Malicious
Malicious

9ebf0e1a54cdf15a4bcfcbfbdc12958f

Share on LinkedIn
Print
VBScript
MD5: 9ebf0e1a54cdf15a4bcfcbfbdc12958f
Size: 4.55 MB
text/vbscript
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 9ebf0e1a54cdf15a4bcfcbfbdc12958f
Sha1 3b750cb6c9f401ec5780ae615552be53f879d373
Sha256 93a180ec5678568b9d071861338cc3572ac8c95cba3f7887ab597565c722602f
Sha384 9f84888f9d99a7e0036af3c53c5879267b76604272c924f60a62405ad5108776acfad685c7210e3d7460277696842dce
Sha512 93298eab5a66131378edafc1216e791292f0a3154c648b726b7d5a01da9d36fe4649db92c1803a9baeec5332afd6d7732a07517699e00bc45892b484dd820752
SSDeep 24576:UzyEQIEATJ9N2sO4sKps6CT28TSo3pLCym7hpxZU9xfARdKVKm32XsEdfQAxDKvV:TBn
TLSH 7B269F606E5859F5EF8C6A0E90AE6F1D87F042176A33706BFB41DF04BD9A341864B21F
9ebf0e1a54cdf15a4bcfcbfbdc12958f
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
9ebf0e1a54cdf15a4bcfcbfbdc12958f.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path scr:vbs~T1027~T1059.001~T1059.005>scr:bat~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape scr:vbs>scr:bat>scr:ps1
malicious 3 nodes
Path scr:vbs~T1027~T1059.001~T1059.005>scr:ps1~T1027~T1059.001~T1059.005>scr:vbs~T1059.005
Shape scr:vbs>scr:ps1>scr:vbs
malicious 3 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$b64 =huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙