Deep Malware Analysis of 25a13d94eb2071525cd77fcba754c87e | md5: 25a13d94eb2071525cd77fcba754c87e | Zip Archive | LNK | Malicious | LOLBin | LOLBin:%COMSPEC% | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	25a13d94eb2071525cd77fcba754c87e
Sha1	72b7fcddce0d98f01feb114d44b23588de282877
Sha256	89ec0c87f61266606537c2511d5590ecbcd2a582fb14908c176af56853faf56a
Sha384	ed31a3b637d9d28b2f637835f8e706ad881c6a9a53d1c0875d1c0114aeccbdc35ce52a01541d40b781d659f62bb37897
Sha512	df19d7f842954c01fa597d71326f15179d0cde9f2896167675936013991bb95da75dd800500dd23df1e53e1bffbf8ba228934c4c23883f3111a00579b74f9a07
SSDeep	24:9WIIl4KgjtMdjkhaoyaougAxTAPJbc8kmSKrLhzhheY7cVtGx7QUI1V:93Ile2bn8TWJgFPAhdheY7cKHID
TLSH	AB21C658B231F64BC3CB8A35B010CF0B9156B438E860B82B61E136B67C95FC803051A2

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$mu1tdhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential