Malicious
PowerShell
MD5: bb13a6dd1fa3ceb4afc1e57cca9720dd
Size: 213.02 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
PowerShell Script
Size
213.02 KB · 213,020 B
First seen
2026-10-07 04:00 · 18 days ago
Last seen
2026-10-07 04:00 · 18 days ago
Last analysis
2026-10-07 04:00 · 18 days ago
Hashes
MD5
bb13a6dd1fa3ceb4afc1e57cca9720dd
Sha1
1c42868f0c17d51d3f6c0978e290f7cafa5f8a77
Sha256
6ee948412a06d2402d7967975e410a7069c75d0bcfb6afd0d7a9215579e2a5c3
Sha384
3b54157d81ff5a63aefbbaae179c96c8c6fcc5646cd454dc292d0c5af5f97eb007feb0305703cd6657867f7856200704
Sha512
5ba9c82011e0a82270dbe131b44f7446160c359a0c63c0f0f7c645275ca23cd45c4e737b280b2091d533133f4132182cfffa06e27d9779d4f121832d21565eb9
SSDeep
3072:XO0O6j5VeNx42G7xEotKLI8K/bc9yRBjgT6WbIVr2wKof:+0Oc5VeNx42PI8KpjgmjZ
TLSH
2224932539C0A665254DDCB72C450C1DA9C8F477E38BA84D79CF49C5AF47AB88BEC838
3 malicious · 3 files
PS1bb13a6dd1fa3ceb4afc1e57cca9720ddT1027 · T1105 · T1059.001
BIN[Deobfuscated String]T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1059.001~T1105
Shape
scr:ps1
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialDeobfuscated PowerShell
UNKNWOWNmalicious
(?i)
huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
ise | huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential