Deep Malware Analysis of add9566630629f62821f9e62696d669f | md5: add9566630629f62821f9e62696d669f | Zip Archive | SOS: 0.44 | WScript.Shell | Scripting.FileSystemObject | MSXML2.XMLHTTP | ADODB.Stream | WinHttp.WinHttpRequest.5.1 | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | T1105 | T1059 | COM Behavior Trace

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	add9566630629f62821f9e62696d669f
Sha1	c545deffc60e50f538d8136b578cf77ab648171f
Sha256	ae8faa1ae163a1280fdfc99b11b497b122817dd1496fc924864a47292022d3f7
Sha384	38674fea4d5e516381976f540a3a44c1942a63c513239ee2f35fdecbaa542480f408aef882825a6605924a3c3fe22851
Sha512	e2bb558433b92c56dc8ce3c6d4da64875cf8fd40a7df4d8a96506efd348795319de4fa61ff84fb18a36b46d86715bf8c10767da6e81f93cf6816b1b89cef493f
SSDeep	24:9m08qNZ35adt8v8ApBCf9TENXHHiAKMZap0x55HwgNGBocBK20ReonAeueN:9JFZcH8v8A/CfCNXnnEpO5HwgHcBKeol
TLSH	8431E98D073F1208C4DA5CB0816D6D31B897D84A91A5E44AD78EE2BD1D0E6EDD139F12

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>scr:vbs~T1027~T1059~T1059.005~T1105

Shape arc:zip>scr:vbs

malicious 2 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu
URL (COM trace) #2	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Command (COM trace) #1 UNKNWOWNmalicious

msiexehuhuhuhuhuhuhuhuhuhuhu

Dropped path (COM trace) #1 PATHmalicious

C:\Usehuhuhuhuhuhuhuhuhuhuhu

Trace COM ordonnée UNKNWOWNmalicious

line 8huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #2 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #3 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential