Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 1ac13ebb0f5f90bae4692a4c7fe8b6c2
Sha1 72b95e745c9a72e3a3ad9e8aa2c5839317f9d477
Sha256 00baceb1512c55893e2b5a2ebca7c9e640352f409e425f15c5bdb92d90cc1853
Sha384 aa9976795e3c8d11efec99db60ebcde57b42fb0bf639bad30ace8d77d634c9fe1a52e7b7f2d1b0e5f1dda14bfb65c85f
Sha512 f6a0f65b5e0c087f47796c8d8f28a86c5549ff9820b88a50d3de2f73ad5d8cf75cb338da1271aed592abe9d25d3eafeffb1e952aa7a92cbc0c52681f0fcc6d97
SSDeep 96:8Eun9bs927yGHnHGMafGH6anrGMz/3LZ7d/rH3K/3sDGc5/tpb3slyZFTsVLU:8Euhs9xsHMfs6ar5/7r3K/8DXtprSkFD
TLSH 89C102212DDB10D9E27747702BC8BAFB0967E4B4583E71B4214D8A448B33AC0DC61F7A
1ac13ebb0f5f90bae4692a4c7fe8b6c2
Malicious
LNK CommandLine
Malicious
[Base64-Block]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>lnk:cmd>scr:ps1~T1027~T1059.001
Shape lnk>lnk:cmd>scr:ps1
malicious 3 nodes
Path lnk~T1059.001~T1059.003~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001
Shape lnk>scr:ps1
malicious 2 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
$rev =huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$rev =huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$rev =huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
$rev =huhuhuhuhuhuhuhuhuhuhu
1ac13ebb0f5f90bae4692a4c7fe8b6c2 › LNK CommandLine › [Base64-Block]
Deobfuscated PowerShell UNKNWOWNmalicious
$rev =huhuhuhuhuhuhuhuhuhuhu
1ac13ebb0f5f90bae4692a4c7fe8b6c2 › LNK CommandLine › [Base64-Block] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
$rev =huhuhuhuhuhuhuhuhuhuhu
1ac13ebb0f5f90bae4692a4c7fe8b6c2 › LNK CommandLine › [Base64-Block] › [Deobfuscated PS] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙