Deep Malware Analysis of 6ee4452ee9b141af4e624180ed1628c9 | md5: 6ee4452ee9b141af4e624180ed1628c9 | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	6ee4452ee9b141af4e624180ed1628c9
Sha1	0990aaeecb290eceea4b34ef3dde70a786728ca7
Sha256	7f6ec55f45b3ad0019453151db766882a84d714e2db3a6f607a1e97ed4ce977e
Sha384	2149259a0ba07e839a41945d22241d803e41c2bd18aa118ad1f5dc5361e9fe00194aba45595e332c14bd0b292d1c3271
Sha512	68405947ab1b5ba28d3259a8b312c46b008dd60ab77d1cafb723afc76c6debd43a3053b4ef3c08bc08e29f9cd54d5bf7f2a78845867051b539c7188e20a30b4d
SSDeep	48:9kDrk1F8OU8BKCfTW4NaaGO2BM3rUuUo1+:MF88aCuTs
TLSH	3341FAE9145DC0D0C8F5C4BAE5151A0F1D0E5A37FB9F152FD0287C32B87674D2C5A554

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes