Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2381b6c2e722beb678c8d46bde8fa323
Sha1 390387036296179532bb8ad6930bd663e6f07bc2
Sha256 a24c1d7adba55f8a6faa08684b638d9bfa0f476511b3b23ba7d7b05a42fb1c11
Sha384 3d89da0a92f595ff03e7e2d7166d42760d38189f953249654e5ac8dbd3c80c2f86d0213639cf8aea3f02631b69774aa3
Sha512 3dc9bad44d4b8d960043e85066ffc5b77d4fa7f2025c8762783a8a0644fc940e52967d9d82db6763e3bb60b458351e6ea1aace832495afc2ace140858b30e679
SSDeep 24:9Kt5h0AtIaONN11qA5joYI5E2QhW7/GzS2c2zfDX2PNq5GmXEDUWLkmkDpL324Pq:9KF0zaMhx5EYeE2QhW7/GPc2fGWyvLk2
TLSH DD21E7C6C209E5A9CF0571FDBD033A49709A3A99102FE8036FE081872433366E73201A
2381b6c2e722beb678c8d46bde8fa323
Malicious
photov_918207518101.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_210571101284.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$k2kt huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2381b6c2e722beb678c8d46bde8fa323
Malicious
photov_918207518101.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_210571101284.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
2381b6c2e722beb678c8d46bde8fa323 › photov_918207518101.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$k2kt huhuhuhuhuhuhuhuhuhuhu
2381b6c2e722beb678c8d46bde8fa323 › photov_918207518101.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙