Malicious
b194b81c477a6d9a1b448ee2a5bffa82
Disk Image
MD5: b194b81c477a6d9a1b448ee2a5bffa82
Size: 407.55 KB
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | b194b81c477a6d9a1b448ee2a5bffa82 |
| Sha1 | 9a54fd35062d83e5105bc56bab98bfc743146951 |
| Sha256 | 5f4bf788c53ba55b9ed13ac1d71e636ed6d378c7d04ff1bd9d2ec52015cf36df |
| Sha384 | c3d3cfb7c17545515825f2b6418b88005c3d75dd437ee3b1aa24782e42543c0bad40b3cd7e0392f2c76c5f51aeda7206 |
| Sha512 | a9dee7acc004bf516e0b9f6c099c4b4360bce871e66976154d820fb0ea09017cd68359c12d77d6900be94a8e513d378479c4985f5a84a39977cb21dbef29d879 |
| SSDeep | 6144:PfOICnReKRU6dpNUuyFfX/iz5VgZuPFB:P2IMPUXFCtSZcB |
| TLSH | 2E8439317545CF32D56F017098A49AF99A2FAC218F615BC7B38C7E693B306C2AE31617 |
Malicious
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 5
STICH kept: 2secondary ignored: 3
bin
2img
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
img:disk>scr:ps1~T1027~T1059.001~T1105
Shape
img:disk>scr:ps1
malicious
2 nodes
Path
img:disk>pe:dll
Shape
img:disk>pe:dll
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| ISO | DiskImage extraction mode: DiscUtils (ISO) |
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Malicious
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | http:/huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1
URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
b194b81c477a6d9a1b448ee2a5bffa82 › file.txt
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.