Deep Malware Analysis of c93b565d9c6b897e127a17ffcaa8d50e | md5: c93b565d9c6b897e127a17ffcaa8d50e | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	c93b565d9c6b897e127a17ffcaa8d50e
Sha1	67768afe9c7413efd88c741df27c445ce2f66d9b
Sha256	009803420ed70ac96ff0783784ddd70bfa1b05f430fc753278b9266e7848a32a
Sha384	d72b90312ad32199fc8cd45eab774d274b709ce33d1f3f7ef0eb073c76bc078237dab01849d647deb7cd35a7fcb90309
Sha512	e9fae289d5c46a542e1b6f4effb4a3b007afec314ca105a67928ffa15da1d0a258d51225d95e74b72cf9276259afe47d5a18cebdf6a1b5c6ae5cef1a71a4d6f2
SSDeep	384:0OlPiKg1T/tQs6BwINOqEs/fmh4OZcNxNFyee9DhTVcvyaFfY:0OtgZ/KNOqD/+WOExNFyN9DhxMzpY
TLSH	6572DF96CB8A17A2C53AF1782DCC9DA782E4B06ABE6531F6C541A15D5F010902FE3B28

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential