Malicious
681d063cf5ff9603fd563d179ad6f95f
VBScript
MD5: 681d063cf5ff9603fd563d179ad6f95f
Size: 1.03 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
1.03 MB · 1,028,352 B
First seen
2026-08-11 09:01 · 2 months ago
Last seen
2026-08-11 09:01 · 2 months ago
Last analysis
2026-08-12 06:44 · 2 months ago
Hashes
MD5
681d063cf5ff9603fd563d179ad6f95f
Sha1
f6bad0234013310c61a4df7b619859c26265a51d
Sha256
f328fee05adb6e079ab0baa3202fd3335ad6cb1973321e88020bca8496fa1ddb
Sha384
cae1355fb968569aeb8847f89374d9312881366779cc37e7672447687b9d68c210d019b18f6f23882ea3cb65dea0042f
Sha512
fa252a0e00dbe7cb5bf8b23c84e721264addbe8562ffa3ef3b31132343d620e823b784bce1555d95c408bb488afa4c1e6c2d2217cd1d46ce612cefa84c30281f
SSDeep
768:d1M+dlqvI2wIYUQHX5ZSRMY1rWllc6P9NoNVLd+2YJRVMAI08SpMHCvgjkA+kNYG:MVv
TLSH
CD258B2933C5C82C4DC1EAB4CF64BF5BC297E68C2B9005DEDD2AFF61610D5E2A665231
7 malicious · 8 files
VBS681d063cf5ff9603fd563d179ad6f95fT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN681d063cf5ff9603fd563d179ad6f95f.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1059.005>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1059.005
Shape
scr:vbs>scr:ps1>scr:vbs
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential7 malicious · 8 files
VBS681d063cf5ff9603fd563d179ad6f95fT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001 · T1059.005
VBS[PowerShell Command].deobfuscated.vbsT1059.005
PS1[Deobfuscated PS]
BIN[Base64-Block]
BIN681d063cf5ff9603fd563d179ad6f95f.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
Copy-Ihuhuhuhuhuhuhuhuhuhuhu
681d063cf5ff9603fd563d179ad6f95f › 681d063cf5ff9603fd563d179ad6f95f.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account