Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2409fa63f6814f1bd92de6ca83ce7a08
Sha1 0e0063daa6e71a761d53e1ed674574b6633f5a3c
Sha256 f9e38ac9a3b8bf129d54d7ce8aa4f19e56dfd829b43f362fc4692d4c8213c59e
Sha384 89dcc0d4336a66929aa43553fb3dfaeebf0ca446ac5abae7a6fd009eb003895891c327b41d0fb91b41e77950f4278332
Sha512 a2a8d3136c01e63be8a7735f1f0197a741d65acbf0451e5689b10decea4dc894c3f104941256c323e8a0869d2372f2507ca9434355d6b430d6511d928b458a25
SSDeep 24:9eq3s8z79SVORY5B0IrLRN9Bri0S3KjKmSI2zyblZsWqsZGzyiCXF:9FTGMC79w0SkKPI2jWvZakXF
TLSH AC2167F8C6EED130D81392B79C255636A77280C90003767B1EFE79652FF3948160D511
2409fa63f6814f1bd92de6ca83ce7a08
Malicious
photov_303795533153.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_441921103168.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$s6xgnhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2409fa63f6814f1bd92de6ca83ce7a08
Malicious
photov_303795533153.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_441921103168.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
2409fa63f6814f1bd92de6ca83ce7a08 › photov_303795533153.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$s6xgnhuhuhuhuhuhuhuhuhuhuhu
2409fa63f6814f1bd92de6ca83ce7a08 › photov_303795533153.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙