Malicious
Malicious

9ec67aab419801a2f181de5d8f6e6f28

ZIP Archive
MD5: 9ec67aab419801a2f181de5d8f6e6f28
Size: 56 KB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 9ec67aab419801a2f181de5d8f6e6f28
Sha1 b10216ece0845da0b0a05482281295c1d3590a19
Sha256 351395a3055b183263aa2e4cc2245fdc0ffd249b0011ac65bdc8d471d1b5b4c5
Sha384 f08947956d132ef6f3633e100f3f0ad10933b951770f20af26d0e44135f6e909aa899abdbf4b04a7f4c7762d54786b5f
Sha512 4216a93c04d32cec11ec8c4ba00d44cd366fda3a7ab6dee586fcab90206ec9cdbf6c1cb1ddcf76b9bf8ca138f12a837f16ef3f17fdd1e31c83e419fc06805c23
SSDeep 768:4GsY+oJUWCVhRKPhKsY/5iFtxsLknErPV3tLZRXJWH2Hh4t3cR0L70SBB4HNJPWt:4GsQUWCX4PI5awt3VxmjiGxBGttWiI6O
TLSH BE43022CC69CD950CAF536B89B423C970199188B889A51CB0521BAC9DD81FCBD6DF5DC
9ec67aab419801a2f181de5d8f6e6f28
Malicious
29228d1c.js
34dd3d3d.js
45791b1c.js
Malicious
[PowerShell Command]
Malicious
854a4a00.js
Malicious
[PowerShell Command]
Malicious
9307a0c6.js
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
a7b18fe1.js
desfazer.bat
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
desfazer.dat
manifest.json
run.bat
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
run.dat
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>scr:ps1~T1027~T1059.001
Shape arc:zip>scr:ps1
malicious 2 nodes
Path arc:zip>scr:ps1~T1027~T1059.001~T1105
Shape arc:zip>scr:ps1
malicious 2 nodes
Deobfuscated PowerShell UNKNWOWNmalicious
"%D%" huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
%d% shuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
trata huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
9ec67aab419801a2f181de5d8f6e6f28
Malicious
29228d1c.js
34dd3d3d.js
45791b1c.js
Malicious
[PowerShell Command]
Malicious
854a4a00.js
Malicious
[PowerShell Command]
Malicious
9307a0c6.js
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
a7b18fe1.js
desfazer.bat
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
desfazer.dat
manifest.json
run.bat
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
run.dat
No malware configuration was found at this point.
Deobfuscated PowerShell UNKNWOWNmalicious
"%D%" huhuhuhuhuhuhuhuhuhuhu
9ec67aab419801a2f181de5d8f6e6f28 › desfazer.bat › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
%d% shuhuhuhuhuhuhuhuhuhuhu
9ec67aab419801a2f181de5d8f6e6f28 › desfazer.bat › [Deobfuscated PS] › [PowerShell Command] › [PowerShell Command] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
trata huhuhuhuhuhuhuhuhuhuhu
9ec67aab419801a2f181de5d8f6e6f28 › run.bat › [PowerShell Command] › [PowerShell Command] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙