Malicious
f80f9f4992c69c21b547d5ae9be8d10a
ZIP Archive
MD5: f80f9f4992c69c21b547d5ae9be8d10a
Size: 1.58 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | f80f9f4992c69c21b547d5ae9be8d10a |
| Sha1 | 360a33f3a7dd6aa216f493bb936ba1f4b5150075 |
| Sha256 | 6930ec46d217c854d7e5731e5efad4757eeb344e28386742586a33f455d8b401 |
| Sha384 | 8e24382208ca53a3d0a2a1eebc47e0646a069f22622733b7124b9fe1c5ae84fe3fb12e03ec448de954bd0968b358a777 |
| Sha512 | 9a1510fa1245273b509ab5257178405a5f08883a27ff387cc959a1f4a02cd303535d3a0a84ee0668f77ef41bcb76d2dff606f1a318af7392d4a5bbd90a90885f |
| SSDeep | 24576:gKHbSUzO2D68Ij6MdRiM/zxnky3+1Hpk+jY0OvCYPDSH9xkI0yZU+9qK+3:g0OI6niM/dnky3+1HPbYPDU9NUYq1 |
| TLSH | 6B75336D8574AFBBE076751138D8861AAC4837CE4CF13893F7EAADED0F9609049E5483 |
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:ps1~T1027~T1059.001~T1105
Shape
arc:zip>scr:ps1
malicious
2 nodes
Path
arc:zip>pdf
Shape
arc:zip>pdf
2 nodes
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell
UNKNWOWNmalicious
^
"trhuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell
UNKNWOWNmalicious
^
"trhuhuhuhuhuhuhuhuhuhuhu
f80f9f4992c69c21b547d5ae9be8d10a › Client_Matter_Document › Encrypted_P_D_F_Passw0rd.bat › [PowerShell Command]
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
f80f9f4992c69c21b547d5ae9be8d10a › Client_Matter_Document › Encrypted_P_D_F_Passw0rd.bat › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.