HKTL_AMSIBypass_Tool_OpCode_Indicators_May21_1

Rule Info

Tags
['HKTL', 'EXE']
Name
HKTL_AMSIBypass_Tool_OpCode_Indicators_May21_1
Minimum Yara
1.7
Rule Hash
99599b4970b3f3b6c78ccf9e78adcc30
Av Ratio
8.98
Score
70
Author
Florian Roth
Date
2021-05-18
Description
Detects AMSI Bypass tools
Required Modules
[]
Reference
https://pentestlaboratories.com/2021/05/17/amsi-bypass-methods/
Virustotal Matches
https://www.virustotal.com/gui/search/hktl_amsibypass_tool_opcode_indicators_may21_1/comments

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
8
Suspicious (< 10 engines)
23
Clean (0 engines)
12

Rule Matches

Hash
Timestamp
Total
Positives
VT
4fd51972afad0f2b202359f4ff7626055f77d1f05eacb01b994035fffe88af5d
2021-06-15 10:19:41
69
23
a3b18342d96657a64e32b08464fb028c6af479121489406bda0d249db12cece3
2021-06-15 08:31:46
69
32
7b76f4383665fa8e7f1f9ba3a1863dedff5cddcedcdae164ff72bd4bae836847
2021-06-15 02:26:02
66
0
ab43fd1ff31031aa73b7467bec01b8bd60282d3f7e3067707b9cc916d8d89f56
2021-06-12 17:06:26
67
1
fbf06bb64c598b3e259876dc356b2128c990f888e60a2be3c240a5bd3a5f1855
2021-06-11 12:08:51
67
0
3a2f1e8fe4ead9951eb636e243b3e7f3c17e80d249b13fbe4cf62ba64e816e41
2021-06-10 17:34:11
67
1
e30b680b99739e0ca9ba751ca5d7b19b8654579d8a71325526927cf2b9746019
2021-06-08 20:16:05
68
1
daa37b4e192691e16a34d58b7bdf57e7ce84ef22c5d70c2965508075ba283cc2
2021-06-07 23:26:35
67
1
40401c53690a1328861fb4596c0ab21d5e57fb570000ed03cd450156bab9a058
2021-06-07 14:50:09
67
0
f5e8b826c5a4c9f80985b9fd7d9a6db0bef0556a0f3c0b338745bf58084a8b02
2021-06-06 21:29:06
67
7
568a08d9aa977e415bc6307d676e3b734e5ff09fc4470172810fe355acab7d09
2021-06-05 18:24:25
67
1
1988a2f3e7c8fbd1b28b8be025ff051022d55045f45d38fd29e856bf9ec8e847
2021-06-05 09:28:56
67
1
064bd618cada8266e25c9a101ce52fafe45fe247f360f11df6016711ee05d673
2021-06-04 23:54:00
67
0
4aa821c902b8893fc932c264b85ed3759ee5e5907c9db6a42a6ce696c56614a5
2021-06-04 22:06:03
67
1
5a62d041e694341f45ff25729ef4cdf1488ce295a3cd7a95050c4a318415143c
2021-06-04 09:22:00
66
0
ec5aa0375e2fa9fc6c5ae13440cb794712cb3143f041c9c54b634105ca4ea32f
2021-06-04 08:21:01
68
0
72295b508185d87672120135311a4d327493c1e4438308a770449ec73175d926
2021-06-04 05:58:02
66
1
4892646938f4fe8d31841df350e37efd96bf86d6c5b4656bf2217a66056b9fb2
2021-06-04 04:09:38
68
1
1fcccab67724e975278b2d7f3cc511c8029a9d5cac78582998afdef46bb80c28
2021-06-03 23:06:12
67
1
ec1238136c44e7f74d75690ed55cc1c95c030b53cd64df95920d2435b19a0c24
2021-06-03 15:14:15
69
18
4fd466fce1ab270e53dd3989429db336a82fb533f604e91ec914e722896a5b2c
2021-06-03 15:13:01
68
7
e31b1c3b990085a07550a3c46ccdbab6fd473a14c10be913440de82aae1a53e9
2021-06-01 17:13:17
68
1
afcd1487169509129157c78f101fa58586707677452ba6ce6e18f69b2c599400
2021-05-30 08:30:01
67
11
d52d06a18b9ac57cf0ca1c1604242107c9c3a43dd642cd16c19e024c68304e23
2021-05-30 01:52:17
67
1
8267357adbc6b896fb6c22c7dc061a7ad56cca8a0b49e529652db60f12abc875
2021-05-29 18:23:47
68
0
3da937204410afb67e180fd4005311b09f1deb9702491418730bc2f477d4b4b6
2021-05-29 11:59:49
68
2
90ee09ad90f7706c32975683eeef24362e96a6f6b147af189da161a5a4fa313b
2021-05-27 23:55:38
68
0
b2fb2f9cc53e17d8502bfb4e6ea1dd2d6047ee6d3536d6a430876293be33fd12
2021-05-27 19:51:09
68
1
31f45a26c66b6fcca322c34dda1b0ea2de9ac4a5700ba1a166f42c7e2ca2e8bb
2021-05-27 16:46:37
64
0
ae388c119fc2d2f83bff28b82d7262a6f6b3ee5ec15e80dda7c80526cfdbb9aa
2021-05-26 17:42:41
70
44
35b27618299345ae63625435565cee503d22b0faa48572e5ba717167cc36289f
2021-05-25 20:30:02
70
23
3e671f5b1ddf220e56c26f795b07505582f328c0f395a3650cf565770d4d7484
2021-05-25 15:53:31
69
20
661516f519650e0a0150b50eb320edba9a13019bcc25ffaf5b4fe08d7f1612f2
2021-05-24 13:16:51
68
6
aa7cec25495cc2b1db5c47f5dfc526c924c246985788bb255c4c99848251eb93
2021-05-24 11:56:48
68
1
df1031eac1592768ab9104399bd5d01969db8971def7611aad73f7aa372ae607
2021-05-24 11:56:48
68
1
bdc1997ac9334508c487ab8c19a2551438d791b1d5d32c1c28bbb1c66f723511
2021-05-24 08:52:36
66
0
7df414653190094c6344d5c57e83534d177539c3449e8c4c13ea840a24f559cc
2021-05-23 18:07:28
69
1
b4bd653abd0155eebe7d12a2633c4ce68492b28444feb3d1533178d5cc8ef4a2
2021-05-22 18:46:24
68
1
c8c8a9668301b06c1015a5375bf0975d194b355062a8c64976678aa8c3e1979c
2021-05-21 19:51:28
66
40
e3d20362a4aa90c8df6b9d6649d8245fcd4b43caa7cd7c68e43731297c4024e8
2021-05-21 06:31:07
69
0
2f54b1312f58aa091c7494b00325b3ab4fccddd0c4da1ca9ebd17b44f260aeca
2021-05-21 05:43:29
68
9
3d77c39d8158bca2cfab4bc4bb39f744619958fcf206621c963ba264787ce5a8
2021-05-20 11:55:19
64
5
a2ef897f52b183d6f823deefb665d3832059847c662b8b508db0550f63e83b60
2021-05-20 09:04:26
66
0

Rule Matches per Month (last 24 months)

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2020