Malicious
Malicious

a26447136ee86e0952e58044ce230cf4

Share on LinkedIn
Print
PowerShell
MD5: a26447136ee86e0952e58044ce230cf4
Size: 379.47 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 a26447136ee86e0952e58044ce230cf4
Sha1 ffb946023c26fb08bd0c9cb08e24c5a4d9e4395a
Sha256 a93cf6da720e075a3594521a6a71d58ff49bb124759e3512a3c1b4043c11f27b
Sha384 e27ff139e2278cd3ca169a95a6fa19fc02fe0c42ddecc818af28a3fd980178c142675c26963026fcc33b01eba9094634
Sha512 7c928e3df8cd36e3ec87f7c25c1a89390f681aaf6641ee4da2c1d2bc25666792190c2922f4cc26b2653a51956ad495ddb2848baf8b87988f3fce584f18be83db
SSDeep 6144:Dso50xzGOVXoPseUDOYBX3ib13X3R3ts3wAkAzQ323BC36sXhIwTI:o4ozGOVXoPseUDVCh3X3R3ts3wAkAzQA
TLSH 0184E1C1AD8B1DA5C6E167AC904B055AEF100FD32A7A84D4F23ED198EFFC85417C36A6
a26447136ee86e0952e58044ce230cf4
Malicious
a26447136ee86e0952e58044ce230cf4.deobfuscated.vbs
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Base64-Block]
[Deobfuscated PS].deobfuscated.vbs
Malicious
[PowerShell Command]
Malicious
[Base64-Block]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path scr:ps1~T1027~T1047~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1047~T1059.001~T1059.005~T1105
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes
Path scr:ps1~T1027~T1047~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1047~T1059.001~T1059.005~T1105
Shape scr:ps1>scr:vbs>scr:ps1
malicious 3 nodes
Config. Field Value
URL in PowerShell #1 httphuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Trace COM ordonnée UNKNWOWNmalicious
line 4huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
httphuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
httphuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
httphuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
httphuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
httphuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 5huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
httphuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
httphuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙