Deep Malware Analysis of 56fd579bd9e1879a103110453292bdcb | md5: 56fd579bd9e1879a103110453292bdcb | LNK | Malicious | LOLBin | T1218: System Binary Proxy Execution | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated | T1105

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	56fd579bd9e1879a103110453292bdcb
Sha1	e1d88df042694313d14f15aed26cca956d8e5738
Sha256	4f954c7c6228ca4eb0e6b7c3d5f2d025467996866c2d9ae4dd1f005cb6cb1f19
Sha384	cc3c213d9aa41c8ebb1197706cc9d2dba51a85006a387ebd743597d36fa4e85686d58313ed069a7484d4c5d9ffed8edc
Sha512	166826df993d70fc04c76f6f71d32228870725f8018827aaf3bf0fec689ae931421a4305566823137a0d732d41ef5cb818a8cec8e22001022469c63bc5419853
SSDeep	48:8wgVkRGix5VTDR7BT68c3rA0Dedy9XuH+:8fVkRGqlRUF1u
TLSH	AF617B112BFA0318F3B78F79A8BEA616493BBD56EE228B8D4040554818F1714D8B6F77

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>lnk:cmd~T1027~T1059.001>scr:ps1~T1027~T1059.001

Shape lnk>lnk:cmd>scr:ps1

malicious 3 nodes

Path lnk~T1027~T1059.001~T1059.003~T1105~T1202~T1204.002~T1218>scr:ps1~T1027~T1059.001~T1105

Shape lnk>scr:ps1

malicious 2 nodes

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

-c $shuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$sh = huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential