Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2615e39d150e0b6b304b5303b40c7a61
Sha1 499e8dbf641eb321901bbb0651b7bd87ad2e4f34
Sha256 895f80a5fa6b4a2f4f4446f4ec6ce464dc14b45883a2b41878c777a56adeb21b
Sha384 7a55f1d7aa533c467d64987631d881ee96fa702d340b1a832f8eb13a987fbc415b85d808f8e0e03865c2a9e643e8b0c4
Sha512 fe570b141cfee551ad269e7cf4d33673a2c3016fb410fadc041054babb5d86710c938be01606566dbb6aa2c45a0aea5d508808f70718827383f37f348fa5682f
SSDeep 24:9UwNDEMZMUhgbIvNzkxbTa6Ka2d22/HmkWMhrwUE6FIxX:9U8QMeUbvN2Ta6ufTfD9+F
TLSH 8C21D8F0777C1366EB0D73B07FD6506B2075401D2952D9E2E852966DE04BDB482CB2E2
2615e39d150e0b6b304b5303b40c7a61
Malicious
photov_275121676585.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_560292278528.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$g21zthuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2615e39d150e0b6b304b5303b40c7a61
Malicious
photov_275121676585.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_560292278528.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
2615e39d150e0b6b304b5303b40c7a61 › photov_275121676585.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$g21zthuhuhuhuhuhuhuhuhuhuhu
2615e39d150e0b6b304b5303b40c7a61 › photov_275121676585.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙