Deep Malware Analysis of 21116bc1fa4898a0651486762858db49 | md5: 21116bc1fa4898a0651486762858db49 | WScript.Shell | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | T1059 | COM Behavior Trace | PowerShell | T1059.001

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	21116bc1fa4898a0651486762858db49
Sha1	a4c7bfb5ea7d08980a7a3218e224b975a9b5fd63
Sha256	427a774025774978b7cfd562d32086bbdc89d8ec4fad06c391ac4a55273ec69a
Sha384	661fcb6618faf5bb77fd668ae9b7b3ca4790e22c24115de41e43e24b7d26992730cd60c0b2804e0cceee7dabc747aa0b
Sha512	f31bb4ccc31e6fbaac64c74040d5dc02bad8b7e55c46551dfab60789caaee976efbc8bd011e9871b18e81339e9abbe60aa87031bd973709038fea28a273b78f0
SSDeep	12288:cvj4y9zlwElhbV3KdlaIS7QkFBBlxd1ELwELmk8h6nA/GkWcmbwQ+7SEx0TOm:Gj4Uzl7J3K/aItMBD1ELwU80A/GlcO+A
TLSH	6CE413A25BEA46BE499C41C2111326CED554CBC24CA2B2F386CE2F671EAEF774DD144C

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:vbs~T1059.005

Shape scr:ps1>scr:vbs

malicious 2 nodes

Trace COM ordonnée UNKNWOWNmalicious

line 9huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential