Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 21e4deb6bb9d67bcd920d3f1f5c13b10
Sha1 0f8226c80c0d7e6cbdb5815022e0bbd6fb90e9a7
Sha256 7e5de4602e024c3e33f42212ab0ecee6fa35278beb9de50e56aa34c8f67a9bdc
Sha384 69f15981be08311d16915d4a2a94377225d3415f6156fcf3fd98add0ad468fbb9db1887aca3b071c76aae1ec793da0a2
Sha512 b6975ce4879fa5380d84e9c0f235f80ce9dc7e55e18467c4f4f328ea5160e014946787c6687b360e49e7f9c8fba7cd137321944a86fbce026d65fda16ed97e1c
SSDeep 24:9U7OShlwFso2pVRye9gh3HawnknGM6F4EjIi4HmSHa+FV8i6mRmc9MM7O9nhM5eV:9YO4lIsV7RT9g90nKFfjIjP6+Fb6mRmZ
TLSH 952196488117ED02C18DE235689AE95B701E73A56100845B5AAC7B363B1049E7F4D6B1
21e4deb6bb9d67bcd920d3f1f5c13b10
Malicious
photov_565527363742.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_534939554134.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$cd26rhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
21e4deb6bb9d67bcd920d3f1f5c13b10
Malicious
photov_565527363742.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_534939554134.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
21e4deb6bb9d67bcd920d3f1f5c13b10 › photov_565527363742.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$cd26rhuhuhuhuhuhuhuhuhuhuhu
21e4deb6bb9d67bcd920d3f1f5c13b10 › photov_565527363742.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙