Malicious
f16e36b1872294feeead4605078af08c
ZIP Archive
MD5: f16e36b1872294feeead4605078af08c
Size: 806 B
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | f16e36b1872294feeead4605078af08c |
| Sha1 | 74473113f6a5b97fdae279130204d9884cdfbdc9 |
| Sha256 | dd1fc30d158402e2a2e963a7f291e3cf268c07d2d9c46abebbb7546e0eb7d49f |
| Sha384 | cd146f40bc74a7fd1bfccdd72539a03d84f9c528690bd836293aafcc67d036241e2c2fdf509161f65bb4f88884c42f7f |
| Sha512 | 3f437399381d9d0fc9f907d8a6f587153433a9f26e53d9a80788ce4715fd14fa057457acddbf91655fd1ef33a863a371a5d756833686b3069dc3bd518fc15e11 |
| SSDeep | 12:5j/LfibL6a9V6wBaqAv/QvPIRB5PK8eI9WzYsrjtQRJO7fHa86eSaa:9/LKH/9EwKY3sq8eIcPrhQ2CeQ |
| TLSH | 980181C2EB266DB2D0EC5C33011D06B3A280D289C903D316ABC0D3ADEB23D801817900 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:ps1~T1027~T1059.001~T1105
Shape
arc:zip>scr:ps1
malicious
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell
UNKNWOWNmalicious
^
"$Ehuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
^
$erhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
^
$erhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell
UNKNWOWNmalicious
^
"$Ehuhuhuhuhuhuhuhuhuhuhu
f16e36b1872294feeead4605078af08c › WebexSetup-V.7.3.bat › [PowerShell Command] › [PowerShell Command]
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
f16e36b1872294feeead4605078af08c › WebexSetup-V.7.3.bat
Deobfuscated PowerShell
UNKNWOWNmalicious
^
$erhuhuhuhuhuhuhuhuhuhuhu
f16e36b1872294feeead4605078af08c › WebexSetup-V.7.3.bat › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
^
$erhuhuhuhuhuhuhuhuhuhuhu
f16e36b1872294feeead4605078af08c › WebexSetup-V.7.3.bat › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.