Malicious
19a610a42153432e1e7d3d78a271c910
LNK File
MD5: 19a610a42153432e1e7d3d78a271c910
Size: 59.56 KB
application/x-ms-shortcut
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 19a610a42153432e1e7d3d78a271c910 |
| Sha1 | 8efd802360046024794bd727b98191a7b6368d64 |
| Sha256 | 429a19e94becd3548a084678fe5e557189469f0eeb81370271d92d37dbc40d98 |
| Sha384 | 8be8ddb14278ef17953af5564059b3d1b51232abaf09077b039939d6911e44a42bfdfb09868aff3469cc0b88a178d2de |
| Sha512 | bc6efeb8ae2d53842d40c94d9a3de1d1c6ed4e9ea1824c43f5f1db274463c815d4800781109c94780a5b11abda172fe1b8f9e118c1f35fd89e69ed8013b1550b |
| SSDeep | 1536:zMArmQJ+qonSdDm7rZHICr/CGD5uLmdU3WJ:AArmfbnSVm7rZHTCTmSmJ |
| TLSH | C043E1144E937231D4B3EB7AFC354660D96E7C28DE91974F181AC14D60B3A089A37F07 |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105
Shape
lnk>lnk:cmd>scr:ps1
malicious
3 nodes
Path
lnk~T1027~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001~T1105
Shape
lnk>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$src =huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$src =huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
LNK: Command Execution
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
19a610a42153432e1e7d3d78a271c910
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
19a610a42153432e1e7d3d78a271c910 › [Lnk Summary] › [Deobfuscated PS]
Deobfuscated PowerShell
UNKNWOWNmalicious
$src =huhuhuhuhuhuhuhuhuhuhu
19a610a42153432e1e7d3d78a271c910 › LNK CommandLine › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
$src =huhuhuhuhuhuhuhuhuhuhu
19a610a42153432e1e7d3d78a271c910 › LNK CommandLine › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.