Malicious
PowerShell
MD5: b35ec6887f558684e929a711c2becd4e
Size: 1.66 MB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
1.66 MB · 1,659,282 B
First seen
2026-09-15 09:45 · one month ago
Last seen
2026-09-15 09:45 · one month ago
Last analysis
2026-09-15 09:46 · one month ago
Hashes
MD5
b35ec6887f558684e929a711c2becd4e
Sha1
1d506584c428761f3eae48ae437ffb51efb6b675
Sha256
7d29ead638414d002d0c60db258081385393e6f08348f77685f6f1a7cebb4bdf
Sha384
7e5b4ac00c0527064497953887e312849775890fc1fc3123b5b40d32b7d00ff58b1938052b13a6093498297a6cd9591f
Sha512
d9045315db7eac0186c2d006f09e8c0b678241080bedbb8850d9f933952589443b7859030562734a429eadb10372689bcff779b4934df8a137647d420e56a1df
SSDeep
12288:tUwWhuxyGyQOiPm1y9ptV4jxeRRHWd+oKSbfnlBLkeYYI/VD7p3ArRqch8IiHCBB:s
TLSH
B17500523651FD7D029693B16E1646F0A86ACA80CEDF8556F24DCE8CB14DC823AF93C7
3 malicious · 5 files
PS1b35ec6887f558684e929a711c2becd4eT1105 · T1059.001
EXE[Base64-Block @0x00192505]
PS1[PowerShell Command]T1105 · T1059.001
PS1[PowerShell Command]T1105 · T1059.001
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1059.001~T1105>pe:dll>pe:rsrc>bin
Shape
scr:ps1>pe:dll>pe:rsrc>bin
malicious
4 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #3 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential