Malicious
906aa49539cc6a374fb89ca86afdb635
PowerShell
MD5: 906aa49539cc6a374fb89ca86afdb635
Size: 498.18 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
PowerShell Script
Size
498.18 KB · 498,181 B
Hashes
MD5
906aa49539cc6a374fb89ca86afdb635
Sha1
2fe013334825c010dc54d5df008f1f377c07445d
Sha256
ed263d7dbabbc20839a5d95ba6688c1354434caaf45c9083a06aaea723bf95d9
Sha384
0149d35e7609791c7d910d4f24951091f7bd397c4f84873462bf882260a611c4bc846e62973437e8f247ad01b6b20aa1
Sha512
29f2186190373bfa3b8685588a0d4c948870fe7d0d54c309c514542169d5c6feec962adf504791054bde05150e83ed665e7dd8739e66e4719ccec57d44d33299
SSDeep
12288:hhLF/cG0CnB3/spOqsdQdceRe9p1E08AqS:zLF/Iaw/5e9sG
TLSH
1EB423503E3F2BDB4C646384C4FB0E5D2E98CC462588AA42716CE0537B6F5A68D93D3B
4 malicious · 5 files
PS1906aa49539cc6a374fb89ca86afdb635T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1105
Shape
scr:ps1
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | htthuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1
URImalicious
htthuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
4 malicious · 5 files
PS1906aa49539cc6a374fb89ca86afdb635T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1105 · T1059.001
BIN[Base64-Block]
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | htthuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1
URImalicious
htthuhuhuhu
906aa49539cc6a374fb89ca86afdb635
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
906aa49539cc6a374fb89ca86afdb635 › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.