Malicious
ZIP Archive
MD5: ab14c941868fcf42a6e9c7894d2eb0c7
Size: 970.37 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
970.37 KB · 970,367 B
First seen
2026-09-29 07:15 · 26 days ago
Last seen
2026-09-29 07:15 · 26 days ago
Last analysis
2026-09-29 07:15 · 26 days ago
Hashes
MD5
ab14c941868fcf42a6e9c7894d2eb0c7
Sha1
896113612b0248a993e1f82c2a127d0c9ea9de47
Sha256
ec617e393544d37af6ec2b21d22a835cd82788c95e16a0dafcda39f9876c1125
Sha384
da9e4f0bfa95b07903e125e1cae9c88617701c4acb97dd807a168d38fe2a76a900158c56b91d46a092fb93949adadb40
Sha512
0d433571bebec9e9dd321d2ef563257b40a5a0b4af049d06e966763029a61eeac59ff0a37ccb879dad3dee8fc36f649b66c6e1c8cadd6c2f7616b32e7f41bf7d
SSDeep
24576:XbcgKfKLwPJZXszw3Ae02iRXRQ6fgq6Tp9SWvCA3NM:IDyLCzXmALiRBxYNNvJdM
TLSH
6125120AA93C5CA3CA61B7F97B084F72DBC8B8D45A06B7056DD49AF00E0B1667E345CD
9 malicious · 198 files
ZIPab14c941868fcf42a6e9c7894d2eb0c7T1027 · T1105 · T1059.001
BINVTM-Spark-main
BIN.gitignore
BINLICENSE
PS1README.mdT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PYapp.py
BINbackend
BINdata
PYengine.py
PYlive_poser_client.py
PYlive_retarget.py
PYmodel_layout.py
BINpackaging
PS1build.ps1T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
PS1console-progress.ps1
PS1kill-orphans.ps1
PYlauncher.py
SPEClauncher.spec
SPECreal_stream.spec
PYrth_idna.py
PS1start-menu.ps1T1059.001
PS1sync-vendor.ps1
PYupload_tracker_models.py
PYpose_controller.py
PYref_pose_fit.py
TXTrequirements.txt
PS1start.batT1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BATtest.bat
PYtest_pose.py
BINtests
BINui
BINvendor
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 8
STICH kept: 5secondary ignored: 3
bin
2img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
5 / 5
Path
arc:zip>scr:ps1~T1027~T1059.001
Shape
arc:zip>scr:ps1
malicious
2 nodes
Path
arc:zip>scr:ps1~T1059.001~T1105
Shape
arc:zip>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialDeobfuscated PowerShell
UNKNWOWNmalicious
`
outhuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
set "huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential