Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 53bb942bbde6c5d74939f78ea637694d
Sha1 05ce4513a051743130acc54a4264c0bb091ddfaa
Sha256 79e3f0d3f1527538660528242a3349e5f638ad0952ad2ecac2c43754f31d7bf1
Sha384 dc1e94e0e056057d6b648a4e4edb6cba5c35e8b3983eb35c61e2d3a279a944e4e40d221821a033f705d2aebc0ac08c36
Sha512 60aece6a36f7d1db19820e0baae604cd9254a746a6ada00454f2a6a32eb28aeb3f10a56612769c00beb8f28a6576de2a850cdce9e6db1453939f38c687df9ce6
SSDeep 24:8d/aqWHIxRiqX+yDW9KT62TS6BxU/n9qcMQoRrGUuu:8laaQqXFDW9l5SUF3K9
TLSH EF15DF8226E80300F1B6FE39CE7A9B85083BBA80ED75D7AC8A50CC1C5554615FA75F36
53bb942bbde6c5d74939f78ea637694d
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary].deobfuscated.vbs
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path lnk~T1027~T1059.001~T1059.003~T1059.005~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape lnk>lnk:cmd>scr:ps1
malicious 3 nodes
Path lnk~T1027~T1059.001~T1059.003~T1059.005~T1202~T1204.002>scr:ps1~T1027~T1059.001
Shape lnk>scr:ps1
malicious 2 nodes
LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
53bb942bbde6c5d74939f78ea637694d
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary].deobfuscated.vbs
Malicious
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
cmd.exhuhuhuhuhuhuhuhuhuhuhu
53bb942bbde6c5d74939f78ea637694d
URLs in VB Code - #1 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
53bb942bbde6c5d74939f78ea637694d › [Lnk Summary]
Deobfuscated PowerShell UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
53bb942bbde6c5d74939f78ea637694d › [Lnk Summary] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
& Remohuhuhuhuhuhuhuhuhuhuhu
53bb942bbde6c5d74939f78ea637694d › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙