Malicious
2c52fdc8ec2f8a21b2060fe290b468a3
PowerShell
MD5: 2c52fdc8ec2f8a21b2060fe290b468a3
Size: 149 B
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | 2c52fdc8ec2f8a21b2060fe290b468a3 |
| Sha1 | 275b9ad7e8f9746a54465c12e9290f038d8254e9 |
| Sha256 | 9b10065ad584ce4251c0d0cd3c636326fa07904692a519ba15acbecdc5e49fb4 |
| Sha384 | 0e732c60f1a83504fa6917c2e8226bce072e6e0583ac0b54bbbc04dbd220a52995d0abb33f627bee0aea105e358fc4b2 |
| Sha512 | 1a62e16d7660971cd0ba339a5e9283d8dd836d70a6c98d6458a49e23c29ad795ee5ad83dac48982a878dab6f526059958fa4cce05dff27801e7cf949aa6c60cf |
| SSDeep | 3:zTxHw+WjJhAeANytmAcLhzVvtRmRKVfwCWHU+RIMFBQfLB7Rn:zTdA+tzVKsKRIMFw7Rn |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1105
Shape
scr:ps1
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| Payload URI | http:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell
UNKNWOWNmalicious
$p = "huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
http:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| Payload URI | http:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell
UNKNWOWNmalicious
$p = "huhuhuhuhuhuhuhuhuhuhu
2c52fdc8ec2f8a21b2060fe290b468a3
URL in PowerShell #1
URImalicious
http:huhuhuhuhuhuhu
2c52fdc8ec2f8a21b2060fe290b468a3
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.