Malicious
b09a0ac5c44025de20d1f45ddd00c2ac
VBScript
MD5: b09a0ac5c44025de20d1f45ddd00c2ac
Size: 222 B
text/vbscript
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | b09a0ac5c44025de20d1f45ddd00c2ac |
| Sha1 | 64d66761cbbf6d69118c0e0d770d5a45df408046 |
| Sha256 | d5d34d1b316b802ccb92d4dcc5c2c336c4432407ecba5925795e6ab31e00597d |
| Sha384 | c848b5dbe7ed658372467549e08da7e2f5572109ec2b3c8a3900a74b6d0628e1b0b76b676ec8a3296df31a90c50c3d1a |
| Sha512 | 711abd1b1aa44d5b7b6e6266c4d82b55276b38d71118e662c0fbb97d49feee15f229f524799a65ce5dc04a7246e8ddad8bc0270df97ca21c567cade68a402596 |
| SSDeep | 6:j+q9NqhnfBMbHZGnc4KFrFHJhjNEEHZtyJHbr:KqahpSCAFHJhhE0Ql |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001~T1105
Shape
scr:vbs>scr:bat>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Command (COM trace) #1
UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
b09a0ac5c44025de20d1f45ddd00c2ac
Trace COM ordonnée
UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
b09a0ac5c44025de20d1f45ddd00c2ac
URLs in VB Code - #1
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
b09a0ac5c44025de20d1f45ddd00c2ac
Deobfuscated PowerShell
UNKNWOWNmalicious
Removehuhuhuhuhuhuhuhuhuhuhu
b09a0ac5c44025de20d1f45ddd00c2ac › b09a0ac5c44025de20d1f45ddd00c2ac.comtrace › [Command #1] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.