Deep Malware Analysis of b99e3ac29a8eaf4ae21aa0338b6bc209 | md5: b99e3ac29a8eaf4ae21aa0338b6bc209 | PowerShell | Batch Command | PowerShell Call | Scripting.FileSystemObject | Shell.Application | VBScript | T1059.005 | T1059.001 | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	b99e3ac29a8eaf4ae21aa0338b6bc209
Sha1	28df4f6678645ae10d203bdea9a671ff47a713da
Sha256	f62519453afb691de16b4674927332cc8b28b4325c4e19892d31813b691652d0
Sha384	3dfb59d02bca4c54d63903df8101f1ce6b7961469ef4d1d1fe9c4b87732f7b2cfbad72a59b74298eab1113d971f2fbc2
Sha512	859f18c66b7a365572fe6feadfa10dbb0243eb429f130da3c26b7daaa59fd58629880190f2c76bd2dcea7170e78bd47e71cec0de27055f71f52029249e27ca34
SSDeep	6:jw+7y0Px+yBpauBhNFvo0AgB8GFPuEs4oJXcviUhtpG9J9P9:dOp4BvNB8XE/oVcqwkP
TLSH	28E02652001E869A0DA727E555D6484D8011A2E46E74A161BF40C8DD642D2ACA3B928E

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:vbs~T1059.005>scr:bat>scr:ps1~T1027~T1059.001

Shape scr:vbs>scr:bat>scr:ps1

malicious 3 nodes

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

Invokhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential