Malicious
8db5e877eb3dc381b053b4ccebf2758a
PowerShell
MD5: 8db5e877eb3dc381b053b4ccebf2758a
Size: 3.61 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
3.61 KB · 3,605 B
First seen
2026-10-06 07:00 · 19 days ago
Last seen
2026-10-06 07:00 · 19 days ago
Last analysis
2026-10-06 07:00 · 19 days ago
Hashes
MD5
8db5e877eb3dc381b053b4ccebf2758a
Sha1
3417ff64a58405a96011dfaf512f8f122d8a242c
Sha256
9ed1c9ac09d3025927babf2f02cbdd55f71f846d979c01175850edb1b403dbdf
Sha384
a1e02109e97effe3271517e8c203d583dc86188b29e476faab81168c50f47b4cc3d603eb816b3f1031f0ea8947dff3a8
Sha512
dccfeb37174ab4e7a621a8d45ddef9253a6d47762aaf59d14d39c0dcae8d5a67972a9f3360844b64bc273d063b2b8c0fef8138b3d5c8ae5d3fdc4289fd8f9b98
SSDeep
96:aw+oIcyinf9JZqjLVVol0/H6JhT/2/r1V:aw+oIcl1JZAml0/s/2//
TLSH
9C711F037707E1748CB18BA6C99FAC09D1E02D97AC0F0C157DCD89D66F3539AB5E90A2
Detection
Symbol obfuscation
Medium
6 malicious · 6 files
PS18db5e877eb3dc381b053b4ccebf2758aT1027 · T1059 · T1105
VBS8db5e877eb3dc381b053b4ccebf2758a.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059~T1059.001~T1059.005~T1105>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
" & g_huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential6 malicious · 6 files
PS18db5e877eb3dc381b053b4ccebf2758aT1027 · T1059 · T1105
VBS8db5e877eb3dc381b053b4ccebf2758a.deobfuscated.vbsT1027 · T1059.001 · T1059.005
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialTrace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
8db5e877eb3dc381b053b4ccebf2758a
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
8db5e877eb3dc381b053b4ccebf2758a
Deobfuscated PowerShell
UNKNWOWNmalicious
" & g_huhuhuhuhuhuhuhuhuhuhu
8db5e877eb3dc381b053b4ccebf2758a › 8db5e877eb3dc381b053b4ccebf2758a.deobfuscated.vbs › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account