Malicious
f9941d5690bf9147da1ffd38e27d9b4c
PowerShell
MD5: f9941d5690bf9147da1ffd38e27d9b4c
Size: 13.56 MB
application/x-powershell
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
VBScript file
Size
13.56 MB · 13,564,633 B
First seen
2026-09-06 13:30 · one month ago
Last seen
2026-09-06 13:30 · one month ago
Last analysis
2026-09-06 13:30 · one month ago
Hashes
MD5
f9941d5690bf9147da1ffd38e27d9b4c
Sha1
81375e29113bbf187c7668151901be093e1fa867
Sha256
572fa3dd2128f37601cf91eb9a8a275d93ec207cbec6fe4a998146989797b8ab
Sha384
da44ebb8a967cba7a336a00f3f0bd169ed8b280845ce6077fb10fae63e5dc5dc97154a4dc1d1146412f5a671487cb145
Sha512
17d45f11106a955a0c532cb37d0d6821bc8e94a375eb07ad4e30a6e6da64008bccb6f4e91c98b3aaeb6ee9c45a07a4714676f10347553621bf2baa3b5f547091
SSDeep
384:tH5XGiS55Dd3zjT+/Eth5ocSk6249G4QDDUfPOLh:15XGiS55Dd3zjT+/OAcSk54gDDUHOLh
TLSH
EBD6199E5A0A3544C0838F035993F2BB6F2767FA77967959258D1120F2E1BBCB237813
Detection
Symbol obfuscation
Low
9 malicious · 9 files
PS1f9941d5690bf9147da1ffd38e27d9b4cT1027 · T1047 · T1059
VBSf9941d5690bf9147da1ffd38e27d9b4c.deobfuscated.vbsT1027 · T1105 · T1059.001
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
scr:ps1~T1027~T1047~T1059~T1059.001~T1059.005~T1105>scr:bat>scr:ps1~T1027~T1059.001
Shape
scr:ps1>scr:bat>scr:ps1
malicious
3 nodes
Path
scr:ps1~T1027~T1047~T1059~T1059.001~T1059.005~T1105>scr:vbs~T1059.005>scr:ps1~T1027~T1059.001~T1105
Shape
scr:ps1>scr:vbs>scr:ps1
malicious
3 nodes
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCommand (COM trace) #1
UNKNWOWNmalicious
msiexehuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #1
PATHmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée
UNKNWOWNmalicious
line 7huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell
UNKNWOWNmalicious
"[Net.huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential9 malicious · 9 files
PS1f9941d5690bf9147da1ffd38e27d9b4cT1027 · T1047 · T1059
VBSf9941d5690bf9147da1ffd38e27d9b4c.deobfuscated.vbsT1027 · T1105 · T1059.001
SH[Command #0] T1027 · T1059.001
PS1[PowerShell Command]T1027 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
PS1[PowerShell Command]T1027 · T1105 · T1059.001
PS1[Deobfuscated PS]
| Config. Field | Value |
|---|---|
| URL (COM trace) #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| URL in PowerShell #1 | https:huhuhuhuhuhuhuhuhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with EssentialCommand (COM trace) #1
UNKNWOWNmalicious
msiexehuhuhuhuhuhuhuhuhuhuhu
f9941d5690bf9147da1ffd38e27d9b4c
Dropped path (COM trace) #1
PATHmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
f9941d5690bf9147da1ffd38e27d9b4c
Trace COM ordonnée
UNKNWOWNmalicious
line 7huhuhuhuhuhuhuhuhuhuhu
f9941d5690bf9147da1ffd38e27d9b4c
URLs in VB Code - #1
URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
f9941d5690bf9147da1ffd38e27d9b4c
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
f9941d5690bf9147da1ffd38e27d9b4c › [PowerShell Command]
URL in PowerShell #1
URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
f9941d5690bf9147da1ffd38e27d9b4c › f9941d5690bf9147da1ffd38e27d9b4c.deobfuscated.vbs › [PowerShell Command]
Deobfuscated PowerShell
UNKNWOWNmalicious
"[Net.huhuhuhuhuhuhuhuhuhuhu
f9941d5690bf9147da1ffd38e27d9b4c › f9941d5690bf9147da1ffd38e27d9b4c.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with EssentialSign in or create a free account to view the matching YARA rules.
Create a free account