Malicious
Malicious

8b35ee8435fff328b3b7b4be7e94c5f8

Share on LinkedIn
Print
VBScript
MD5: 8b35ee8435fff328b3b7b4be7e94c5f8
Size: 4.45 KB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 8b35ee8435fff328b3b7b4be7e94c5f8
Sha1 c4db4f01f13e2074b5367959119736ac5f7ea0a5
Sha256 71fbffcbab0e585ae33ff277a076366955661e39fee25b62c9f59392263025b3
Sha384 459969db60c1cf0477db64c3d3dfcd7ecb25b8fb7128f7315fac0c845c43186970673b9f20c5adc5e910fe833ae5ea59
Sha512 7c93a23753f377d10b200fddfcb99e4a1e8f177f561fc65670ea7cdd7cf748a1196f0d15e970497ad169d96e2fed15da703592cfb4cad0c8287b435895fbf5bb
SSDeep 96:ykjVUKd4WE/RlPj6LacSmt/eEje3kJsTNaFr/Q:9RvE/XPmt/XarQB/Q
TLSH 3491FE0B7922E0B4443116EE6A1E742DD66285BF4600445E7D7C44DE4F3EB7ED2682EF
8b35ee8435fff328b3b7b4be7e94c5f8
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
8b35ee8435fff328b3b7b4be7e94c5f8.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 14 STICH kept: 14
STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
14 / 14
Path scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105
Shape scr:vbs>scr:ps1>scr:ps1>scr:ps1>scr:ps1>scr:ps1
malicious 6 nodes
Path scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105>scr:ps1~T1059.001~T1105
Shape scr:vbs>scr:ps1>scr:ps1>scr:ps1>scr:ps1>scr:ps1
malicious 6 nodes
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & Rehuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & Rehuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & Rehuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI uhuhuhuhu
Payload Destination replhuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & Rehuhuhuhuhuhuhu
Payload Destination ,huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2 URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"[Net.huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Unmanhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
" & _huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
if nahuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"" _ huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙