Deep Malware Analysis of dc4c82ad02d1acf89201d55af7d6f26e | md5: dc4c82ad02d1acf89201d55af7d6f26e | SOS: 0.22 | PowerShell | Batch Command | PowerShell Call | Wscript.Shell | DeObfuscated | VBScript | T1059.005 | Obfuscated | T1027 | T1047 | COM Behavior Trace | T1059.001 | T1105

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Low

MD5	dc4c82ad02d1acf89201d55af7d6f26e
Sha1	848ede885554dd97d604e4ede827edf7aceb9be0
Sha256	26981dedd90f93b85e34cb2f901c9bf1e9fb754eb07c000ca070128b9d51a56c
Sha384	c5d6e234125e1655063a958c32ce9939cbe22d26b803b49ca0323dc7eeaa10a45efd90f6f48494cef9ddc8f2a310f2a9
Sha512	ecd29765b250483b3f41fc95ecf0e214b460765a4f1800bb17719a0c2fd96821f4bb5f0773e2471b05ec6200808099878116b16a2db2054c19b4864ff368e2b0
SSDeep	1536:W0aa35m22oQKqWkm3gEG+qU+yoPAdzdLpSFRcb1Rob1Q:1jFoIlWI
TLSH	CC83D891A8415D0DCD95682171BB7503A13483EFA24CED99F2E44ABC89C3F15FFE22B6

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

4 / 4

Path

scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1105

Shape scr:vbs>scr:ps1>scr:vbs>scr:ps1

malicious 4 nodes

Path

scr:vbs~T1027~T1047~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1059.001~T1105

Shape scr:vbs>scr:ps1>scr:vbs>scr:ps1

malicious 4 nodes

Config. Field	Value
URL (COM trace) #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Config. Field	Value
URL in PowerShell #1	https:huhuhuhuhuhuhuhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Trace COM ordonnée UNKNWOWNmalicious

line 3huhuhuhuhuhuhuhuhuhuhu

URLs in VB Code - #1 URIsuspect

https:huhuhuhuhuhuhuhuhuhuhu