Malicious
Malicious

312974d984446b4bb23a9e71f327e624

Share on LinkedIn
Print
PowerShell
MD5: 312974d984446b4bb23a9e71f327e624
Size: 3.54 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
VBScript file
Size
3.54 KB · 3,538 B
First seen
2026-10-14 08:00 · 11 days ago
Last seen
2026-10-14 08:00 · 11 days ago
Last analysis
2026-10-14 08:00 · 11 days ago
Hashes
MD5 312974d984446b4bb23a9e71f327e624 Sha1 edddce711fde3df269922a2160fea784a96e2cfe Sha256 cbecf60e5553795c1dc900d2848b143bfd9097109a4b9851d374e8724b23c0ef Sha384 474133299d9cef1294fa6bfaf85da5bd0d50a9d9e759ad507b204e043adcfa788f8f6d8b453ad6917e839d24608dbceb Sha512 68c9aa2a33c98a27c553315b11905e93de7aa8bda31a1e27b552f556c8a2934c1820e155f4ff7f0aafd9b27dd9f69a1e449bf5f3be62b06019db0000af7f77e8 SSDeep 96:EwmFEB/eWywLm3sQuFdOFQOjdKrZuB34qKwQ:EwAEB/fy9sQuu9MZup4Dv TLSH 24716F51E9F0A31FE1614724C6C0AB455D6AE6BB02164094F0DC8620BFAE7C6D2B73A7
25 malicious · 25 files
PS1312974d984446b4bb23a9e71f327e624
VBS312974d984446b4bb23a9e71f327e624.deobfuscated.vbs
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BIN312974d984446b4bb23a9e71f327e624.comtrace
SH[Command #1]
PS1[PowerShell Command]
PS1[PowerShell Command]
PS1[PowerShell Command]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes
Path scr:ps1~T1027~T1059~T1059.001~T1059.005~T1105>scr:bat
Shape scr:ps1>scr:bat
malicious 2 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI FACEIhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination FACEIhuhuhuhuhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination facehuhuhuhuhuhuhuhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination facehuhuhuhuhuhuhuhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination unhuhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
Payload Destination huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1 UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$scriphuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
unparshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$scriphuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙