Malicious
7c121167467f41e1c871a589e7a6d462
VBScript
MD5: 7c121167467f41e1c871a589e7a6d462
Size: 6.7 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
6.7 MB · 6,698,105 B
First seen
2026-08-13 11:47 · 2 months ago
Last seen
2026-08-13 11:47 · 2 months ago
Last analysis
2026-08-13 20:56 · 2 months ago
Hashes
MD5
7c121167467f41e1c871a589e7a6d462
Sha1
a1717161ba53b2646ac6e692eb60784d73d520ca
Sha256
f2a73d34cc811730977a2364f3eb5e65b150cf58c9af6d3189182413f5ce9039
Sha384
1d2d5b2a5476d05fef540aa84e2e1062a5c393aa2fb54d6456f38ee791e81cf047f60e4016de4592479e442601a92528
Sha512
1cc380b7e4c89148fc85928069b1e3304c30fa45899cdd311f73d2e74fddd95ad8cba1193182041510fbad0045b5bd942747c85ef04edcf6178fe2878cb98aff
SSDeep
24576:y/IPkE5xOLWSl/m+f1z68UGfL9DnQDWoYxoyzXSclBoiWdKPaRcSl0yNk/emUfF2:U5hEvdbw3Ig
TLSH
8A669F516E5459F5EF8C290E90AE6F1D83F082176A3370ABFB41DF05BEDA241864B21F
17 malicious · 19 files
VBS7c121167467f41e1c871a589e7a6d462T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
VBS[Deobfuscated PS].deobfuscated.vbsT1059.005
BIN7c121167467f41e1c871a589e7a6d462.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
3 / 3
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1059.005
Shape
scr:vbs>scr:ps1>scr:vbs
malicious
3 nodes
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
$b64 =huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential17 malicious · 19 files
VBS7c121167467f41e1c871a589e7a6d462T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Base64-Block]
PS1[Deobfuscated PS]T1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
VBS[Deobfuscated PS].deobfuscated.vbsT1059.005
BIN7c121167467f41e1c871a589e7a6d462.deobfuscated.vbs
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
No malware configuration was found at this point.
Deobfuscated PowerShell
UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
7c121167467f41e1c871a589e7a6d462 › 7c121167467f41e1c871a589e7a6d462.deobfuscated.vbs › [Command #0]
Deobfuscated PowerShell
UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
7c121167467f41e1c871a589e7a6d462 › 7c121167467f41e1c871a589e7a6d462.deobfuscated.vbs › [Command #0] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
$b64 =huhuhuhuhuhuhuhuhuhuhu
7c121167467f41e1c871a589e7a6d462 › 7c121167467f41e1c871a589e7a6d462.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account