Deep Malware Analysis of e389394ddf91f89ffa49ad5958122dd7 | md5: e389394ddf91f89ffa49ad5958122dd7 | Zip Archive | LNK | Malicious | LOLBin | LOLBin:powershell.exe | Execution: CMD in LNK | T1059.003 | T1202: Indirect Command Execution | T1204.002 | Execution: PowerShell in LNK | T1059.001 | PowerShell | Batch Command | PowerShell Call

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

MD5	e389394ddf91f89ffa49ad5958122dd7
Sha1	5d3f9fc4a2d2732fd3a9b757adec4974fad40890
Sha256	d28f8996e7950f461242a43a37f6b9caa37a82f44d64e47d8570041b09aba6f9
Sha384	9a65abc91c63b7051efa908405004ff9139f09cbeaede4cb470de0537a60e155390682f93ea2b988668ac461a4f06171
Sha512	b272c2221ffab5b6197d85ac057f38640f48dfb4beaa1aa6ead85798673ffb6fd863236c67338eb5ccbef618cdcd922c15de78bcc119911a1cd50f6d0902104a
SSDeep	48:9fUdWfR13K8BBSnpYzYKkwRWb64joDI1D7hKMWrUD:H51jBYpzM4jQI1O6
TLSH	2A41A6898ABC1D43CBF7BDB179D166CA631D61CB15317213370881D61A37877BBAA290

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1

bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path arc:zip>lnk~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd

Shape arc:zip>lnk>lnk:cmd

malicious 3 nodes

LNK: Command Execution UNKNWOWNmalicious

powershuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential