Malicious
Malicious

41f68d6596ee4f5fb34557ecd2c9ae22

PowerShell
MD5: 41f68d6596ee4f5fb34557ecd2c9ae22
Size: 5.49 MB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 41f68d6596ee4f5fb34557ecd2c9ae22
Sha1 00fa72f4cfaf47916efc70304a4206e7cbd2056f
Sha256 4b9f1dedd74b796c39c299b67369d5043739c3f1002d0b5df1e12db29369f7a2
Sha384 7b0c40b02cc94fc651191c27b3c91c25299ae6e4aa535b55a4db7d70306be2c6913fd52839c664544fffcaaa4a7a3098
Sha512 f94f74c1f8c98a0b3c05de1bf6faccd5a81d4281c84c985a97e129f385da3bfd2cefe0fa253a5b4a60b8b3b0832c24efdb556e769558f6acd7b97c0136054f6c
SSDeep 24576:6BDM3ojNKZWZDztp3lZDc2E9zaeRAup8lftxzQ9LYqBfwVrTPimmsW/L6iI2y5jW:SMKiK+B
TLSH 8F469F516E5859F5EF8C2A0E90AE6F1D87F042176A3370ABFB41DF04BDDA241864B21F
41f68d6596ee4f5fb34557ecd2c9ae22
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001
Shape scr:ps1
malicious 1 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
"+" "huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"+" "huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"+" "huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"+" "huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
" " +huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
" "huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
41f68d6596ee4f5fb34557ecd2c9ae22
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
"+" "huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"+" "huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"+" "huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"+" "huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
reads huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
" " +huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
" "huhuhuhuhuhuhuhuhuhuhu
41f68d6596ee4f5fb34557ecd2c9ae22 › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙