Malicious
ZIP Archive
MD5: a1271541c0098606fb05741ea2dd2ae5
Size: 7.44 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | a1271541c0098606fb05741ea2dd2ae5 |
| Sha1 | 055f7ecee82eb03a61442384610fba4fe6d2914f |
| Sha256 | 9d64e52708ab78bf5e93b06d40cb08392ef8918987c2ce9ac2f0511ede89d4aa |
| Sha384 | f599f7da3f6345c4cff1f0a88d76d7048dea6cc9e9c47bcbdc2e74733b14f771cdae86bf201af1ef3c609dc0673681f8 |
| Sha512 | e778523c47d35274313947e54c7eb359ccf41d4c7dd13ab3dde8a3e3669fc0b43944e0bde5b5510896796e60ba8ac6c8b765386321cdb49f841395b2c4f666fb |
| SSDeep | 98304:3+jZsqnTTx1AhxC+TOh5OsM5wij6UU/UYqDTV8Krp3nZdty4GbS8cWHNbfE2BCPk:QNTTYXGMVj6UU/UYoJ/7GbBZpfErPMl |
| TLSH | 1F76335DECAE86EED92CE473735BA48721C845E59A84D102DF3202EABFD40CE411F56B |
Malicious
Malicious
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 9
STICH kept: 4secondary ignored: 5
bin
5Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
4 / 4
Path
arc:zip>pe:exe~T1027~T1055>pe:rsrc>bin
Shape
arc:zip>pe:exe>pe:rsrc>bin
malicious
4 nodes
Path
arc:zip>pe:exe~T1027~T1055>bin
Shape
arc:zip>pe:exe>bin
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #4 | https:huhuhuhuhuhuhu |
| URL in PowerShell #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #6 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #7 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #8 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #9 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #10 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #11 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #12 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #13 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #14 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #15 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #16 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #17 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #18 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #19 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #20 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #21 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #22 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #23 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #24 | http:/huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #25 | https:huhuhuhuhuhuhu |
| URL in PowerShell #26 | https:huhuhuhuhuhuhu |
| URL in PowerShell #27 | https:huhuhuhuhuhuhu |
| URL in PowerShell #28 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #29 | https:huhuhuhuhuhuhu |
| URL in PowerShell #30 | httpshuhuhuhuhuhuhu |
| URL in PowerShell #31 | https:huhuhuhuhuhuhu |
| URL in PowerShell #32 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #33 | https:huhuhuhuhuhuhu |
| URL in PowerShell #34 | https:huhuhuhuhuhuhu |
| URL in PowerShell #35 | https:huhuhuhuhuhuhu |
| URL in PowerShell #36 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #5
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #7
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #8
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #9
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #10
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #11
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #12
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #13
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #14
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #15
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #16
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #17
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #18
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #19
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #20
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #21
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #22
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #23
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #24
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #25
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #26
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #27
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #28
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #29
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #30
URImalicious
httpshuhuhuhuhuhuhu
URL in PowerShell #31
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #32
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #33
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #34
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #35
URImalicious
https:huhuhuhuhuhuhu
URL in PowerShell #36
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential