Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 a5218e27771150a317d66c095570c23f
Sha1 5aa746bddb71df255ed937a3cb4a42f7f96d6324
Sha256 ba918b96dbb97ee7cfeb6594df7034d2d2052245be6369f4af5d3cb5fb582bb2
Sha384 ab5f0b9c83ca6f2ef7bdaeb03c892ea1a935f08878ae498df5b948e3d8edede5f1bc3d1571e778c3792fbc317c9d0ab7
Sha512 a9b6950154b63e14886df7c79b3e8bf406d904df3f8e7e3426ed8ff8cc67fb7b70989ccac82eed79ffe1cdd62de084fbb978b51f350035c5053d6e71a236e544
SSDeep 24:9OUqfg4ECDtrxgfuTmOx61Hyb+Y3zqNJYZmkt4X+UaNuUam+VPT1FMymKiQ3YV:9OAJCJrxg2mOYkBjyYZTt4X+UkOF1FM7
TLSH 6031F75D92CE4531CB9BAEBCFC6C4E75317E8208D4B50523AB2C861032699940B07227
a5218e27771150a317d66c095570c23f
Malicious
photov_506185122644.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_394948932151.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$hnnymhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
a5218e27771150a317d66c095570c23f
Malicious
photov_506185122644.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_394948932151.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
a5218e27771150a317d66c095570c23f › photov_506185122644.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$hnnymhuhuhuhuhuhuhuhuhuhuhu
a5218e27771150a317d66c095570c23f › photov_506185122644.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙