Malicious
Malicious

597a5092a1c506db538526df16760a71

PowerShell
MD5: 597a5092a1c506db538526df16760a71
Size: 2.54 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 597a5092a1c506db538526df16760a71
Sha1 58bf80ed34585fb7e0ad90185b151f9255ccad16
Sha256 d947e4cc8c8c5d7cc6dbb1e38cea7e50133e3032bd943bc1ff4eefd11f5f1a8d
Sha384 886dc2dc7c7f98291e7bf12112f4e293cdbec9cf6966b47bb57d5ab1201d229e791ddfbf92a238bb7144831e6ec033a6
Sha512 1d9bca082e31f40d3bf01594945f668595cbfc7ce2f05326f90a3ffed3d6335bfe30e15c0343f514ae709eaed90c9a1441bdbba18c329044746043d058787154
SSDeep 48:KezGigGImaG/goZ3ulYtSmQKTtSJRUOw1xfbekdMETVanCWHRMmYtcofmHSCnn:CiZ+Nh74NjdPTVHWyTfevn
TLSH CC51E97068103BEDC282A877EDE353D8BF266B2A5159393169EDD30158613B4273BF85
597a5092a1c506db538526df16760a71
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059.001~T1105
Shape scr:ps1
malicious 1 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
-forcehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
-forcehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
597a5092a1c506db538526df16760a71
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
597a5092a1c506db538526df16760a71 › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
-forcehuhuhuhuhuhuhuhuhuhuhu
597a5092a1c506db538526df16760a71 › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
-forcehuhuhuhuhuhuhuhuhuhuhu
597a5092a1c506db538526df16760a71 › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙