Malicious
67026ca74f49003fe02090bfb0c2d2b9
PowerShell
MD5: 67026ca74f49003fe02090bfb0c2d2b9
Size: 158.73 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
158.73 KB · 158,730 B
First seen
2026-10-19 06:15 · 6 days ago
Last seen
2026-10-19 06:15 · 6 days ago
Last analysis
2026-10-19 06:15 · 6 days ago
Hashes
MD5
67026ca74f49003fe02090bfb0c2d2b9
Sha1
cf982e75d0737da3badac679cb1939e43afbdaa8
Sha256
50cb154cff572686b3b8d0d4912c8ef77ddd2f637fec5338e541e7c0f7f00988
Sha384
235bcf96754312c0660c89b229095a660d7f07b5f01355dae7a11ecad495aee60de8ccf33144b1c13da28dc4466d8404
Sha512
c814a65b0ac993c1e8618a5ae906c9e76eb75a9d7f09019d92d6b5e2380ed2d462266f9f90cf7c6230e5820ad1cbcb56841ac5e7a704621010cba449176aa341
SSDeep
3072:Th2wRexbPJ1/6DweuDBFNj/bh2wRexbPJ1/6DweuDBFNj/iVC2FyFYyayyYyMYy4:Th2wRexbPJ1/6DweuDBFNj/bh2wRexb8
TLSH
A9F338F715729E92E608F01983BC89C5F031B56A7292B64C7CED7720884C0EAAF77C56
4 malicious · 4 files
PS167026ca74f49003fe02090bfb0c2d2b9T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.007~T1105
Shape
scr:ps1
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential4 malicious · 4 files
PS167026ca74f49003fe02090bfb0c2d2b9T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
67026ca74f49003fe02090bfb0c2d2b9 › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account