Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 bb349926d552e1800d8ab61d1e70968f
Sha1 1165ca23e4471663e5a7c10a630e0fe89f94f39e
Sha256 9ac48d8bc52702ec7d94141082abad65867fb1f9a8e4d3c100b634d8ba95574a
Sha384 c98c9f03535413509ff16bde50e90b0dc62403280e47c5eabb8e581cdacccdff873484a8277f42fe96f8afbb99289d8e
Sha512 12831e2dac79ee12b6de8027e2de7f40653214d63bb3028484c78b85ec2db152b8d97aa132d9b5e16175777eb83c196eae0531a3c0281e9e4468f3f1e1da9bbf
SSDeep 24:9UTx5Dh9K9Vi3upMURKRaljJZmSLlVeh6EpR4Zul:9UFE+3wXVZPLlU9UZul
TLSH 1F21C67A01CB8C84CF67F0370286607A56244110C3573B2BF62C665DCD2AB5C673956B
bb349926d552e1800d8ab61d1e70968f
Malicious
photov_985484071957.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_538134407426.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$ewc0bhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
bb349926d552e1800d8ab61d1e70968f
Malicious
photov_985484071957.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_538134407426.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
bb349926d552e1800d8ab61d1e70968f › photov_985484071957.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$ewc0bhuhuhuhuhuhuhuhuhuhuhu
bb349926d552e1800d8ab61d1e70968f › photov_985484071957.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙