Malicious
78cfc67bd99bb5a1201c772655eb7e71
PowerShell
MD5: 78cfc67bd99bb5a1201c772655eb7e71
Size: 2.89 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
2.89 KB · 2,894 B
First seen
2026-10-07 17:15 · 18 days ago
Last seen
2026-10-07 17:15 · 18 days ago
Last analysis
2026-10-07 17:15 · 18 days ago
Hashes
MD5
78cfc67bd99bb5a1201c772655eb7e71
Sha1
cf21cf3af7d726bb8fd0c14ccf6675c4a3e24229
Sha256
b3fc341509036e209c0441d5723cf5240908339d7486d5d7362cc33114263fdd
Sha384
59fd72281db5c32be9ad4ee720e3a95d4e878c71c9cb7fea01bcbd7a213c63ccb00745a7b5ce167cf258cae338adfd05
Sha512
5fa738e31e17de03b37b0aa471bb12ef0b192cb4b0345e5a8a039adbb4b91428b23499bcf941bbd158ac7282ee2528b91811347875ea5c74e556ca746db966f0
SSDeep
48:auySRuE8bWB8IGYKu5UUfb9jYJsVw7t9GnbApGYKZR0UW1d/GLiM5v:uSV5NrPC6L6NPUYFGDv
TLSH
66516317721463B181F51268B4B8C265CA7E800E54423B217AF99359EEF73EE4B1DDA4
3 malicious · 3 files
PS178cfc67bd99bb5a1201c772655eb7e71T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1105
Shape
scr:ps1
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential3 malicious · 3 files
PS178cfc67bd99bb5a1201c772655eb7e71T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhu
78cfc67bd99bb5a1201c772655eb7e71
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account