Deep Malware Analysis of cfec796592331a426e59a66ba008003d | md5: cfec796592331a426e59a66ba008003d | PowerShell | T1059.001 | T1105 | Powershell: Hidden Execution

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	cfec796592331a426e59a66ba008003d
Sha1	7ef07012eef3f27c43dc733cd3fdbbf27697870c
Sha256	24659741d848df76bca81f288f113be78422ea865368b02e5b8d1034827f28b6
Sha384	808bd72677b8e1cd47dd954cd5fa89a1ea61b7119fa88d69ca380444220920cfe23bf3bf6409378d72ea60adf95be29c
Sha512	301bff04f148073ba4472dfa0105076bdcac76c51f592b37f97c908d78e563812c0318adf8040560c5cf406fad11c39c9df08e4ee3f5be76f95b6082e0347bfb
SSDeep	1536:siem4QgL+O0SbzP7Ha+POG3/cUVvqYImwvb5YGOvKRZc0b099P:siem4QgL+O0S3LaePcUVvqYIm8b5YG1e
TLSH	42430512B251E53846F35B3AE9EB5149FA2B403F466A1100BADED5E01F32165837EFEC

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path scr:ps1~T1059.001~T1105

Shape scr:ps1

malicious 1 nodes

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #4	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #5	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #6	https:huhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2	https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #3	https:huhuhuhuhuhuhu
URL in PowerShell #4	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

URL in PowerShell #1 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #2 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #3 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #4 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #5 URImalicious

https:huhuhuhuhuhuhuhuhuhuhu

URL in PowerShell #6 URImalicious

https:huhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential