Malicious
25fd60cb24dace6016b6ded8a967ecf3
ZIP Archive
MD5: 25fd60cb24dace6016b6ded8a967ecf3
Size: 632 B
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
632 B · 632 B
First seen
2026-08-03 08:53 · 2 months ago
Last seen
2026-08-03 08:53 · 2 months ago
Last analysis
2026-08-03 08:53 · 2 months ago
Hashes
MD5
25fd60cb24dace6016b6ded8a967ecf3
Sha1
4c9bc594d8c46b1004e01e474496908053c4f160
Sha256
b123db73ee0a3299cfb8dea6c13865a765e4e88f15ae40a4440cedcaa002bbf2
Sha384
3c53d779b6633bbe4560ffd22b7e79aeddaee36ec23fdd663b8167c79dda899e48ecf7355180f86aa7a53af627e531bc
Sha512
fcf6bbbe58167df3fa1823d7a7028e3e838ef1a5a56195bf4ec25308125dbc3029b677dd1c8205498d5497babd7aaee2c653f2eaf966d70502f8bc67fc945d19
SSDeep
12:5jBEXrm9LNNYED6Pg7YR1x23IvSypNx15fiHPvT+s6hOgsf3HvsLVX9a4:9BgmBYo6D7jpn15fKvqrd3Lh
TLSH
1EF0620240338905D0002ABD268F275EC93CB8C3C09E01F83F25FF6AD0E96C4D8503A7
3 malicious · 3 files
ZIP25fd60cb24dace6016b6ded8a967ecf3T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKALVESHOTEL_VOUCHER--ONZREV.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>lnk~T1059.003~T1202~T1204.002
Shape
arc:zip>lnk
malicious
2 nodes
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 3 files
ZIP25fd60cb24dace6016b6ded8a967ecf3T1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
LNKALVESHOTEL_VOUCHER--ONZREV.lnkT1059.003 · T1204.002 · T1202: Indirect Command ExecutionLOLBin
BIN[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution
UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
25fd60cb24dace6016b6ded8a967ecf3 › ALVESHOTEL_VOUCHER--ONZREV.lnk
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account