Malicious
add9566630629f62821f9e62696d669f
ZIP Archive
MD5: add9566630629f62821f9e62696d669f
Size: 1.47 KB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | add9566630629f62821f9e62696d669f |
| Sha1 | c545deffc60e50f538d8136b578cf77ab648171f |
| Sha256 | ae8faa1ae163a1280fdfc99b11b497b122817dd1496fc924864a47292022d3f7 |
| Sha384 | 38674fea4d5e516381976f540a3a44c1942a63c513239ee2f35fdecbaa542480f408aef882825a6605924a3c3fe22851 |
| Sha512 | e2bb558433b92c56dc8ce3c6d4da64875cf8fd40a7df4d8a96506efd348795319de4fa61ff84fb18a36b46d86715bf8c10767da6e81f93cf6816b1b89cef493f |
| SSDeep | 24:9m08qNZ35adt8v8ApBCf9TENXHHiAKMZap0x55HwgNGBocBK20ReonAeueN:9JFZcH8v8A/CfCNXnnEpO5HwgHcBKeol |
| TLSH | 8431E98D073F1208C4DA5CB0816D6D31B897D84A91A5E44AD78EE2BD1D0E6EDD139F12 |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:vbs~T1027~T1059~T1059.005~T1105
Shape
arc:zip>scr:vbs
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
msiexehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL (COM trace) #2 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
msiexehuhuhuhuhuhuhuhuhuhuhu
add9566630629f62821f9e62696d669f › WebexMeetingSetup.vbs
Dropped path (COM trace) #1
PATHmalicious
C:\Usehuhuhuhuhuhuhuhuhuhuhu
add9566630629f62821f9e62696d669f › WebexMeetingSetup.vbs
Trace COM ordonnée
UNKNWOWNmalicious
line 8huhuhuhuhuhuhuhuhuhuhu
add9566630629f62821f9e62696d669f › WebexMeetingSetup.vbs
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
add9566630629f62821f9e62696d669f › WebexMeetingSetup.vbs
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
add9566630629f62821f9e62696d669f › WebexMeetingSetup.vbs
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
add9566630629f62821f9e62696d669f › WebexMeetingSetup.vbs
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.