Deep Malware Analysis of b578c78fb9cb2b94c7ff31cb8ca9bacb | md5: b578c78fb9cb2b94c7ff31cb8ca9bacb | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	b578c78fb9cb2b94c7ff31cb8ca9bacb
Sha1	5aa607d2fac92643a234417a223b8fe671d4f806
Sha256	53623e0711a41f08b777a50d46a79dc390b64ce7a080a9dd02417beeb0a3d06e
Sha384	7170f45ea55e2375e04f3498bac048b0d1d3cb9c82352048dfe37523b9dd99faadcfbac6584ff1197b5d463bf533ab83
Sha512	f421127a576e807fe7b039ed415fc65392e3612618721a31d99f7ded34dece74fd446b864809959c04de97b62ca30c7d242815a3369883735d19308327414a7f
SSDeep	192:Z6wug3ZZKAj6XbLUoxvMJRsFSLn0IthnSGcwqJQhj3Y:F85ZMJGFSLn1hHUJYTY
TLSH	8002C0262F44AD31E036B64CAB78A27A53FB64742BDC224369AE277A3753700D3DD518

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential