Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 22a5941e77756e87eae588a17c856056
Sha1 6ef1e9e7b8cc71e4e9144a659fed7bf81cdad4ea
Sha256 b86f676dcb8a3e45743dc196a7db42404341cb9e6b6e8d46d1e8856c49a75425
Sha384 f350e07a22aed6cb12ceab6c586a1bc38ed027dbbadabea9e5d5fdb40f38ba1469b433e1b163669de33e97f6484da7e2
Sha512 a130b06333a10d2f7d05ba179cea9f4dfabcaca8d5ba4ada6b1d4caad4a955e2ca2f8744326de8b5103410b69dda0d60b009044d6365718951b9947fd24746cb
SSDeep 24:9sBCR1kBkgnGcHFlumhx5gd8nnsqX9LOSmSibMHqk6jJynCEi:9BReBkmGcHFlumKCnsO9LpPYvjlj
TLSH B6219611A05B8B80C0118A7FBF35C6E4A174C196E462C2A74ECB6CAA2E798C54707EBC
22a5941e77756e87eae588a17c856056
Malicious
photov_565225557024.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_458448295582.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ke6x_huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
22a5941e77756e87eae588a17c856056
Malicious
photov_565225557024.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_458448295582.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
22a5941e77756e87eae588a17c856056 › photov_565225557024.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ke6x_huhuhuhuhuhuhuhuhuhuhu
22a5941e77756e87eae588a17c856056 › photov_565225557024.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙