Malicious
Malicious

ea20a9f8bc166d904257304ac37369ed

Share on LinkedIn
Print
ZIP Archive
MD5: ea20a9f8bc166d904257304ac37369ed
Size: 48.56 KB
application/zip
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
MD5 ea20a9f8bc166d904257304ac37369ed
Sha1 ad0024085771c2a61b01cf2700774d1aca6c6608
Sha256 0d0cf937953e7bdc87d29f093f3667e618314b312a9bd70345b84e25be57fab7
Sha384 0c2156e5ea7df5d7dc09df27217255640ef2e360f53ac40ad3a33ce1e796320d0e41ca97f5c4309809ac47cd50031a79
Sha512 c4474683c5f59e4efcd66e3fd398dbd49fde86057ba7d1aa3b637c3afe60fe1e3971fe0ac28f0cca05f517dcfcd3fd8d650e7148031a16074d7a653ca951ff09
SSDeep 768:kJqTxbfLzImi7CS3nxCQB8iPbGhdLnOffn7g4vJ4JazIb0PCyyQWcX3tJ+oCeL:kSRIm1InQgSP8frvp0zw3tJj
TLSH 5123E1E8D7093502FC779BF82287252BD1B2640CA370916F1D6CB0271C4FAE56F6316A
ea20a9f8bc166d904257304ac37369ed
Malicious
command.py
config.py
connection.py
constants.py
extproc.py
fileops.py
grabber_user.py
handler.py
hardware.py
helper.py
idle.py
idle_report.py
launcher.py
launcher.vbs
Malicious
main.py
main_agent.py
message.py
profileproc.py
progress.vbs
Malicious
progress.vbs.comtrace
Malicious
[Command #1]
Malicious
[PowerShell Command]
Malicious
[Command #2]
Malicious
[PowerShell Command]
Malicious
[Command #3]
Malicious
[PowerShell Command]
Malicious
runtime.py
secrets.py
service.py
setup.bat
setup.py
showext.py
state.py
usbvideo.vbs
Malicious
utils.py
windows_registry.py
zip_archive.py
__init__.py
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 2secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path arc:zip>scr:vbs~T1027~T1059~T1059.005>scr:bat>scr:ps1~T1027~T1059.001
Shape arc:zip>scr:vbs>scr:bat>scr:ps1
malicious 4 nodes
Path arc:zip>scr:vbs~T1027~T1059~T1059.005
Shape arc:zip>scr:vbs
malicious 2 nodes
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #1 UNKNWOWNmalicious
cmd /chuhuhuhuhuhuhuhuhuhuhu
Command (COM trace) #2 UNKNWOWNmalicious
cmd /huhuhuhuhuhuhu
Command (COM trace) #3 UNKNWOWNmalicious
cmdhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
Clehuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
colhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
title huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙