Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 c696211155ead3b8f54be535f68aa925
Sha1 0285a51ffb97b18bdababe3ab706696ded3fd2fe
Sha256 73ce6dec11d8f4be64e7a79f82b47c505be8f3b5dd0c5a2715eaa32aeaa68b3e
Sha384 a1b9b78cbb101f28ddb622e57e87dcc35e72e5fa675d808b57255142b1fe974ca1470e5294fb7db6677356d4e6562ce2
Sha512 a87f9bd5b671603d9990863bc526547342061230db9fb5cce8a13415afbd3b7bdd09425c9684fc3d71bd42ac4cee6288931b36b8e3854c72e9c8e9883d53c60d
SSDeep 24:9U346tgjwMMNcM7ZKuTXIG7XyCs+I0aIjiO2NpoimScY4SH1HoBneV34CQgpoDL:96gjWVKcXfe5+SIjiDrZPc6HgnedIL
TLSH A621DA6BCC15C724C741D175FCC3D52C153A50B0E58D21CB95993CE7746284CBD5E360
c696211155ead3b8f54be535f68aa925
Malicious
photov_190026442150.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_513570585664.mp4
[Lnk Summary]
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk
Shape arc:zip>lnk
2 nodes
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
$obcl huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
c696211155ead3b8f54be535f68aa925
Malicious
photov_190026442150.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
videoa_513570585664.mp4
[Lnk Summary]
No malware configuration was found at this point.
LNK: Command Execution UNKNWOWNmalicious
%COMSPhuhuhuhuhuhuhuhuhuhuhu
c696211155ead3b8f54be535f68aa925 › photov_190026442150.lnk
Deobfuscated PowerShell UNKNWOWNmalicious
$obcl huhuhuhuhuhuhuhuhuhuhu
c696211155ead3b8f54be535f68aa925 › photov_190026442150.lnk › LNK CommandLine › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙