Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
37 malicious · 37 files
VBScc2fa5d1e8557b9db21b12766da0a97aVBScript
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
BINcc2fa5d1e8557b9db21b12766da0a97a.deobfuscated.vbs
SH[Command #0] code extracted · Bash Script
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
SH[Command #2] code extracted · Bash Script
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
SH[Command #3] code extracted · Bash Script
SH[Command #4] code extracted · Bash Script
SH[Command #5] code extracted · Bash Script
SH[Command #6] code extracted · Bash Script
SH[Command #8] code extracted · Bash Script
SH[Command #9] code extracted · Bash Script
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$zonehuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
Add-Mphuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"$Proghuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
37 malicious · 37 files
VBScc2fa5d1e8557b9db21b12766da0a97aVBScript
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
BINcc2fa5d1e8557b9db21b12766da0a97a.deobfuscated.vbs
SH[Command #0] code extracted · Bash Script
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
SH[Command #2] code extracted · Bash Script
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
SH[Command #3] code extracted · Bash Script
SH[Command #4] code extracted · Bash Script
SH[Command #5] code extracted · Bash Script
SH[Command #6] code extracted · Bash Script
SH[Command #8] code extracted · Bash Script
SH[Command #9] code extracted · Bash Script
PS1[PowerShell Command]code extracted · PowerShell
PS1[Deobfuscated PS]deobfuscated · PowerShell
No malware configuration was found at this point.
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
cc2fa5d1e8557b9db21b12766da0a97a
URLs in VB Code - #2
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
cc2fa5d1e8557b9db21b12766da0a97a
URLs in VB Code - #3
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
cc2fa5d1e8557b9db21b12766da0a97a
URLs in VB Code - #4
URIsuspect
http:/huhuhuhuhuhuhuhuhuhuhu
cc2fa5d1e8557b9db21b12766da0a97a
Deobfuscated PowerShell
UNKNWOWNmalicious
"$zonehuhuhuhuhuhuhuhuhuhuhu
cc2fa5d1e8557b9db21b12766da0a97a › cc2fa5d1e8557b9db21b12766da0a97a.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
Add-Mphuhuhuhuhuhuhuhuhuhuhu
cc2fa5d1e8557b9db21b12766da0a97a › cc2fa5d1e8557b9db21b12766da0a97a.deobfuscated.vbs › [Command #2] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"$Proghuhuhuhuhuhuhuhuhuhuhu
cc2fa5d1e8557b9db21b12766da0a97a › cc2fa5d1e8557b9db21b12766da0a97a.deobfuscated.vbs › [Command #9] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Coming soon: export of this report's indicators to MISP and EDR platforms.
