Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 21a64d49a054513263645ab87787132d
Sha1 9e646592fd9ef210ff7e2b3feac7367aa4a49900
Sha256 d6317db9baeb51e7c4e67db12190502c301747a63fa0aa734243ee4bb811233e
Sha384 54c2842b1a90511918b3ec4f0399e95e88edad820897857658c55f220b944d6ccaf79d9113f52d016a9fcc752b2dce51
Sha512 08e0a4840b5e5cd5460f0790d32a53e2cbcc1aff9a00baba310cfd7331365ea273e9a79720196d45b14a0f8da7d4c2df5f9cc1c240324dee2f4cf736cc7cadae
SSDeep 24:9kvc2mLibUbWVS5e6S8PGo0HjVaebffCPtTnUaYgmkkIMhrwUEQVAhcmnhsk2PJh:9kvc2zdI5bHUDVamCPtzU3gT0DiimhsZ
TLSH 3521083AD1299130D21BD670F5D1C1803306910ED816DAB25BEF52BA9B070CC228B270
21a64d49a054513263645ab87787132d
Malicious
photov_329525140467.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_092365302671.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$fk708huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
21a64d49a054513263645ab87787132d
Malicious
photov_329525140467.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_092365302671.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
21a64d49a054513263645ab87787132d › photov_329525140467.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$fk708huhuhuhuhuhuhuhuhuhuhu
21a64d49a054513263645ab87787132d › photov_329525140467.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙