312974d984446b4bb23a9e71f327e624

PowerShell

MD5: 312974d984446b4bb23a9e71f327e624

Size: 3.54 KB

application/x-powershell

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

VBScript file

Size

3.54 KB · 3,538 B

First seen

2026-10-14 08:00 · 11 days ago

Last seen

2026-10-14 08:00 · 11 days ago

Last analysis

2026-10-14 08:00 · 11 days ago

Hashes

MD5 312974d984446b4bb23a9e71f327e624 Sha1 edddce711fde3df269922a2160fea784a96e2cfe Sha256 cbecf60e5553795c1dc900d2848b143bfd9097109a4b9851d374e8724b23c0ef Sha384 474133299d9cef1294fa6bfaf85da5bd0d50a9d9e759ad507b204e043adcfa788f8f6d8b453ad6917e839d24608dbceb Sha512 68c9aa2a33c98a27c553315b11905e93de7aa8bda31a1e27b552f556c8a2934c1820e155f4ff7f0aafd9b27dd9f69a1e449bf5f3be62b06019db0000af7f77e8 SSDeep 96:EwmFEB/eWywLm3sQuFdOFQOjdKrZuB34qKwQ:EwAEB/fy9sQuu9MZup4Dv TLSH 24716F51E9F0A31FE1614724C6C0AB455D6AE6BB02164094F0DC8620BFAE7C6D2B73A7

25 malicious · 25 files

PS1312974d984446b4bb23a9e71f327e624

VBS312974d984446b4bb23a9e71f327e624.deobfuscated.vbs

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN312974d984446b4bb23a9e71f327e624.comtrace

SH[Command #1]

PS1[PowerShell Command]

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:ps1~T1027~T1059~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105

Shape scr:ps1>scr:vbs>scr:ps1

malicious 3 nodes

Path scr:ps1~T1027~T1059~T1059.001~T1059.005~T1105>scr:bat

Shape scr:ps1>scr:bat

malicious 2 nodes

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Payload URI	FACEIhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Payload URI	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	FACEIhuhuhuhuhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Payload URI	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	facehuhuhuhuhuhuhuhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Payload URI	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	facehuhuhuhuhuhuhuhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

cmd.exhuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$scriphuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

unparshuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$scriphuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

25 malicious · 25 files

PS1312974d984446b4bb23a9e71f327e624

VBS312974d984446b4bb23a9e71f327e624.deobfuscated.vbs

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN312974d984446b4bb23a9e71f327e624.comtrace

SH[Command #1]

PS1[PowerShell Command]

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Payload URI	FACEIhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Payload URI	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	FACEIhuhuhuhuhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Payload URI	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	facehuhuhuhuhuhuhuhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
Payload URI	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	facehuhuhuhuhuhuhuhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	unhuhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu
Payload Destination	huhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

cmd.exhuhuhuhuhuhuhuhuhuhuhu

312974d984446b4bb23a9e71f327e624

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

312974d984446b4bb23a9e71f327e624

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

312974d984446b4bb23a9e71f327e624

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

312974d984446b4bb23a9e71f327e624

Deobfuscated PowerShell UNKNWOWNmalicious

$scriphuhuhuhuhuhuhuhuhuhuhu

312974d984446b4bb23a9e71f327e624 › 312974d984446b4bb23a9e71f327e624.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]

Deobfuscated PowerShell UNKNWOWNmalicious

unparshuhuhuhuhuhuhuhuhuhuhu

312974d984446b4bb23a9e71f327e624 › 312974d984446b4bb23a9e71f327e624.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]

Deobfuscated PowerShell UNKNWOWNmalicious

$scriphuhuhuhuhuhuhuhuhuhuhu

312974d984446b4bb23a9e71f327e624 › 312974d984446b4bb23a9e71f327e624.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential