Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 3c65ccef988e27a2efc27cb11f31eafc
Sha1 9e95e95127a0ddd1257976eda1dfb1582f9fd952
Sha256 c65f05b9f92b5d1cc2d19cf9f8d12fad263403d54952be88f93cd65a54239a5b
Sha384 e68221ff30943bac3b26d2ca39e637cc166794bb61be908b622f0bc47e55c1d6a0eca93a1d4e89e1656169d2e6a84360
Sha512 ffdb664bb644a568b694ba174da9cd6aa0167763f2a92d273a40194f031cafff01939e03a77c52d79d938fe9bc3ee7b53e53a5f95dddf9772093b30ebd2478e1
SSDeep 24576:KrSVzHwm9MNo2bsO4sKps6CT28TSo3pLCym7hpxZU9xfARdKVKm32XsEdfQAxDKM:mB+
TLSH 07269F606E5859F5EF8C6A0E90AE6F1D87F042176A33706BFB41DF04BD9A341864B21F
3c65ccef988e27a2efc27cb11f31eafc
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
3c65ccef988e27a2efc27cb11f31eafc.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path scr:vbs~T1027~T1059.001~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes
Path scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1059.005
Shape scr:vbs>scr:ps1>scr:vbs
malicious 3 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b64 =huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3c65ccef988e27a2efc27cb11f31eafc
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
3c65ccef988e27a2efc27cb11f31eafc.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
3c65ccef988e27a2efc27cb11f31eafc › 3c65ccef988e27a2efc27cb11f31eafc.deobfuscated.vbs › [Command #0]
Deobfuscated PowerShell UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
3c65ccef988e27a2efc27cb11f31eafc › 3c65ccef988e27a2efc27cb11f31eafc.deobfuscated.vbs › [Command #0] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
$b64 =huhuhuhuhuhuhuhuhuhuhu
3c65ccef988e27a2efc27cb11f31eafc › 3c65ccef988e27a2efc27cb11f31eafc.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙