Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
85 malicious · 85 files
VBS5738c721b5d9d2af328059e8c0e99ccfVBScriptT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
VBS[PowerShell Command].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
VBS[PowerShell Command].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShellT1059.005
VBS[Deobfuscated PS].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
VBS[PowerShell Command].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShellT1059.005
VBS[Deobfuscated PS].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
VBS[PowerShell Command].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
VBS[Deobfuscated PS].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
VBS5738c721b5d9d2af328059e8c0e99ccf.deobfuscated.vbsdeobfuscated · VBScriptT1059.005
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
85 malicious · 85 files
VBS5738c721b5d9d2af328059e8c0e99ccfVBScriptT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
VBS[PowerShell Command].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
VBS[PowerShell Command].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShellT1059.005
VBS[Deobfuscated PS].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
VBS[PowerShell Command].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShellT1059.005
VBS[Deobfuscated PS].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
VBS[PowerShell Command].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShellT1059.005
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
VBS[Deobfuscated PS].deobfuscated.vbsdeobfuscated · VBScriptT1059.005
VBS5738c721b5d9d2af328059e8c0e99ccf.deobfuscated.vbsdeobfuscated · VBScriptT1059.005
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
5738c721b5d9d2af328059e8c0e99ccf
Deobfuscated PowerShell
UNKNWOWNmalicious
5738c721b5d9d2af328059e8c0e99ccf › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
