Malicious
cfec796592331a426e59a66ba008003d
PowerShell
MD5: cfec796592331a426e59a66ba008003d
Size: 59.51 KB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | cfec796592331a426e59a66ba008003d |
| Sha1 | 7ef07012eef3f27c43dc733cd3fdbbf27697870c |
| Sha256 | 24659741d848df76bca81f288f113be78422ea865368b02e5b8d1034827f28b6 |
| Sha384 | 808bd72677b8e1cd47dd954cd5fa89a1ea61b7119fa88d69ca380444220920cfe23bf3bf6409378d72ea60adf95be29c |
| Sha512 | 301bff04f148073ba4472dfa0105076bdcac76c51f592b37f97c908d78e563812c0318adf8040560c5cf406fad11c39c9df08e4ee3f5be76f95b6082e0347bfb |
| SSDeep | 1536:siem4QgL+O0SbzP7Ha+POG3/cUVvqYImwvb5YGOvKRZc0b099P:siem4QgL+O0S3LaePcUVvqYIm8b5YG1e |
| TLSH | 42430512B251E53846F35B3AE9EB5149FA2B403F466A1100BADED5E01F32165837EFEC |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1059.001~T1105
Shape
scr:ps1
malicious
1 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #4 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #6 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #3 | https:huhuhuhuhuhuhu |
| URL in PowerShell #4 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #5
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6
URImalicious
https:huhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #3 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #4 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #5 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #6 | https:huhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #2 | https:huhuhuhuhuhuhuhuhuhuhu |
| URL in PowerShell #3 | https:huhuhuhuhuhuhu |
| URL in PowerShell #4 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
cfec796592331a426e59a66ba008003d
URL in PowerShell #2
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
cfec796592331a426e59a66ba008003d
URL in PowerShell #3
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
cfec796592331a426e59a66ba008003d
URL in PowerShell #4
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
cfec796592331a426e59a66ba008003d
URL in PowerShell #5
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
cfec796592331a426e59a66ba008003d
URL in PowerShell #6
URImalicious
https:huhuhuhuhuhuhu
cfec796592331a426e59a66ba008003d
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.