Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 e3d489c1423f52c23257b4f647039d29
Sha1 2e06c3db2d476bb62f8f423f56de567efd86816b
Sha256 842d49501e0650601458936ade269902a6182c5ba10e731be7f8a87b1d206818
Sha384 d6714c5f37107c6415d330b9204417f737292b354214fa9575655b55319bd56c8b705cc83f03f00f2ad68ff43f13a3e7
Sha512 9616393fa4659f8c695718e36bc740a4f350dc44ceb2b496fa4a3aead7e86894606b371132b3b0078879a86d53f97d11228ff6e6e571f95aebfb67c4268784fc
SSDeep 24:91uzwgg37zazfmLws293Bh5oZvVJBqvRqzYIlhHE0oI4bObKLg/tl:9kz1gDLwf9xhKZjgvRFwhjo1Kqg/X
TLSH FE21C61E02603C13CA1D20F4093BA8AC6069C3E172B8275EC95D6F85CD052017A8C383
e3d489c1423f52c23257b4f647039d29
Malicious
Complete bill - NAGA.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002>lnk:cmd~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape arc:zip>lnk>lnk:cmd>scr:ps1
malicious 4 nodes
Path arc:zip>lnk~T1027~T1059.001~T1059.003~T1202~T1204.002>scr:ps1~T1059.001
Shape arc:zip>lnk>scr:ps1
malicious 3 nodes
e3d489c1423f52c23257b4f647039d29
Malicious
Complete bill - NAGA.lnk
Malicious
LNK CommandLine
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Lnk Summary]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙