Malicious
b7b98986c5cf8cbbe0067f0a60660d92
PowerShell
MD5: b7b98986c5cf8cbbe0067f0a60660d92
Size: 83.01 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
83.01 KB · 83,008 B
First seen
2026-09-29 06:15 · 26 days ago
Last seen
2026-09-29 06:15 · 26 days ago
Last analysis
2026-09-29 06:15 · 26 days ago
Hashes
MD5
b7b98986c5cf8cbbe0067f0a60660d92
Sha1
12ec82cd3b2ee632ddfe0f8a70140041a94b5a9f
Sha256
059a1dc5280223b2a55ee373722e7b8850f28da144062661877f8f0f7fc6e085
Sha384
31bc5c9cd1c52edb0de0d500e82ea531bdbb581c16b083113051e3fa61aaa98c77cdaaa1ea27ee52c46777cabe2519b1
Sha512
3bf14e6efd7a22dc9affaa11b579e6251f895c3a153a4b0b2d02a3ce3b957063c07b33127f2fac90e41855eb71a46401348fbd4dd964adc166f9db51c0704c70
SSDeep
1536:t/ls13dQhPau7h/X/1qeclxJXUoX+HizO1rk89QvO1dB0WSt6mD0MGXS:tds1ydRv0rxlUvXkTmS
TLSH
E083AFCED89F04D29C073A9A452E25467BB44333061CC414B96DBAC95F6397A80EEFF9
5 malicious · 6 files
PS1b7b98986c5cf8cbbe0067f0a60660d92T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Base64-Block]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1059.007~T1105
Shape
scr:ps1
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | htthuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
htthuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential5 malicious · 6 files
PS1b7b98986c5cf8cbbe0067f0a60660d92T1027 · T1105 · T1059.001
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
BIN[Base64-Block]
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | htthuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialURL in PowerShell #1
URImalicious
htthuhuhuhu
b7b98986c5cf8cbbe0067f0a60660d92 › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account