Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 6a1684c748274b36db9f038c11da58c1
Sha1 74b136cda629c0a99dd9f805efe545bb3bebcc1f
Sha256 0c1d2dccbc4c5e2610d26371ffdff3e074b43fd8fef840e8c9e5f964a1c99c2c
Sha384 a13fa6a23aab7b6676f7a89fdf806ea055086e1a80c375b78b2a1e2a834d16007f56c7916bb419f884f2ee6bfa37a3b0
Sha512 3781afa79ddb2324a28ecd7ec74bc7e2b40c126d7e54a517abeceb7e23f356d5e1592cc7dc1ea72f98c7b575f10afdbf875caa6fce59a8f0d97264fad586ee73
SSDeep 24:9Wfpe2TyvOiYhyqtyGk4+O2R39+BnB+n0nmSx4NWyl+dbR1q2yP:9SJMbYhysHMOXenIPtbdb9y
TLSH B4210D20909FEE43D75BC03368D4170E1D7B1119E380E4B332F7514B91C74A5939CB94
6a1684c748274b36db9f038c11da58c1
Malicious
photov_832775966717.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_131405887958.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$xc_rfhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
6a1684c748274b36db9f038c11da58c1
Malicious
photov_832775966717.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_131405887958.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
6a1684c748274b36db9f038c11da58c1 › photov_832775966717.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$xc_rfhuhuhuhuhuhuhuhuhuhuhu
6a1684c748274b36db9f038c11da58c1 › photov_832775966717.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙