Deep Malware Analysis of ba0e6b2803470a769a0fbbcef4e0902e | md5: ba0e6b2803470a769a0fbbcef4e0902e | Zip Archive | LNK | Malicious | LOLBin | LOLBin:%COMSPEC% | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call | T1027 | DeObfuscated

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	ba0e6b2803470a769a0fbbcef4e0902e
Sha1	a5f9ab3ef7a293440d572782c1753f60e28ed8ca
Sha256	48a34014da3a472c643e06a8036d5e7daf3ed1a89b4f23a6570a5ba8eddcc337
Sha384	83eb5db7fc0454a73870a50337fe24711285265eaf7975ed5e9d282959527a3599eca89bb10e9b25effd7cf894c9c5fd
Sha512	504a9d044670741316d1eb57317ebc95cfa7785f0418ae4775c2356f89cf52f234a95f6db3e2ab6100cfc99fef31aacc7d263621d3b7192e0101ea4b2615a386
SSDeep	24:99z3mAICd5bOazxZpKlONbqTV+sTUSeBciNqL8PhgBT+mSGphDY7gojzCBgApTbX:913D1L1bqTgsYBuiQwgcPGnDY7gonGPd
TLSH	D021CAD0F6554C02E58C933BB602DD4C255DD23A944ADEA7C30D32B66D53E683E0BAD8

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001

Shape arc:zip>lnk>lnk:cmd>scr:ps1

malicious 4 nodes

Path arc:zip>lnk

Shape arc:zip>lnk

2 nodes

LNK: Command Execution UNKNWOWNmalicious

%COMSPhuhuhuhuhuhuhuhuhuhuhu

Deobfuscated PowerShell UNKNWOWNmalicious

$cb7drhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential