Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 278efe9fed78275e61c9642301730f3b
Sha1 da235469d36f180bdc956e69f86a56606212c466
Sha256 552fec551719f12507dfd582dd5e8176134d9267f45847eb5f8941d864629d78
Sha384 1778b093558a93467e7d862e2c8900123a86e8d8c0c2d355fa3afe6ef6de4c23ad03ab50d3be410480b83f8f932f7e8f
Sha512 40021a75f76e069c0c90d81ff43c84b31cc300f22843962ace28e77c1f45f6bbfaa38187518306a7ded987c78b550b01cbcaefc9f98ed2032b02f372e4b2b295
SSDeep 24576:9uxpcVW7TtImbwkZIUgYOAXXwt8zXDtBT5P:9u/KAamBIUlOAXAtuHT5P
TLSH B82523F1DD1BEE01FCD29ABB32C1853B38196049226ABE8A745691D24E93FD3F53E114
278efe9fed78275e61c9642301730f3b
Malicious
hlmod-id-3807163120-name-Asteroid Speedrun.hlmod
payload.hta
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[Base64-Block@0x000135F8]
[Base64-Block@0x00013905]
[Base64-Block@0x0001B479]
[Base64-Block@0x0001BE11]
[Base64-Block@0x0001D406]
[Base64-Block@0x0001DE6F]
[Base64-Block@0x0002134C]
[Base64-Block@0x00021A81]
[Base64-Block@0x000252A5]
[Base64-Block@0x00026215]
[Base64-Block@0x0002971D]
[Base64-Block@0x0002D5C2]
[Base64-Block@0x0002D8D5]
[Base64-Block@0x000314E0]
[Base64-Block@0x00031F3E]
[Base64-Block@0x00035C34]
[Base64-Block@0x00037B32]
[Base64-Block@0x00038768]
[Base64-Block@0x0003BA63]
[Base64-Block@0x0003C44E]
[Base64-Block@0x0003FF42]
[Base64-Block@0x000408D3]
[Base64-Block@0x00047E2F]
[Base64-Block@0x00048169]
[Base64-Block@0x00049DD9]
[Base64-Block@0x0004AC06]
[Base64-Block@0x0005656C]
[Base64-Block@0x00056FE9]
[Base64-Block@0x0006A6F2]
[Base64-Block@0x0006AE52]
[Base64-Block@0x0006C6A8]
[Base64-Block@0x0006CB8C]
[Base64-Block@0x000705DA]
[Base64-Block@0x000710A5]
[Base64-Block@0x00072585]
[Base64-Block@0x00073444]
[Base64-Block@0x000764EE]
[Base64-Block@0x00076D4A]
[Base64-Block@0x000784A9]
[Base64-Block@0x00078EC0]
[Base64-Block@0x0007C3E4]
[Base64-Block@0x0007CB35]
[Base64-Block@0x00080486]
[Base64-Block@0x00086FC3]
[Base64-Block@0x00087C06]
[Base64-Block@0x00096242]
[Base64-Block@0x00096E3C]
[Base64-Block@0x000981D4]
[Base64-Block@0x000990F2]
[Base64-Block@0x000AE07D]
[Base64-Block@0x000AE848]
[Base64-Block@0x000B000E]
[Base64-Block@0x000B0810]
[Base64-Block@0x000B1FCF]
[Base64-Block@0x000B25F8]
[Base64-Block@0x000B3FAB]
[Base64-Block@0x000B47B8]
[Base64-Block@0x000B5F78]
[Base64-Block@0x000B6893]
[Base64-Block@0x000BE5B1]
[Base64-Block@0x000BEBAE]
[Base64-Block@0x000CAD18]
[Base64-Block@0x000CB448]
[Base64-Block@0x000CCCBB]
[Base64-Block@0x000CD272]
[Base64-Block@0x00152326]
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Command #1]
Malicious
[PowerShell Command]
Malicious
[Command #2]
Malicious
[PowerShell Command]
Malicious
[Base64-Block@0x00010EA4]
[Base64-Block-Decoded]
[Base64-Block@0x00012E55]
[Base64-Block-Decoded]
[Base64-Block@0x00014DDC]
[Base64-Block-Decoded]
[Base64-Block@0x00016D42]
[Base64-Block-Decoded]
[Base64-Block@0x00018CCF]
[Base64-Block-Decoded]
[Base64-Block@0x0001AC47]
[Base64-Block-Decoded]
[Base64-Block@0x0001CBD6]
[Base64-Block-Decoded]
[Base64-Block@0x0001EB5E]
[Base64-Block-Decoded]
[Base64-Block@0x00020B09]
[Base64-Block-Decoded]
[Base64-Block@0x00022A7E]
[Base64-Block-Decoded]
[Base64-Block@0x00024A3D]
[Base64-Block-Decoded]
[Base64-Block@0x00026D48]
[Base64-Block-Decoded]
[Base64-Block@0x00028D11]
[Base64-Block-Decoded]
[Base64-Block@0x0002AC9A]
[Base64-Block-Decoded]
[Base64-Block@0x0002CC01]
[Base64-Block-Decoded]
[Base64-Block@0x0002EB89]
[Base64-Block-Decoded]
[Base64-Block@0x000311B2]
[Base64-Block-Decoded]
[Base64-Block@0x00033153]
[Base64-Block-Decoded]
[Base64-Block@0x000350D7]
[Base64-Block-Decoded]
[Base64-Block@0x00037058]
[Base64-Block-Decoded]
[Base64-Block@0x00038FF8]
[Base64-Block-Decoded]
[PowerShell Command]
Malicious
[Base64-Block@0x0003B43D]
[Base64-Block-Decoded]
[Base64-Block@0x0003D3E6]
[Base64-Block-Decoded]
[Base64-Block]
[Base64-Block@0x0003F3C9]
[Base64-Block@0x00041368]
[Base64-Block@0x000432DC]
[Base64-Block@0x00045269]
[Base64-Block@0x00047213]
[Base64-Block@0x0004947C]
[Base64-Block@0x0004B413]
[Base64-Block@0x0004D924]
[Base64-Block@0x0004F8B9]
[Base64-Block@0x00051824]
[Base64-Block@0x000537A3]
[Base64-Block@0x00055AF6]
[Base64-Block@0x00057AB4]
[Base64-Block@0x00059A47]
[Base64-Block@0x0005BA21]
[Base64-Block@0x0005D9C1]
[Base64-Block@0x0005F94A]
[Base64-Block@0x000618F0]
[Base64-Block@0x00063874]
[Base64-Block@0x00065802]
[Base64-Block@0x000677A0]
[Base64-Block@0x00069747]
[Base64-Block@0x0006B6BA]
[Base64-Block@0x0006D64E]
[Base64-Block@0x0006F5EF]
[Base64-Block@0x00071583]
[Base64-Block@0x0007350E]
[Base64-Block@0x000754C5]
[Base64-Block@0x0007743E]
[Base64-Block@0x000793BF]
[Base64-Block@0x0007B379]
[Base64-Block@0x0007D319]
[Base64-Block@0x0007FE7A]
[Base64-Block@0x00081E02]
[Base64-Block@0x00083D79]
[Base64-Block@0x00085CF8]
[Base64-Block@0x000883CB]
[Base64-Block@0x0008A370]
[Base64-Block@0x0008C322]
[Base64-Block@0x0008EA8E]
[Base64-Block@0x0009280E]
[Base64-Block@0x00094793]
[Base64-Block@0x0009679D]
[Base64-Block@0x00098B67]
[Base64-Block@0x0009AAFF]
[Base64-Block@0x0009CA95]
[Base64-Block@0x0009EA3B]
[Base64-Block@0x000A09D6]
[Base64-Block@0x000A299E]
[Base64-Block@0x000A55EB]
[Base64-Block@0x000A7553]
[Base64-Block@0x000AA04D]
[Base64-Block@0x000ABFEB]
[Base64-Block@0x000ADFA0]
[Base64-Block@0x000AFF68]
[Base64-Block@0x000B1F01]
[Base64-Block@0x000B4164]
[Base64-Block@0x000B6132]
[Base64-Block@0x000B81E9]
[Base64-Block@0x000BA3A8]
[Base64-Block@0x000BC34B]
[Base64-Block@0x000BE2FB]
[Base64-Block@0x000C02A3]
[Base64-Block@0x000C222B]
[Base64-Block@0x000C4996]
[Base64-Block@0x000C691F]
[Base64-Block@0x000C88A5]
[Base64-Block@0x000CA870]
[Base64-Block@0x000CCB65]
[Base64-Block@0x0013A9DA]
[Base64-Block@0x0013C97C]
[Base64-Block@0x0013E917]
thumbnail.hta
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 7 STICH kept: 6secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
6 / 6
Path arc:7z>html~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape arc:7z>html>scr:bat>scr:ps1
malicious 4 nodes
Path arc:7z>html~T1027~T1059~T1059.005>scr:vbs~T1059.005>enc:b64
Shape arc:7z>html>scr:vbs>enc:b64
malicious 4 nodes
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
(if "huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Unblochuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
278efe9fed78275e61c9642301730f3b
Malicious
hlmod-id-3807163120-name-Asteroid Speedrun.hlmod
payload.hta
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[Base64-Block@0x000135F8]
[Base64-Block@0x00013905]
[Base64-Block@0x0001B479]
[Base64-Block@0x0001BE11]
[Base64-Block@0x0001D406]
[Base64-Block@0x0001DE6F]
[Base64-Block@0x0002134C]
[Base64-Block@0x00021A81]
[Base64-Block@0x000252A5]
[Base64-Block@0x00026215]
[Base64-Block@0x0002971D]
[Base64-Block@0x0002D5C2]
[Base64-Block@0x0002D8D5]
[Base64-Block@0x000314E0]
[Base64-Block@0x00031F3E]
[Base64-Block@0x00035C34]
[Base64-Block@0x00037B32]
[Base64-Block@0x00038768]
[Base64-Block@0x0003BA63]
[Base64-Block@0x0003C44E]
[Base64-Block@0x0003FF42]
[Base64-Block@0x000408D3]
[Base64-Block@0x00047E2F]
[Base64-Block@0x00048169]
[Base64-Block@0x00049DD9]
[Base64-Block@0x0004AC06]
[Base64-Block@0x0005656C]
[Base64-Block@0x00056FE9]
[Base64-Block@0x0006A6F2]
[Base64-Block@0x0006AE52]
[Base64-Block@0x0006C6A8]
[Base64-Block@0x0006CB8C]
[Base64-Block@0x000705DA]
[Base64-Block@0x000710A5]
[Base64-Block@0x00072585]
[Base64-Block@0x00073444]
[Base64-Block@0x000764EE]
[Base64-Block@0x00076D4A]
[Base64-Block@0x000784A9]
[Base64-Block@0x00078EC0]
[Base64-Block@0x0007C3E4]
[Base64-Block@0x0007CB35]
[Base64-Block@0x00080486]
[Base64-Block@0x00086FC3]
[Base64-Block@0x00087C06]
[Base64-Block@0x00096242]
[Base64-Block@0x00096E3C]
[Base64-Block@0x000981D4]
[Base64-Block@0x000990F2]
[Base64-Block@0x000AE07D]
[Base64-Block@0x000AE848]
[Base64-Block@0x000B000E]
[Base64-Block@0x000B0810]
[Base64-Block@0x000B1FCF]
[Base64-Block@0x000B25F8]
[Base64-Block@0x000B3FAB]
[Base64-Block@0x000B47B8]
[Base64-Block@0x000B5F78]
[Base64-Block@0x000B6893]
[Base64-Block@0x000BE5B1]
[Base64-Block@0x000BEBAE]
[Base64-Block@0x000CAD18]
[Base64-Block@0x000CB448]
[Base64-Block@0x000CCCBB]
[Base64-Block@0x000CD272]
[Base64-Block@0x00152326]
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Command #1]
Malicious
[PowerShell Command]
Malicious
[Command #2]
Malicious
[PowerShell Command]
Malicious
[Base64-Block@0x00010EA4]
[Base64-Block-Decoded]
[Base64-Block@0x00012E55]
[Base64-Block-Decoded]
[Base64-Block@0x00014DDC]
[Base64-Block-Decoded]
[Base64-Block@0x00016D42]
[Base64-Block-Decoded]
[Base64-Block@0x00018CCF]
[Base64-Block-Decoded]
[Base64-Block@0x0001AC47]
[Base64-Block-Decoded]
[Base64-Block@0x0001CBD6]
[Base64-Block-Decoded]
[Base64-Block@0x0001EB5E]
[Base64-Block-Decoded]
[Base64-Block@0x00020B09]
[Base64-Block-Decoded]
[Base64-Block@0x00022A7E]
[Base64-Block-Decoded]
[Base64-Block@0x00024A3D]
[Base64-Block-Decoded]
[Base64-Block@0x00026D48]
[Base64-Block-Decoded]
[Base64-Block@0x00028D11]
[Base64-Block-Decoded]
[Base64-Block@0x0002AC9A]
[Base64-Block-Decoded]
[Base64-Block@0x0002CC01]
[Base64-Block-Decoded]
[Base64-Block@0x0002EB89]
[Base64-Block-Decoded]
[Base64-Block@0x000311B2]
[Base64-Block-Decoded]
[Base64-Block@0x00033153]
[Base64-Block-Decoded]
[Base64-Block@0x000350D7]
[Base64-Block-Decoded]
[Base64-Block@0x00037058]
[Base64-Block-Decoded]
[Base64-Block@0x00038FF8]
[Base64-Block-Decoded]
[PowerShell Command]
Malicious
[Base64-Block@0x0003B43D]
[Base64-Block-Decoded]
[Base64-Block@0x0003D3E6]
[Base64-Block-Decoded]
[Base64-Block]
[Base64-Block@0x0003F3C9]
[Base64-Block@0x00041368]
[Base64-Block@0x000432DC]
[Base64-Block@0x00045269]
[Base64-Block@0x00047213]
[Base64-Block@0x0004947C]
[Base64-Block@0x0004B413]
[Base64-Block@0x0004D924]
[Base64-Block@0x0004F8B9]
[Base64-Block@0x00051824]
[Base64-Block@0x000537A3]
[Base64-Block@0x00055AF6]
[Base64-Block@0x00057AB4]
[Base64-Block@0x00059A47]
[Base64-Block@0x0005BA21]
[Base64-Block@0x0005D9C1]
[Base64-Block@0x0005F94A]
[Base64-Block@0x000618F0]
[Base64-Block@0x00063874]
[Base64-Block@0x00065802]
[Base64-Block@0x000677A0]
[Base64-Block@0x00069747]
[Base64-Block@0x0006B6BA]
[Base64-Block@0x0006D64E]
[Base64-Block@0x0006F5EF]
[Base64-Block@0x00071583]
[Base64-Block@0x0007350E]
[Base64-Block@0x000754C5]
[Base64-Block@0x0007743E]
[Base64-Block@0x000793BF]
[Base64-Block@0x0007B379]
[Base64-Block@0x0007D319]
[Base64-Block@0x0007FE7A]
[Base64-Block@0x00081E02]
[Base64-Block@0x00083D79]
[Base64-Block@0x00085CF8]
[Base64-Block@0x000883CB]
[Base64-Block@0x0008A370]
[Base64-Block@0x0008C322]
[Base64-Block@0x0008EA8E]
[Base64-Block@0x0009280E]
[Base64-Block@0x00094793]
[Base64-Block@0x0009679D]
[Base64-Block@0x00098B67]
[Base64-Block@0x0009AAFF]
[Base64-Block@0x0009CA95]
[Base64-Block@0x0009EA3B]
[Base64-Block@0x000A09D6]
[Base64-Block@0x000A299E]
[Base64-Block@0x000A55EB]
[Base64-Block@0x000A7553]
[Base64-Block@0x000AA04D]
[Base64-Block@0x000ABFEB]
[Base64-Block@0x000ADFA0]
[Base64-Block@0x000AFF68]
[Base64-Block@0x000B1F01]
[Base64-Block@0x000B4164]
[Base64-Block@0x000B6132]
[Base64-Block@0x000B81E9]
[Base64-Block@0x000BA3A8]
[Base64-Block@0x000BC34B]
[Base64-Block@0x000BE2FB]
[Base64-Block@0x000C02A3]
[Base64-Block@0x000C222B]
[Base64-Block@0x000C4996]
[Base64-Block@0x000C691F]
[Base64-Block@0x000C88A5]
[Base64-Block@0x000CA870]
[Base64-Block@0x000CCB65]
[Base64-Block@0x0013A9DA]
[Base64-Block@0x0013C97C]
[Base64-Block@0x0013E917]
thumbnail.hta
Malicious
No malware configuration was found at this point.
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
278efe9fed78275e61c9642301730f3b › thumbnail.hta
Deobfuscated PowerShell UNKNWOWNmalicious
(if "huhuhuhuhuhuhuhuhuhuhu
278efe9fed78275e61c9642301730f3b › payload.hta › payload.hta.deobfuscated.vbs › [Command #2] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Start-huhuhuhuhuhuhuhuhuhuhu
278efe9fed78275e61c9642301730f3b › payload.hta › payload.hta.deobfuscated.vbs › [Command #1] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
Unblochuhuhuhuhuhuhuhuhuhuhu
278efe9fed78275e61c9642301730f3b › payload.hta › payload.hta.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Command (COM trace) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
278efe9fed78275e61c9642301730f3b › payload.hta
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
278efe9fed78275e61c9642301730f3b › payload.hta
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙