Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 14201c51d9407b1b10e1c39eb3a349e4
Sha1 a7e95be7e2a5526814cfb91f44a4df3805781de6
Sha256 eaaa4bc79fde2741c391726f90fe393f63e0be136aa6a2eb7cb8c11e54e72c79
Sha384 ed7d205fe88bf945b40bad015c14079f84917a58e7cc74bc87548fc9b5794cb9a98b9350beb58f182ac74b83c502c11b
Sha512 ed12c35b11df9254ad1cdca46f2b53a222ad376ed42ccbc7f18e7ca2d0ab7e92deffadf790213eab1b2da4f3ec95f98628412fa3964642c12b083a3cf5553d57
SSDeep 24576:N+NvjCGtzG1Bw6wUp7Pv5R6q7Js+KWFWBXGOI3d7r2k4skIMWIGIteDqt/:NIWGCfwU1j67+KWmXGdd7r2k6nsS
TLSH 775533E0FDA1C1F1BCA781A3269B2840BC0178895B307D97B5BCC3D7137DA5D15AB6A2
14201c51d9407b1b10e1c39eb3a349e4
Malicious
peça_carro_meca
Malicious
fotos
Malicious
peça 1.png
peça 1.png-preview.png
peça 2.png
peça 2.png-preview.png
peça_3.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001~T1105
Shape arc:zip>lnk>scr:ps1
malicious 3 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"$b=[Chuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
start-huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
14201c51d9407b1b10e1c39eb3a349e4
Malicious
peça_carro_meca
Malicious
fotos
Malicious
peça 1.png
peça 1.png-preview.png
peça 2.png
peça 2.png-preview.png
peça_3.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › [Lnk Summary]
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › LNK CommandLine › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › [Lnk Summary] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › [Lnk Summary] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › [Lnk Summary] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › [Lnk Summary] › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"$b=[Chuhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › [Lnk Summary] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › [Lnk Summary] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › LNK CommandLine › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › LNK CommandLine › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › LNK CommandLine › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › LNK CommandLine › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › LNK CommandLine › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › LNK CommandLine › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
$b = [huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › LNK CommandLine › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
start-huhuhuhuhuhuhuhuhuhuhu
14201c51d9407b1b10e1c39eb3a349e4 › peça_carro_meca › fotos › peça_3.lnk › [Lnk Summary] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙