Deep Malware Analysis of b5891cbfb31a46357a3749487486984d | md5: b5891cbfb31a46357a3749487486984d | Javascript | T1059.007 | PowerShell | Powershell: Hidden Execution | T1059.001 | T1027 | DeObfuscated | T1105

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	b5891cbfb31a46357a3749487486984d
Sha1	e93f7566922428740ef95e45d83e30c8da03be81
Sha256	7f97451f3eb454915ff6a6f897910565bf30e0aefbf4408f997c87854ef9a492
Sha384	d844c8ed30ebf63bae3e62704d3a76f24da4b7e97ed03e729218454f5a95f84155a7c1907dfa609498358ad08c776b8c
Sha512	afa5a6fe9fbe0e785999d082898978798fa2fe48cb9517ea644d0a1ada58d8154fbd9d7d00d72fb1b8ef086666acd6d72408079fb28abcf0d9ab0f6cd3af7ed5
SSDeep	1536:2fFGfTgf9fgf9fyfgfIfgfgfyfgfGfyfgfffyfTgfXfgfLfmfgf3fFGfTgfzfgfm:24Mlol6oAoo6oO6on6MPoDuov4M7oaA0
TLSH	BE83449B1B08CF960A55B87845574ECED5277BC3D3C2D749EC8F3B01A12C4DA68ABA34

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:ps1~T1027~T1059.001~T1059.007~T1105

Shape scr:ps1

malicious 1 nodes

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential