026-08-04 00:30 · 2 months ago
Last analysis
2026-08-04 00:30 · 2 months ago
Hashes
MD5
092d9c22f3d74528ab4a8d46a23fcdcf
Sha1
fe6e890e6aeb4995b5d1defe61a2ca16c6b5f4b8
Sha256
37a9ec32272ae8633b64231ba323de25df4190e901ef2544afd99356b3fe49b0
Sha384
1ce081e626d286375d405e36c03c6e90110a15a15a0bfa8fea6fcc36436b4c394847f106d8eebbf9a37eefc5c1100c78
Sha512
f35b9663672194f43a42fb23d5f5e0aa9f71043d2d1830b1cb2352f7b67988593434f8b85c97da8918b0af4d1c7069eabbca72636d7b8a98fe0c8187804f25ef
SSDeep
96:mLq6sZT0peQdFzKsxIjlZWLtCIJfumM8aqjwIutTrF2PHT:ikZIpeQPKsKytCyfk8CtEPHT
TLSH
F8225FD551CB23089AC5991F862C99D7F75D67D83823CB9574D6BAC48EA3D2C80DB0CC
29 malicious · 29 files
PS1092d9c22f3d74528ab4a8d46a23fcdcfT1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
VBS[Base64-Block]T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001>scr:vbs>scr:ps1~T1027~T1059.001~T1105
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
$psCmdhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
""
$phuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
" "."huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
". '$dhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential