Malicious
Malicious

93fb2c91da06abf1ef53a3cbbb779560

PowerShell
MD5: 93fb2c91da06abf1ef53a3cbbb779560
Size: 174.53 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 93fb2c91da06abf1ef53a3cbbb779560
Sha1 3277ca16e7487193f4068b4f44f6682c2d17290f
Sha256 b1642b024cfc49eb68cec1cc06bfa3aef4152ebdb07f93d7312e85756f4a6ea8
Sha384 cb35e01441b1b4785a9db90bc373031f716ff9cf02a438a58070577704ef22f02928caa741131c1386fce0517836c99e
Sha512 2590ac170770a3197c05b1e46a347c18d03ecf6d553acbae5ebbba25134fd59cbf0e9a32d54be4b14764f7d7845c33acd068f0a6abb0fbb61601a082f4990e6e
SSDeep 3072:BR7lcI2E6KFSVa5313X5ggfOl2zNMis9x7EiD2+o/HUz8fM5z:Pl329Ikaz+gMYQ7bos8Up
TLSH D80413500A5F9EAFD2AC236240BB978C3A341DD6803EAE5D2696B4775C6FD7B3131207
93fb2c91da06abf1ef53a3cbbb779560
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape scr:ps1>scr:bat>scr:ps1
malicious 3 nodes
Path scr:ps1~T1027~T1059~T1059.001~T1059.005>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"C:\Wihuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"" Sehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
" " huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
93fb2c91da06abf1ef53a3cbbb779560
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
No malware configuration was found at this point.
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
93fb2c91da06abf1ef53a3cbbb779560
Deobfuscated PowerShell UNKNWOWNmalicious
"C:\Wihuhuhuhuhuhuhuhuhuhuhu
93fb2c91da06abf1ef53a3cbbb779560 › 93fb2c91da06abf1ef53a3cbbb779560.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"" Sehuhuhuhuhuhuhuhuhuhuhu
93fb2c91da06abf1ef53a3cbbb779560 › 93fb2c91da06abf1ef53a3cbbb779560.deobfuscated.vbs › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
" " huhuhuhuhuhuhuhuhuhuhu
93fb2c91da06abf1ef53a3cbbb779560 › 93fb2c91da06abf1ef53a3cbbb779560.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙