Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 2d21767d0870eae451e6f335ce539b47
Sha1 aa243d3f8a446fcfb0697a515981260f45c44fe7
Sha256 49a8507e58f1ffbfc025d406a6fc9fa3ccc9f70e14ba46d40e5240529eca9e2d
Sha384 fb3cfb8698df42c423d87ab6cb75a543c402429493e8da09267432e8ad5f7788b31104503aacd92a5cb89d166946fbe1
Sha512 fc4a56c330af6030259916ab53605cec61c1e92549ad1c15590bf5145e226e2290e8d09e49c756723b5d24c94ca71fbd347c0049ee38d68048cc22a2278f1434
SSDeep 24:9u4eDKBl8xXl27pyISYOndjmgvmk+nSNbX+2mwnNQu8jf3IGnTn:9u4eDiU27pqYOdayT16S1KTTn
TLSH 6821EAAADBDCC1F2C87BF4377D22541A30D42B9941C57AED46E416ECFCC4846A312C14
2d21767d0870eae451e6f335ce539b47
Malicious
photov_001127393551.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_200015949577.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$v5622huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
2d21767d0870eae451e6f335ce539b47
Malicious
photov_001127393551.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_200015949577.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
2d21767d0870eae451e6f335ce539b47 › photov_001127393551.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$v5622huhuhuhuhuhuhuhuhuhuhu
2d21767d0870eae451e6f335ce539b47 › photov_001127393551.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙