Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 be22b78d684da1213589abeaff731293
Sha1 68d939c0e443e4efc600feee6d2dba780197ee04
Sha256 70834d14952834148288f1cf93edbac7eeb8a62cb90fb312c8e3091b1e14cb89
Sha384 87ef8f466571a5262d73047e98187b8451467afd755a3b97c03c1bf8e7a3bf8350b48a8890c45e80840eaa282d20de57
Sha512 d77c923e942a704e6bf487da9b689472ee7087c32e4a25b81459bfb90e95d55c9b722ec17b47323a924663b53f2f5ddf58b6a42edfafa7fb4bf00aa6da1ffce7
SSDeep 24:9mGYloXHi9OWk1eoT712udYrVG9yrxNBbdWFMHmkQ+XX1/5cpeYWDwb6L6KbGpX:9fQoXHmjoT5/dYrjfdWF+T/XHcpeYWEX
TLSH 8E31B964826F826AC8C52EBD7EE61344646D3195428490EF63D724A21A74F693FC7CA1
be22b78d684da1213589abeaff731293
Malicious
photov_666120654596.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_066617938191.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$v3wthhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
be22b78d684da1213589abeaff731293
Malicious
photov_666120654596.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_066617938191.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
be22b78d684da1213589abeaff731293 › photov_666120654596.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$v3wthhuhuhuhuhuhuhuhuhuhuhu
be22b78d684da1213589abeaff731293 › photov_666120654596.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙