Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 6a1a15c25c6fba007315c5aad9fcfb8c
Sha1 64c1f610603177a3ff36b78a9a595d4a5f8275f3
Sha256 a33bddb753434ac6021a2c32ad9a2e050addf6cc150da04769a3be64081d5e51
Sha384 c982d74d4b3a2380b68587c3da99ec12bb988d9ab88b614d54766b863eee8c959e83329572aa533c267052dd28f6ad14
Sha512 bbab55b39d499e4a14701cf211dcb02f455d146a31461477a5086b5db6c64c0ec647ce0cb6146b9f4caebcfade79054020e3d501bfd156d66671a0e9ee5f99af
SSDeep 24:9iSPDK7EcJcGYpNN2hI11h4XpJ0oR2DmkrtubjeY1uPb5zbvec:9iSPm7vcGYx2h0hMpJqTrIbkDlbGc
TLSH B421B4E6C1089856FC6A7475B9F8825B20163CB824CC3EA79219893932C85F84F4FDC8
6a1a15c25c6fba007315c5aad9fcfb8c
Malicious
photov_027853836618.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_513361124040.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$teny4huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
6a1a15c25c6fba007315c5aad9fcfb8c
Malicious
photov_027853836618.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_513361124040.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
6a1a15c25c6fba007315c5aad9fcfb8c › photov_027853836618.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$teny4huhuhuhuhuhuhuhuhuhuhu
6a1a15c25c6fba007315c5aad9fcfb8c › photov_027853836618.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙