Deep Malware Analysis of 8f251d98e5ddc088808f3ecaf71364ea | md5: 8f251d98e5ddc088808f3ecaf71364ea | Zip Archive | LNK | Malicious | LOLBin | LOLBin:%COMSPEC% | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	8f251d98e5ddc088808f3ecaf71364ea
Sha1	86db8c349a92aec75892158134906926225d99ed
Sha256	1431922cf87dd5e65476ef9975c60a7ba4f79466ff35ac16b789c62f8532eece
Sha384	6fd6baf19e4153a0d7f3d088a30939cd1954a21cd749d02d12819694e76fe4bbd08624d5a0754bad4c0e15d40a0b2602
Sha512	01ab70f3f477dc2fc23da865ce720b6145ca6e39d72d3c105641714af1b0fe6602efe931c068c38f5e9807420a984a607e15b06f917ca07c9dcbba91a4f54f7c
SSDeep	24:9zyBhHnZ7lIwGJ63fgwGxSPikdR6DQKgFmSPmq+Jl8yltYy63Ryd:9zCHZ727OgwGoPikSDQZFPF+7ltYZE
TLSH	FD2171F4C01DD368C10AC5B2B7A6508C279C61D45862A40EB7B8BA83FDA59CAC71081A

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$fyeqqhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential