Deep Malware Analysis of 6b5def3c7a1766bb5ad80e2512e0530d | md5: 6b5def3c7a1766bb5ad80e2512e0530d | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	6b5def3c7a1766bb5ad80e2512e0530d
Sha1	1bde4d72c72794b4b4004f78c33451d36ff16f4e
Sha256	0553f3b996e73485d6b3e91123a438a2828006cb619ecb4205e48a025f47ea3b
Sha384	55f71d6b8377e791a684c35afe76dcecd3203c06ea35f0bbf22e317c9b496041e548967896ac94393db2159f78609a26
Sha512	93add1c500ad2b61e78774a027d6511a3dc5c9fb1944adff8c6093d37c7c61bfc5a60e461dccffec1addec051fec68a05d6a3dd802a7ed161b563c6a94ad7198
SSDeep	192:h3ZL2LDJucYGRZDv7y44ZCQIM4ab5R/18KlgjyLWXOzjc/u:h3ZxcYGRF7xqqRAGezjcu
TLSH	85029F14D19D4E7BC431BB69706058426DDABCEC20919F07E24C8CE7CACB6B7362E566

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential