Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 26a76a85db570d6392f204ea6dacf2bf
Sha1 865eee3f2a6c866d381c4a90c1b1ad6aae7f7b13
Sha256 21a2f4f76beea38c16f6c45d3ce97c8d8fd1ff038a5de66cec97e3efad69e942
Sha384 653eff6d62ef36158e57c6152bbcd200cda6224f9a67133b66a56acb1d98fa304ee3f543ac56d62ec78e555c0d24960b
Sha512 6f5c4fc9ad9035a801bbe9dca8a0e7e7cddc7238600d2739dedf1781cf6220a54f1362c22d2868368f70e1ce9743c9b032a34468d5e5fd0c41c109bc6a205915
SSDeep 24:9keI/vnkl9nS3B1cnrhlUwMDWmSMJJxMHKP0VmODRg:95I/gS3PcnrhlU96PeuKPmFg
TLSH 422192F1D4DD8311C89CA3365DBD62B2236F614C2A29E4E350C3B6B2F024A85250CFC0
26a76a85db570d6392f204ea6dacf2bf
Malicious
photov_951377388727.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_009721856135.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$cv6mehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
26a76a85db570d6392f204ea6dacf2bf
Malicious
photov_951377388727.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_009721856135.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
26a76a85db570d6392f204ea6dacf2bf › photov_951377388727.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$cv6mehuhuhuhuhuhuhuhuhuhuhu
26a76a85db570d6392f204ea6dacf2bf › photov_951377388727.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙