Deep Malware Analysis of 85717735af709f1b38c5f33bbf12177b | md5: 85717735af709f1b38c5f33bbf12177b | Zip Archive | LNK | Malicious | LOLBin | LOLBin:%COMSPEC% | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	85717735af709f1b38c5f33bbf12177b
Sha1	280066b48e0c94530614c66e24da2c743bbcfab0
Sha256	e996cfdad8da2c623d24005b615276179f74b64a0cc3ff1e0de40f73e6ff8ce0
Sha384	ed3f5addb2b4e16817fffc0350b4bb02f20ea1c7dd1617254f03fdd28ff9c764d7493e997148881dc2ad3737820de323
Sha512	baee0be67383d98560bba0d458b17d9f38b3212e660db485c43e986dcbcad622033e35faa5cfa4582b1dc976fcd2d03df890f00a98e5fe852fba44ea9024d9ff
SSDeep	24:9rVQQWvmDIQNqEshGDDsLFLzlOBUPja167CwF4l+d4KYmk0TbvAxkLGiBeR4KT:9rP9iODwZjB7CipXYT0Tr1LGiqXT
TLSH	A121C850DAEDC758C5E35636F8360AAC3460A1154605CBEA775A8A4EB459208920BE3E

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$jhf0jhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential