213890795ce6d2daa99cd9cfb4038ca5

ZIP Archive

MD5: 213890795ce6d2daa99cd9cfb4038ca5

Size: 364 B

application/zip

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

MD5	213890795ce6d2daa99cd9cfb4038ca5
Sha1	51896b3313055ccf8db51f7798e88a4ba3bb9015
Sha256	e1f674edc4eb4d260443dad971862a640423c72787a319a031ee702322d3c2f9
Sha384	0ef09de526a45336f3f52d884075242353daca748e46881339afb24e8c92d8f5dbada8ba345be2f1899dcefc192c30c9
Sha512	d95b6304d5c0904aa9faa791beaf5ba308d832a8f191899d61d6c9dd3381418d07b70357ed45370f62c4acd04436b184054f3614a675708187417c0bcee74e50
SSDeep	6:5j7tabTXLuxcD2N8P+LpoM/p0O95S9S5Dv65EEmcOXmxyx1tQtFlbTXLux2S/+l0:5j7GXicDu8epoMRR9J6a3lXmxyxXQ750
TLSH	12E0C623A32020BBFB64B37902379E2C1AC6E2A000410CBA08ED0300B1204800E3EF44

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>scr:vbs~T1027~T1059~T1059.005

Shape arc:zip>scr:vbs

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

msihuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

msihuhuhuhu

213890795ce6d2daa99cd9cfb4038ca5 › WebexMeetingInstaller.vbs

Trace COM ordonnée UNKNWOWNmalicious

line 1huhuhuhuhuhuhuhuhuhuhu

213890795ce6d2daa99cd9cfb4038ca5 › WebexMeetingInstaller.vbs

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

213890795ce6d2daa99cd9cfb4038ca5 › WebexMeetingInstaller.vbs

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.