Malicious
Malicious
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 fc23847761db95c69920933f37556dd5
Sha1 ff02a672690a096b6363c4cbd0d3c8304341ca2b
Sha256 575d71b9f52c4f93fc8072ab33eeaa85fbffb5743d66a5a89dba75363b4068f3
Sha384 aae1715cbc50a1c3f1aab0fb5843ff00be31cb229210f2e5000afa19231b9911fa8a1b5f1ca19b89a6410b4c289a67b0
Sha512 0c423be67b1bba473bab86e07b662d77cd5d4509a2754e38700e5e04f91f2b302aa051dde7c409e6914a6d48640e7e3c1b9003b90cc0f3db9cde8429257cdada
SSDeep 96:10A+yrtsqfDY9HvUOHRsPeRe1OG2grb/l/V0/HsJ+0h2Pytbl6:iKbXQRsGY1O4/l/W/MJ7hCsk
TLSH 9DD1734B6A36D2F0C0B0A6551152AC0CFA822573DB33B89EBE8C45185F35F6EB3E15C5
fc23847761db95c69920933f37556dd5
Malicious
fc23847761db95c69920933f37556dd5.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
4 / 4
Path scr:ps1~T1027~T1047~T1059~T1059.001~T1059.005~T1105>scr:vbs~T1027~T1059.001~T1059.005~T1105>scr:ps1~T1027~T1059.001~T1059.005~T1105>scr:vbs~T1059.005
Shape scr:ps1>scr:vbs>scr:ps1>scr:vbs
malicious 4 nodes
Path scr:ps1~T1027~T1047~T1059~T1059.001~T1059.005~T1105>scr:bat~T1027~T1059.001~T1105>scr:ps1~T1027~T1059.001~T1105
Shape scr:ps1>scr:bat>scr:ps1
malicious 3 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination dhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination dhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Dropped path (COM trace) #1 PATHmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
Dropped path (COM trace) #2 PATHmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
& [Serhuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"" [Shuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"" [Shuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"& {[Nhuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
"" [Shuhuhuhuhuhuhuhuhuhuhu
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
& [serhuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
[Servihuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
fc23847761db95c69920933f37556dd5
Malicious
fc23847761db95c69920933f37556dd5.deobfuscated.vbs
Malicious
[Command #0]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[PowerShell Command]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS].deobfuscated.vbs
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
[Deobfuscated PS]
Malicious
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination dhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination dhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Config. Field Value
Payload URI & huhuhuhu
Payload Destination & huhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Dropped path (COM trace) #1 PATHmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5
Dropped path (COM trace) #2 PATHmalicious
C:\Winhuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5
Trace COM ordonnée UNKNWOWNmalicious
line 2huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS]
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS] › [Deobfuscated PS]
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS] › [Deobfuscated PS]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS] › [Deobfuscated PS]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS] › [Deobfuscated PS].deobfuscated.vbs
Deobfuscated PowerShell UNKNWOWNmalicious
powershuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Command #0]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS] › [Deobfuscated PS].deobfuscated.vbs › [Deobfuscated PS]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS] › [Deobfuscated PS] › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS] › [Deobfuscated PS] › [Deobfuscated PS]
URLs in VB Code - #1 URIsuspect
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › [Deobfuscated PS] › [Deobfuscated PS] › [Deobfuscated PS]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
& [Serhuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"" [Shuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [PowerShell Command]
Trace COM ordonnée UNKNWOWNmalicious
line 6huhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"" [Shuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 1huhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
bypasshuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Command #0] › [Deobfuscated PS] › [PowerShell Command]
Deobfuscated PowerShell UNKNWOWNmalicious
"& {[Nhuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Command #0] › [PowerShell Command]
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
"" [Shuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS]
Trace COM ordonnée UNKNWOWNmalicious
line 3huhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [PowerShell Command] › [Deobfuscated PS] › [Deobfuscated PS] › [Deobfuscated PS]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Deobfuscated PS] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
& [serhuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Deobfuscated PS] › [PowerShell Command] › [Deobfuscated PS]
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Deobfuscated PS] › [Deobfuscated PS] › [Deobfuscated PS]
Deobfuscated PowerShell UNKNWOWNmalicious
[Servihuhuhuhuhuhuhuhuhuhuhu
fc23847761db95c69920933f37556dd5 › fc23847761db95c69920933f37556dd5.deobfuscated.vbs › [Deobfuscated PS] › [Deobfuscated PS] › [PowerShell Command]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙