Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
File Size
1.51 MB · 1,511,617 B
First seen
2026-08-20 20:00 · 2 months ago
Last seen
2026-08-20 20:00 · 2 months ago
Last analysis
2026-08-20 23:40 · 2 months ago
Hashes MD5
57f01391064cac371eed2be1281070af
Sha1
79e45f117df27c1cffa22b1fc5276d89f9aafe8a
Sha256
8d538435f6048919c10abd27cf3f1315afeb5c815b6346d0ec9dcfda5afc5b51
Sha384
59c2f30dcdd4a29f3182bafa16cba0bf9c025fd1da52cab65a25a45a3872884e8e290b44697e36268ddd0699c526f452
Sha512
82f39cb9509c78af480871a9def0ba4766f124147a40b656fd660e7948af65201c1ff17a42dd9274c461103d193e5ee7200acc6d827bbd420c3453d7da36684e
SSDeep
24576:/cjh9+TiOV9A7D0AtWL+kcatqOCRcKNEiN5GrZP/x7GQrYmILWj:/cL+uUAtWfxtqOQ154P57RrYFLWj
TLSH
40653343CC2E429EC71A3837084C692E510377823CEA57B4A75253DCF9AFBA53774A96
117 malicious · 174 files
Malicious chain only
Expand all
ZIP 57f01391064cac371eed2be1281070af ZIP Archive T1027 · T1059.001
BIN zapret-discord-youtube-1.0.0c
BAT general (ALT).bat extracted from ZIP Archive
BAT general (ALT10).bat extracted from ZIP Archive
BAT general (ALT11).bat extracted from ZIP Archive
BAT general (ALT12).bat extracted from ZIP Archive
BAT general (ALT2).bat extracted from ZIP Archive
BAT general (ALT3).bat extracted from ZIP Archive
BAT general (ALT4).bat extracted from ZIP Archive
BAT general (ALT5).bat extracted from ZIP Archive
BAT general (ALT6).bat extracted from ZIP Archive
BAT general (ALT7).bat extracted from ZIP Archive
BAT general (ALT8).bat extracted from ZIP Archive
BAT general (ALT9).bat extracted from ZIP Archive
BAT general (FAKE TLS AUTO ALT).bat extracted from ZIP Archive
BAT general (FAKE TLS AUTO ALT2).bat extracted from ZIP Archive
BAT general (FAKE TLS AUTO ALT3).bat extracted from ZIP Archive
BAT general (FAKE TLS AUTO).bat extracted from ZIP Archive
BAT general (SIMPLE FAKE ALT).bat extracted from ZIP Archive
BAT general (SIMPLE FAKE ALT2).bat extracted from ZIP Archive
BAT general (SIMPLE FAKE).bat extracted from ZIP Archive
BAT general.bat extracted from ZIP Archive
BIN gitignore extracted from ZIP Archive
TXT LICENSE.txt extracted from ZIP Archive
MD README.md extracted from ZIP Archive
MD SECURITY.md extracted from ZIP Archive
PS1 service.bat extracted from ZIP Archive · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
TXT SHA256SUMS.txt extracted from ZIP Archive
PS1 gamein.bat extracted from ZIP Archive · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
BAT gamein_config.bat extracted from ZIP Archive
BIN game_filter.enabled extracted from ZIP Archive
TXT targets.txt extracted from ZIP Archive
PS1 test zapret.ps1 extracted from ZIP Archive · PowerShell T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and
MITRE techniques from the initial file to each final payload.
Structural branches: 8
STICH kept: 3 secondary ignored: 5
bin
5
Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…)
are summarized here instead of producing STICH Paths.
STICH Path & Shape 3
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
arc:zip>scr:ps1~T1027~T1059.001
Shape
arc:zip>scr:ps1
malicious
2 nodes
Path
arc:zip>scr:ps1~T1059.001
Shape
arc:zip>scr:ps1
technique 2 nodes
Show 1 more STICH Path
Deobfuscated PowerShell
UNKNWOWN malicious
"Write huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWN malicious
"Write huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
117 malicious · 174 files
Malicious chain only
Expand all
ZIP 57f01391064cac371eed2be1281070af ZIP Archive T1027 · T1059.001
BIN zapret-discord-youtube-1.0.0c
BAT general (ALT).bat extracted from ZIP Archive
BAT general (ALT10).bat extracted from ZIP Archive
BAT general (ALT11).bat extracted from ZIP Archive
BAT general (ALT12).bat extracted from ZIP Archive
BAT general (ALT2).bat extracted from ZIP Archive
BAT general (ALT3).bat extracted from ZIP Archive
BAT general (ALT4).bat extracted from ZIP Archive
BAT general (ALT5).bat extracted from ZIP Archive
BAT general (ALT6).bat extracted from ZIP Archive
BAT general (ALT7).bat extracted from ZIP Archive
BAT general (ALT8).bat extracted from ZIP Archive
BAT general (ALT9).bat extracted from ZIP Archive
BAT general (FAKE TLS AUTO ALT).bat extracted from ZIP Archive
BAT general (FAKE TLS AUTO ALT2).bat extracted from ZIP Archive
BAT general (FAKE TLS AUTO ALT3).bat extracted from ZIP Archive
BAT general (FAKE TLS AUTO).bat extracted from ZIP Archive
BAT general (SIMPLE FAKE ALT).bat extracted from ZIP Archive
BAT general (SIMPLE FAKE ALT2).bat extracted from ZIP Archive
BAT general (SIMPLE FAKE).bat extracted from ZIP Archive
BAT general.bat extracted from ZIP Archive
BIN gitignore extracted from ZIP Archive
TXT LICENSE.txt extracted from ZIP Archive
MD README.md extracted from ZIP Archive
MD SECURITY.md extracted from ZIP Archive
PS1 service.bat extracted from ZIP Archive · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1059.001
TXT SHA256SUMS.txt extracted from ZIP Archive
PS1 gamein.bat extracted from ZIP Archive · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [PowerShell Command] code extracted · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1027 · T1059.001
PS1 [Deobfuscated PS] deobfuscated · PowerShell T1059.001
BAT gamein_config.bat extracted from ZIP Archive
BIN game_filter.enabled extracted from ZIP Archive
TXT targets.txt extracted from ZIP Archive
PS1 test zapret.ps1 extracted from ZIP Archive · PowerShell T1059.001
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWN malicious
"Write huhuhuhuhuhuhuhuhuhuhu
57f01391064cac371eed2be1281070af › zapret-discord-youtube-1.0.0c › service.bat › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWN malicious
"Write huhuhuhuhuhuhuhuhuhuhu
57f01391064cac371eed2be1281070af › zapret-discord-youtube-1.0.0c › service.bat › [PowerShell Command] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.