Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
File Size
3.13 MB · 3,131,448 B
First seen
2026-08-02 20:15 · 2 months ago
Last seen
2026-08-02 20:15 · 2 months ago
Last analysis
2026-08-02 20:15 · 2 months ago
Hashes MD5
2554316da2f58f58842e658619a40a61
Sha1
f05369f1fce6a5a049036e66e27292c163ac15d0
Sha256
db4c3aa640d2be4ed97fbe502e2b27683a6ba3318524181bc4ab570bafe8c26d
Sha384
dd4acdd4f3f5b68ded533f5c45facad1da25c9b3e458be393cabe8ebbcfeda2558ae63571ec5b08df782a633475b6472
Sha512
26392256c88fcaf74035553c7af8d707dc415bc921d227c36f81ff7c71acc387273c3cf718fc266a49ae059410f85c8f7cd97d775c576fce87086c9bc3fbc13e
SSDeep
49152:JnQ9qVFhBu5NAr5z0xvI9Q5tvz0qWcQeXdY7TZ4E1GW4aLksf/dsIvid4/T4Ur4D:Jn24hsHsqRZ7b0qm4dY/Z4C4E/id4LLI
TLSH
29E53379F4D81B4DE242DB332448C19096D2B81175E0ED4B97E8231E4F63CEB9B907BA
207 malicious · 279 files
Malicious chain only
Expand all
ZIP 2554316da2f58f58842e658619a40a61 ZIP Archive T1027 · T1059.001 BIN .gitattributes extracted from ZIP Archive BIN .gitignore extracted from ZIP Archive PS1 general (ALT).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT10).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT11).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT12).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT2).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT3).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT4).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT5).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT6).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT7).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT8).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT9).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (EXP).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (FAKE TLS AUTO ALT).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (FAKE TLS AUTO ALT2).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (FAKE TLS AUTO ALT3).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (FAKE TLS AUTO).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (SIMPLE FAKE ALT).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (SIMPLE FAKE ALT2).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (SIMPLE FAKE).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 BAT general.bat extracted from ZIP Archive TXT LICENSE.txt extracted from ZIP Archive MD README.md extracted from ZIP Archive PS1 service.bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and
MITRE techniques from the initial file to each final payload.
Structural branches: 9
STICH kept: 3 secondary ignored: 6
bin
6
Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…)
are summarized here instead of producing STICH Paths.
STICH Path & Shape 3 STICH Path = the fingerprint (canonical chain with techniques)STICH Shape = structure onlyOnly determinant branches produce STICH Paths.
3 / 3
Path
arc:zip>scr:ps1~T1027~T1059.001
Shape
arc:zip>scr:ps1
2 nodes
Path
arc:zip>scr:ps1~T1059.001
Shape
arc:zip>scr:ps1
technique 2 nodes
Deobfuscated PowerShell
UNKNWOWN malicious
write- huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWN malicious
"Write huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWN malicious
"Write huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
207 malicious · 279 files
Malicious chain only
Expand all
ZIP 2554316da2f58f58842e658619a40a61 ZIP Archive T1027 · T1059.001 BIN .gitattributes extracted from ZIP Archive BIN .gitignore extracted from ZIP Archive PS1 general (ALT).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT10).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT11).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT12).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT2).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT3).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT4).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT5).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT6).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT7).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT8).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (ALT9).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (EXP).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (FAKE TLS AUTO ALT).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (FAKE TLS AUTO ALT2).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (FAKE TLS AUTO ALT3).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (FAKE TLS AUTO).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (SIMPLE FAKE ALT).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (SIMPLE FAKE ALT2).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 general (SIMPLE FAKE).bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 BAT general.bat extracted from ZIP Archive TXT LICENSE.txt extracted from ZIP Archive MD README.md extracted from ZIP Archive PS1 service.bat extracted from ZIP Archive · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001 PS1 [PowerShell Command] code extracted · PowerShell T1059.001
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWN malicious
write- huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWN malicious
"Write huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWN malicious
"Write huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
