Malicious
Malicious

ab14c941868fcf42a6e9c7894d2eb0c7

ZIP Archive
MD5: ab14c941868fcf42a6e9c7894d2eb0c7
Size: 970.37 KB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
ZIP archive
Size
970.37 KB · 970,367 B
First seen
2026-09-29 07:15 · 26 days ago
Last seen
2026-09-29 07:15 · 26 days ago
Last analysis
2026-09-29 07:15 · 26 days ago
Hashes
MD5 ab14c941868fcf42a6e9c7894d2eb0c7 Sha1 896113612b0248a993e1f82c2a127d0c9ea9de47 Sha256 ec617e393544d37af6ec2b21d22a835cd82788c95e16a0dafcda39f9876c1125 Sha384 da9e4f0bfa95b07903e125e1cae9c88617701c4acb97dd807a168d38fe2a76a900158c56b91d46a092fb93949adadb40 Sha512 0d433571bebec9e9dd321d2ef563257b40a5a0b4af049d06e966763029a61eeac59ff0a37ccb879dad3dee8fc36f649b66c6e1c8cadd6c2f7616b32e7f41bf7d SSDeep 24576:XbcgKfKLwPJZXszw3Ae02iRXRQ6fgq6Tp9SWvCA3NM:IDyLCzXmALiRBxYNNvJdM TLSH 6125120AA93C5CA3CA61B7F97B084F72DBC8B8D45A06B7056DD49AF00E0B1667E345CD
9 malicious · 198 files
ZIPab14c941868fcf42a6e9c7894d2eb0c7
BINVTM-Spark-main
BIN.gitignore
BINLICENSE
PS1README.md
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PYapp.py
BINbackend
PY__init__.py
PY__main__.py
PYapi.py
PYdeveloper.py
PYengine.py
PYlive_poser_client.py
PYlive_retarget.py
PYmodel_checklist.py
PYmodel_download.py
PYmodel_layout.py
PYpaths.py
PYpose_controller.py
PYref_pose_fit.py
PYsingle_instance.py
PYstream.py
PYvcam_device.py
PYvirtual_cam.py
BINdata
JSONmodel_sources.json
BINrefs
BIN.gitkeep
PYengine.py
PYlive_poser_client.py
PYlive_retarget.py
PYmodel_layout.py
BINpackaging
PS1build.ps1
PS1[PowerShell Command]
PS1console-progress.ps1
PS1kill-orphans.ps1
PYlauncher.py
SPEClauncher.spec
SPECreal_stream.spec
PYrth_idna.py
PS1start-menu.ps1
PS1sync-vendor.ps1
PYupload_tracker_models.py
PYpose_controller.py
PYref_pose_fit.py
TXTrequirements.txt
PS1start.bat
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BATtest.bat
PYtest_pose.py
BINtests
PY__init__.py
PYtest_bridge_compat.py
PYtest_constrained_retarget.py
PYtest_coordinate_frames.py
PYtest_engine_live_drive.py
PYtest_live_poser_bridge.py
PYtest_model_layout.py
PYtest_pose_controller.py
PYtest_ref_preview.py
PYtest_tracker_snapshot_frame.py
BINui
BIN.gitignore
JSON.oxlintrc.json
MDREADME.md
HTMindex.html
JSONpackage-lock.json
JSONpackage.json
BINpublic
IMGfavicon.svg
IMGfavicon.svg-preview.jpg
IMGicons.svg
IMGicons.svg-preview.jpg
BINsrc
CSSApp.css
TSXApp.tsx
TSapi.ts
BINassets
IMGhero.png
IMGhero.png-preview.png
IMGreact.svg
IMGreact.svg-preview.jpg
IMGvite.svg
IMGvite.svg-preview.jpg
BINcomponents
TSXCelStage.tsx
TSXControlRail.tsx
TSXMetricStrip.tsx
TSdeveloper.ts
TSXmain.tsx
BINstyles
CSStokens.css
JSONtsconfig.app.json
JSONtsconfig.json
JSONtsconfig.node.json
TSvite.config.ts
BINvendor
BIN.gitignore
TXTREADME.txt
BINtools
BINlive-poser
PYbridge.py
PYcalibration.py
PYcameras.py
PYiris_tracker.py
PYlabel_schema.py
JSONlive_keypoints.json
PYlive_poser.py
BINmodels
BIN.gitkeep
PYonnx_fix.py
TXTrequirements.txt
BATrun.bat
PYskeleton.py
PYtracking_filters.py
BINopenseeface
BIN.gitignore
BINLICENSE
BINLicenses
TXTDShowCapture.txt
TXTIL2cppStartProcess.txt
TXTOpenCV.txt
TXTPytorch_Retinaface.txt
TXTRemedian.txt
TXTThunderSVM.txt
TXTescapi.txt
TXTlibminibmcapture.txt
TXTlibsvm.txt
TXTonnxruntime.txt
TXTscikit-image.txt
MDREADME.md
BINSource
CPPSVMWrapper.cpp
CPPThunderSVMWrapper.cpp
CPPsvm.cpp
Hsvm.h
PYdshowcapture.py
BINdshowcapture
DLLdshowcapture_x64.dll
Structure
DLLdshowcapture_x86.dll
Structure
DLLlibminibmcapture32.dll
Structure
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
DLLlibminibmcapture64.dll
Structure
PYescapi.py
BINescapi
DLLescapi_x64.dll
Structure
DLLescapi_x86.dll
Structure
BINResources
BINRT_MANIFEST
BINID:0002
BINID:1033
PYfacetracker.py
SPECfacetracker.spec
PYinput_reader.py
BATmake_exe.bat
SHmake_exe.sh
PYmodel.py
BINmodels
IMGbenchmark.bin
IMGbenchmark.bin-preview.png
LOCKpoetry.lock
TOMLpyproject.toml
PYremedian.py
PYretinaface.py
BATrun.bat
PYsimilaritytransform.py
PYtracker.py
BINpose-traker
BINanime-face-detector
BINLICENSE
MDREADME.md
TOMLpyproject.toml
BINsrc
BINanime_face_detector
PY__init__.py
BINconfigs
PY__init__.py
BINmmdet
PYfaster-rcnn.py
PYyolov3.py
PYyolov8.py
BINmmpose
PYhrnetv2.py
PYdetector.py
BINmodels
PY__init__.py
PYhrnetv2.py
PYinference.py
PYface_landmark_repair.py
PYhrnet_schema_adapter.py
BINvtm_noble_cam
BATInstall-VTMNobleCam.bat
BATInstall.bat
BATInstallCustomName.bat
TXTREADME.txt
BATUninstall.bat
DLLUnityCaptureFilter32.dll
Structure
DLLUnityCaptureFilter64.dll
Structure
BINtorch_train
MDREADME.md
BINconfigs
PYscratch_30m_character1.py
PYscratch_30m_character2.py
PYscratch_30m_ref.py
PYscratch_fast_character2.py
PYscratch_keypoint_ref.py
BINdiffusion
PYrectified_flow.py
PYinference_keypoint.py
PYinference_numeric.py
BINmodels
PYdit.py
BINscripts
PYbuild_dataset.py
PYbuild_tfrecords.py
PYcache_latents.py
PYcount_dit_params.py
PYdownload_fast_stack.py
PYeval_keypoint_grid.py
PYeval_ref_grid.py
PYremove_original_samples.py
BATstart_scratch_30m_ref.bat
BINtext_encoder
PYtext_encoder.py
BINutils
PYcommon.py
PYconfig.py
PYcoordinate_frames.py
PYkeypoints.py
PYparams.py
PYpose_map.py
PYregistry.py
PYstack.py
PYtransforms.py
BINvae
PYvae.py
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 8 STICH kept: 5secondary ignored: 3
bin 2img 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
5 / 5
Path arc:zip>scr:ps1~T1027~T1059.001
Shape arc:zip>scr:ps1
malicious 2 nodes
Path arc:zip>scr:ps1~T1059.001~T1105
Shape arc:zip>scr:ps1
malicious 2 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell UNKNWOWNmalicious
` outhuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
set "huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
9 malicious · 198 files
ZIPab14c941868fcf42a6e9c7894d2eb0c7
BINVTM-Spark-main
BIN.gitignore
BINLICENSE
PS1README.md
PS1[PowerShell Command]
PS1[Deobfuscated PS]
PYapp.py
PYengine.py
PYlive_poser_client.py
PYlive_retarget.py
PYmodel_layout.py
BINpackaging
PS1build.ps1
PS1[PowerShell Command]
PS1console-progress.ps1
PS1kill-orphans.ps1
PYlauncher.py
SPEClauncher.spec
SPECreal_stream.spec
PYrth_idna.py
PS1start-menu.ps1
PS1sync-vendor.ps1
PYupload_tracker_models.py
PYpose_controller.py
PYref_pose_fit.py
TXTrequirements.txt
PS1start.bat
PS1[PowerShell Command]
PS1[Deobfuscated PS]
BATtest.bat
PYtest_pose.py
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell UNKNWOWNmalicious
` outhuhuhuhuhuhuhuhuhuhuhu
ab14c941868fcf42a6e9c7894d2eb0c7 › VTM-Spark-main › README.md › [PowerShell Command]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
ab14c941868fcf42a6e9c7894d2eb0c7 › VTM-Spark-main › packaging › build.ps1 › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
set "huhuhuhuhuhuhuhuhuhuhu
ab14c941868fcf42a6e9c7894d2eb0c7 › VTM-Spark-main › start.bat › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙