Malicious ZIP Archive analysis – 148322138dc8

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

ZIP archive

Size

13.23 MB · 13,229,340 B

First seen

2026-08-25 19:30 · 2 months ago

Last seen

2026-08-25 19:30 · 2 months ago

Last analysis

2026-08-25 19:31 · 2 months ago

Hashes

MD5 d8ebae54f85db7e248e1533487a4ef80 Sha1 67767d25dc6f77349f10ed610f071be643ab2444 Sha256 148322138dc8b3fe438007441b2eb6ef5546417f72204a0b3b5eb9cf0a4d6163 Sha384 f43464a3fa8a9446926dddc1de2b0f06f5764b482ba8c16190397128c2ffdda4692aae13259b53145c067ff6ba26ab81 Sha512 1499b5c15f3160d17acb64b5b361e6ede6a762dd79cd69c9f9e246712120cd6a4fe90cd712cc9f5118ee251919db752a694607adb1d4ccbe554a8a0668620408 SSDeep 393216:BjFGFWU+GrInh9y9VUMm04Kj6byVtbMpItfr:BJgFcnUkLKm+vMpItT TLSH C3D612A491FB0817DF0EB6FBF0C59186ADECC7EA5C255C66283C23CA4C961B11BD621D

15 malicious · 1817 files

ZIPd8ebae54f85db7e248e1533487a4ef80

BINnode_modules

BINcorepack

MDCHANGELOG.md

BINdist

JScorepack.js

BINlib

PS1corepack.cjs

PS1[PowerShell Command]

PS1[Deobfuscated PS]

PS1[PowerShell Command]

BIN[Base64-Block]

JSnpm.js

JSnpx.js

JSpnpm.js

JSpnpx.js

JSyarn.js

JSyarnpkg.js

MDLICENSE.md

JSONpackage.json

MDREADME.md

BINshims

BINnpm

BIN.npmrc

BINbin

BINdocs

JSindex.js

BINlib

BINLICENSE

BINman

BINnode_modules

BIN@isaacs

BIN@npmcli

BIN@sigstore

BIN@tufjs

BINabbrev

BINagent-base

BINansi-regex

BINaproba

BINarchy

BINbin-links

BINbinary-extensions

BINcacache

BINchalk

BINchownr

BINci-info

BINcidr-regex

BINcli-columns

BINcmd-shim

BINcommon-ancestor-path

BINcssesc

BINdebug

BINdiff

BINemoji-regex

BINencoding

BINenv-paths

BINerr-code

BINexponential-backoff

BINfastest-levenshtein

BINfs-minipass

BINglob

BINgraceful-fs

BINhosted-git-info

BINhttp-cache-semantics

BINhttp-proxy-agent

BINhttps-proxy-agent

BINiconv-lite

BINignore-walk

BINimurmurhash

BINini

BINinit-package-json

BINip-address

BINip-regex

BINis-cidr

BINis-fullwidth-code-point

BINisexe

BINjson-parse-even-better-errors

BINjson-stringify-nice

BINjsonparse

BINjust-diff

BINjust-diff-apply

BINlibnpmaccess

BINlibnpmdiff

BINlibnpmexec

BINlibnpmfund

BINlibnpmorg

BINlibnpmpack

BINlibnpmpublish

BINlibnpmsearch

BINlibnpmteam

BINlibnpmversion

BINlru-cache

BINmake-fetch-happen

BINminimatch

BINminipass

BINminipass-collect

BINminipass-fetch

BINminipass-flush

BINminipass-pipeline

BINminipass-sized

BINminizlib

BINms

BINmute-stream

BINnegotiator

BINnode-gyp

JSON.release-please-manifest.json

GYPIaddon.gypi

BINbin

MDCHANGELOG.md

MDCODE_OF_CONDUCT.md

MDCONTRIBUTING.md

JSeslint.config.js

BINgyp

BINlib

JSbuild.js

JSclean.js

JSconfigure.js

JScreate-config-gypi.js

JSdownload.js

JSfind-node-directory.js

JSfind-python.js

PS1Find-VisualStudio.cs

PS1[Deobfuscated PS]

PS1find-visualstudio.js

PS1[PowerShell Command]

PS1[Deobfuscated PS]

BIN[Base64-Block]

JSinstall.js

JSlist.js

JSlog.js

JSnode-gyp.js

JSprocess-release.js

JSrebuild.js

JSremove.js

JSutil.js

BINLICENSE

SHmacOS_Catalina_acid_test.sh

JSONpackage.json

MDREADME.md

JSONrelease-please-config.json

MDSECURITY.md

BINsrc

BINnopt

BINnpm-audit-report

BINnpm-bundled

BINnpm-install-checks

BINnpm-normalize-package-bin

BINnpm-package-arg

BINnpm-packlist

BINnpm-pick-manifest

BINnpm-profile

BINnpm-registry-fetch

BINnpm-user-validate

BINp-map

BINpacote

BINparse-conflict-json

BINpath-scurry

BINpostcss-selector-parser

BINproc-log

BINproggy

BINpromise-all-reject-late

BINpromise-call-limit

BINpromise-retry

BINpromzard

BINqrcode-terminal

BINread

BINread-cmd-shim

BINretry

BINsafer-buffer

BINsemver

BINsignal-exit

BINsigstore

BINsmart-buffer

BINsocks

BINsocks-proxy-agent

BINspdx-correct

BINspdx-exceptions

BINspdx-expression-parse

BINspdx-license-ids

BINssri

BINstring-width

BINstrip-ansi

BINsupports-color

BINtar

BINtext-table

BINtiny-relative-date

BINtinyglobby

BINtreeverse

BINtuf-js

BINunique-filename

BINunique-slug

BINutil-deprecate

BINvalidate-npm-package-license

BINvalidate-npm-package-name

BINwalk-up-path

BINwhich

BINwrite-file-atomic

BINyallist

BINnpmrc

JSONpackage.json

MDREADME.md

BINSDK

DLLpython36.dll

EXESetuр.exe

DLLsvga3dsw.dll

DLLvcruntime140.dll

DLLzlib1.dll

BINbin

BINlicenses

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 11 STICH kept: 3secondary ignored: 8

bin 5img 3

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

3 / 3

Path arc:zip>scr:ps1~T1027~T1059.001

Shape arc:zip>scr:ps1

malicious 2 nodes

Path arc:zip>scr:ps1~T1059.001

Shape arc:zip>scr:ps1

technique2 nodes

Deobfuscated PowerShell UNKNWOWNmalicious

"use shuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential