Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 6cc50c05d731ce68a785b401b24fe47c
Sha1 250a30ba3299e98fe22c02c935e5cc1dae4e1f43
Sha256 4e867c0477b48c1c765ed5c98a4da8229a6ad2b95c60d529809a7c8b0abd9778
Sha384 16c78f74bd00f7c9fc93770810b0b99141c6aaf6ef91d4f8710f6441452a5f391d939fd5497181db899aa8ff9a6fadec
Sha512 154271ab69a3fa7a613420a1e5c2f309a741716afaba41f47bcb3454d8d01bf787f28293c358807405d3ecff10069bfb94ba3f32e7423789b18a15579f03675d
SSDeep 24:9EVP8/6UtsdhJ98NCy9XDGuvr4oZ856Fj8BYjrmSa4R8Tij3rmKVP8/13GkjV:9Q8/6fzoF9XCuvr4o+bajrPv8/ZxjV
TLSH EF218658897088B2CC0FD33B69A61B9E623712CD14039647A396A493F7E7000AF185F8
6cc50c05d731ce68a785b401b24fe47c
Malicious
photov_921900597579.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_443970753601.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$zgvw4huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
6cc50c05d731ce68a785b401b24fe47c
Malicious
photov_921900597579.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_443970753601.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
6cc50c05d731ce68a785b401b24fe47c › photov_921900597579.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$zgvw4huhuhuhuhuhuhuhuhuhuhu
6cc50c05d731ce68a785b401b24fe47c › photov_921900597579.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙