Deep Malware Analysis of 99ab1b572ec8fdc79d7b432c8d15b5e3 | md5: 99ab1b572ec8fdc79d7b432c8d15b5e3 | Zip Archive | LNK | Malicious | LOLBin | LOLBin:%COMSPEC% | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	99ab1b572ec8fdc79d7b432c8d15b5e3
Sha1	08a5b7c5a91e1f416edf86bb90719201c2b428be
Sha256	abe58173e4e6f99297f8f031252eeabc2af18d795dcaa4e8c826265a691306a9
Sha384	08cd9ea9dac0d16c7d09abca4c0641ee9cc175cd0689e08e1c87b0c1c55d3e06bea5311d5210a8e0a65fac0373e651a6
Sha512	629278a4d5397b67a052f50d447fe0147d4c5811a63c7da25516fb6f3dd378768d6c45ddbaf0aa82d56a41b28637b0ad884c721fd67387180fa49b1e7057ea06
SSDeep	24:9LoQ2e8urxGb9OCUZJCnBWtbwU2dEVE6kmSegi+gWq/R3QM:9LopylGxtUJOjtGV3kPe5+gW+n
TLSH	CF2166D968C61A67E9DB66373E826235BE86617E26B08171861531837515C800B4C9DA

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$wqg3xhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential