Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 26bb913b26f88abcfb1c185ecbb7acc1
Sha1 483ff301c59401bff7741dc2708e0208c1cf6294
Sha256 c657bdae9a4aacc6aa0b29171d28780bbdf2d12d0662cba492788fddb096b911
Sha384 6b5198ac53703570393bedf2d1649e0fe04ffe858397e5418104ba00cbf7f63f6c8d07446c35f20fd9d1b41afe47416b
Sha512 ca1cdbd9bc69dd62414a51e23412c2869f1c2d75f34c4705234da0abd7909f9a0e4281bf10fd06ca13aaf17562102293eaaefc2fa7233f181f97e35768a781a2
SSDeep 24:963+AFxmv9JwTGDh8hik7Sz2/Wv/KA3aX2BmSqbMH+aQUvr24:96bnmHwTvik7SzXHK4OcP35
TLSH 2B21F972240DC8DBCC04CA3AFC3BD3C290885CE9624384B71784FDD57FA349485007AA
26bb913b26f88abcfb1c185ecbb7acc1
Malicious
photov_832842672736.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_779445972341.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$lfuujhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
26bb913b26f88abcfb1c185ecbb7acc1
Malicious
photov_832842672736.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_779445972341.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
26bb913b26f88abcfb1c185ecbb7acc1 › photov_832842672736.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$lfuujhuhuhuhuhuhuhuhuhuhuhu
26bb913b26f88abcfb1c185ecbb7acc1 › photov_832842672736.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙