HKTL_BAT_Loader_Jul22_1

Rule Info

Name
HKTL_BAT_Loader_Jul22_1
Description
Detects batch file loaders as seen in use with Empire Sharpire stagers
Date
2022-07-21
Score
75
Tags
['SCRIPT', 'FILE', 'HKTL']
Minimum Yara
1.7
Author
Florian Roth
Av Ratio
5.65
Rule Hash
6486cc53144ccbdcae27c3b0498e7b1d
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
23
Suspicious (< 10 engines)
54
Clean (0 engines)
82

Rule Matches

Hash
Total
Timestamp
Positives
VT
8c2eeb4187bcff5f5d39774e5b35a00315a44d36aa927ad94726e54ae184f789
59
2022-08-19 17:46:18
1
3eecf6541c13ae3ea525aed72435a3553d80b42e9d28c94e7f05ac04df5aa83d
69
2022-08-18 03:29:34
24
56414693fbba95195e6653157e06aa58f030a3dbfeeb357c48ad4647272f8c2b
59
2022-08-17 15:32:16
1
fb077ae1cfb00b4cb6d23a731d8928d0b544ef188d6e4235c811bfd8994a5e80
67
2022-08-16 21:31:11
8
e1240be74ba1ad61cd7eaee4e32e5060cfb814d7dd3425a5a324646b583b6d6c
59
2022-08-16 11:50:16
1
e3b03d1904a39fcb7aae57d5ea95a89dbee7fb199433ee30dcc20d471ab5d99d
59
2022-08-16 07:24:59
1
7fd3bd41d734430a8a6612ce74491f606ea760112f265d4c5dad84659b4b8070
59
2022-08-15 22:17:32
1
b1cc3082a2d2aa3009a6344295317c74508e97c9454129097e35c0510537e53d
59
2022-08-15 00:48:24
4
ff1298daaa52f659e2d98e555cd1d35ec47ca66e6d902cbeb1d0ae0078275ef5
59
2022-08-13 12:21:39
1
9aa36de65ce18d2d0913504f50b001301d5dbb8c63cbd36b8f7a998b785acd6c
68
2022-08-12 21:32:03
28
d42acf17c5abf5295eb0c307d38f00adb0ee06a80981b22012bd2a6b8a64d1ce
70
2022-08-12 18:22:29
33
d36324ed57a6729b1f030def633200da7a773cf0a42534ae5607da83ab116ed1
70
2022-08-10 03:34:23
36
36fad77e9ba6104eb3cc2e65c39ed57c54b06e6f499684e9eb0818620abb9e00
59
2022-08-09 13:26:47
1
f792e6b2e2dfa3776181b68fd148bb8bb72b142535bff0066b941f2405d2488d
58
2022-08-07 19:11:18
1
a6f8ad34076eac4e2c23ba1bbafb6b7948bac6b17177991feb5fc3d839b60d97
59
2022-08-07 01:40:31
1
5ea7ee88c066d61a7c95fd3230928da5923e6a0a7d3da0953a829fa5767bca08
59
2022-08-07 01:04:37
1
c7d91049c050c491dbaedc3793230ce93688a34c97d03529cb024c7d3fd31e2c
59
2022-08-07 00:56:06
1
f13a1bda4b4eb12078f32ed886ef157081ce64cf980e150107b59c0fc51a3a46
59
2022-08-07 00:37:13
1
62c5f22b4436582fffba7362730c335246967ff6ef0b390ae7369baa7afad81c
59
2022-08-06 23:44:39
1
18c5be32693cbe0f36b6cc2cafde84ec74143714b528ab4490abc358077fb1dc
58
2022-08-06 20:40:08
2
1f021cc5a8761425f8d91d7760657175c3af79b71ac33302adbd4ed7c4d003c2
59
2022-08-06 20:21:01
2
c1118107e50bd7bedc6ad9c2a6793cbfa00f3cea56b616d4e3ebfdef74288c5b
58
2022-08-06 11:04:39
1
40883264357baefc92ee4fecbb547e6c559b1eeea232f2411b7e1b52350ab07d
59
2022-08-05 23:46:26
1
95012804dd7b21f83a19e6cd6f75797f10b9bc8dc690b0434c09dced33585d21
59
2022-08-05 19:47:48
1
0ea7ab2a3835daba6b36adfcd057669f3274724715e6d0c4238dc24a104cb02e
59
2022-08-05 19:23:50
1
aae6c8006476ed82f4fbf28b8ac749b308888f54a378b96c30a08834994cc0b9
59
2022-08-05 13:37:49
0
4ca88bde6021e6512d9c8006acee5326cf4b854a4ef368a366aca4c3a0836a1c
59
2022-08-05 13:31:27
1
e8703a10fc139a7003aa0fd064be697ac792177a222273e0a9f8a54ded24707c
59
2022-08-05 13:11:17
1
369c6032966c5a567e3897e155d8fb00079923b6599b302b44e8e914773d5fc7
59
2022-08-05 13:11:16
0
ed5e9bd924b4c0cd8b7c67cde1dd5efb824b52e715b595aac412ed2010c95dd4
59
2022-08-05 13:03:49
0
390880de7349eeb59ea10a0c94a66eae736b051d8710a79cef73c3da816b8450
59
2022-08-05 11:50:07
1
417149f112cfbe98836c1850e3f6a7c954b674705090f0b1a360798dabcac9ce
59
2022-08-04 21:16:47
1
b9ac2fce7df8f064d7576592ab38e2e8c76a1594cd298d241130cdf3e4704aab
59
2022-08-04 21:11:26
1
735d794be34ea09d80564e6a6c6133c2c8b7854192a5e8140ca6fe25dadcc5c8
69
2022-08-04 01:40:51
7
1cae51d7f99d2e8d733f59c9e530eddd805bc550483d4b456b574dcafa11ed35
59
2022-08-04 01:00:35
0
e265e1d359a994f4e2b92d28bc65facff14e9fec10162aef8b73d4c0890b5360
59
2022-08-04 00:58:29
1
e2210f2d8bb363178e6ac8d943587fb7968c21bed0ba6fe6c1b8760b44b2957e
59
2022-08-04 00:58:28
0
ba10aff564af1e2241cb8abff9dd077d64cc2fdd2fc9ec962fcc7d077839aa8f
70
2022-08-03 23:59:04
16
a59ab27d06ee21bb5c336551842a7eacc39e0ff3b4a9eea72722df2253fdfa90
70
2022-08-03 20:04:33
23
44e6da6fe34e8a496a1122912e9ab125d4a818ffd2bff60f1409ea5319e3df4c
70
2022-08-03 19:28:54
20
3d6df4a813f1d1b2ad30d306e3dff860b25f9ec0e125ed146adf88f1a60b9d14
59
2022-08-03 09:23:09
1
fd12da1341b30a43c6973fd9f28c16b9eab5d8dea9a356cad8a620d4469a1932
58
2022-08-03 05:17:22
1
841090ab64dad73c12320f8963844beaaaa50ab0c9c6b73622d543221c41b3e8
59
2022-08-03 05:16:17
0
2cf8e9776872977f6582059d59c274cc14842cc6bfa5ea297989ffcc82d279a0
59
2022-08-03 05:15:15
0
04774fe3e0c3446f03199eb330ea0913915ca795c8b5192e5effb9d01a151878
59
2022-08-02 21:56:18
0
78e99105a7d55d2aeb5fc4b04ac34a06a80d8b3fb33de49648bd82e95bb637c3
59
2022-08-02 16:26:17
0
f443bf6cc54a6516e35bbdc7def73217e7c1b0445457bfa18389460949ef53c9
59
2022-08-02 16:13:36
0
218703302dad0caed16dde42daa2ae9d67633378b33c4cceb2a06d48d3ee33a8
59
2022-08-02 15:24:37
0
dde77d1a4de06ae858a1146402162c39a7784f2d6e64d38eaf8e933333bc4fef
59
2022-08-02 02:23:46
1
395e2e6bf2489edeaf15487bed69db99aa83c491dc5f72c033a157a71ff5cb3c
59
2022-08-01 23:35:44
2
1893fb94092ce765a71cf626a0900a7337621348177f48c1f7ef6444acff726d
59
2022-08-01 23:15:25
1
18e19bf387341235a48d58adffab856e42c1f7bed61e6a6bd0d2d8a5be4b167b
59
2022-08-01 20:38:26
0
09b8410e844aee5c6e07e08f2f36160251641120e609e8664965c0a4da520000
59
2022-08-01 20:38:25
0
37612097886820bbd1f47e37391c988b8f5e3c68d38217af6a2b1799223ac12f
59
2022-08-01 20:11:58
0
4eff24bf793b7891a862e2dd70697d3eb8b522497f37d6c2bdc8de0d7bc96f3d
59
2022-08-01 20:10:54
1
37a91958253a35ab699af165cc930bc516f604cec46e1ce0aab154b05c331942
59
2022-08-01 17:44:53
0
16df1018975bccdfba2daf9d5acc5328fd5118d9f4f6597d330342e6780ea4e4
59
2022-08-01 17:44:53
0
7bcafa40156808deae8744a28de5932267861eb27cdf65cb1b7bdd6941a3c06b
59
2022-08-01 16:39:30
0
972736bacc1c4c01c88b522aedaf0279d32c78e1a154eafe2455eb5ab6be323a
59
2022-08-01 12:52:41
1
1762b42ead4f7ae03dbe127bd1ed10069931907efbef58b3d7080426e2827887
69
2022-08-01 06:12:51
4
0d0ad88e2a6e4c2f70c764fab13b30309363065e2b43dde83c8490450a838b75
67
2022-08-01 05:50:20
3
1cab9ed63e63c779aeec77388e2973ffc28115389cf9996e6b637281a7bad7fb
69
2022-08-01 05:26:27
3
adbda05238e2b89925c01e82b3c16057b386b830f63277c8fe1eb758695b5599
70
2022-08-01 04:49:39
16
fcffed1e638aead85b5101185cf820dbf1c08c5cae084413100eb1ab7ac912e7
59
2022-08-01 04:05:33
0
a9d02eb1a627e1e739865c618a214c09fefcee84fc9715d8a87c8d6c6d90b4e5
59
2022-08-01 02:58:09
1
0ceeb4f11534e551bd1cf82b4bd5eeb15cff08995c1f16454eaf3140e306da0b
59
2022-08-01 01:31:06
1
b416c8677be35df6708dd137959944131afa78967038b998e1c924aa00349ef7
59
2022-08-01 01:25:51
0
cb4ab3d3a326ca535469bf59743351abe97944bcc71abe1d50dffdb76ca25204
59
2022-08-01 01:23:45
1
7cec5fc639db1cbd1f4da7bd8f141b85414162f0769325be52147dcf8c045dc8
59
2022-07-31 21:47:47
0
adbd2373898d4b45c7dd2ca9a3369f36f223facf6592dec1aec5a20ff6317688
58
2022-07-31 21:18:10
1
bc3469d3d671cfe5d646a6e61932660dc3590309f56e25b4688b2e6d35c939f4
59
2022-07-31 21:16:02
1
9f39e5b001e41d4cb0c4b7b0e9d8a3f1323e1a1f0a2d5b49434df63b49298d5e
59
2022-07-31 19:32:00
0
6a5449f830bc2e5ce1ead91e834c9767d923637379ca011fd29fe6126f07d2a7
59
2022-07-31 18:42:35
0
f4c9b967f3dd4e9a98e29ec70c5c5edc71f72ccde1a232670e1a78b47b720cc0
59
2022-07-31 18:29:14
0
773511c74dbc9d52f482c38f050278a6a084d5b672b39b6aa7b7cd360c3cd3ed
59
2022-07-31 14:25:54
0
ad962f050762ad0edb5b1caec2126d39b34d95636bf71e5e8256ec90132be857
59
2022-07-31 13:20:23
0
6b3fedb66cfd34bc0abc2115297503953f108a6e600dc2cde588d9ff8c36e7a2
69
2022-07-31 11:43:06
11
0238fb33e5e0b35895bb87fce4496cd3d22a973267ee15ecda7d301c8c07e19d
70
2022-07-31 07:33:05
18
f541f5708bf024d86c6a16a8bb2dc21e953c4ebd7d296f2013f06ec2ab2e244a
59
2022-07-30 22:10:07
0
952197a9f9a54c0feecad016ec3e91ee6171c2cf2d59117a1236eaf34e6297ad
59
2022-07-30 22:07:39
0
332b933014a5e835b75cf6a540c3785dbd8e8b0cd6f091ecafa547db45dfd771
59
2022-07-30 18:42:30
0
0d7566f701168768cf426e91c09d3c2d59fa1790311008c8704af638c49dc078
59
2022-07-30 18:02:04
0
6eeeeb4ab5c81d87f73657b94605863b3d7fb07a26297f197b1c355c13c5f2c0
59
2022-07-30 06:22:53
0
75e2ac27c207e787d9785ebf0d2643422518d62138a6855318905c1407609537
59
2022-07-30 03:18:06
0
a34c20c4e53dc71eed72f3df697add7bac148ba241f29471805262d063f9e540
59
2022-07-29 23:48:34
1
cf6805f80895d2e84280f2c261496e91939ddfe8a53d6a5483f314ef41c5f9ca
59
2022-07-29 23:04:25
1
ae9d297f4bb1499e58043f98c6e02bd15bb487dcbac70a337d2879b35edbf2d2
59
2022-07-29 23:03:16
1
61853aa8d8a08e48f17ed10ea7b72e4611dfdacf24a5411261284c2595163904
59
2022-07-29 22:25:24
0
87069b48e363b2b43c93b0cdee977e762b74d2a57831f38e5a4faec51f9b3cfd
59
2022-07-29 17:26:43
0
043728444efdde230fdfc6e44139fbf68b19df61cd1850711e5a6f4074e39ba6
58
2022-07-29 14:19:02
1
5853a4f55a112566a67f36ae8f44da4bce7892296c4c705f29faf43980b5b92e
69
2022-07-28 21:04:51
11
5fdbd4359cb06bd3696f94d17c75c5a5bc576bfc06825586f4b3c0773d70fd6e
59
2022-07-28 18:29:02
0
48076032c35224a4e2e6443f61bc2045dee22937f80bf586d787f32a0e118114
59
2022-07-28 18:18:29
0
baac1281715aef2828a29092d338504cd4f4081c39b874f9723d8c815785f96b
59
2022-07-28 02:25:39
0
4dbf1d1ccf2e9e44cc96741aa30048b7a06344f45f71d5ceac9e22284ac312e8
59
2022-07-28 02:20:17
0
d89108fee711224dec218a9f8562ea937e1f4b6e1650f50fb02c706c7a651313
58
2022-07-27 15:56:00
0
c742da53d083ab63617390412cea2ee37c40a7cbda9e713723315d4a4c344c0d
59
2022-07-27 15:54:51
0
aba36b6b40b27925daa78336672a2c67fbaea7d125b2f36fced72dbd35d16d67
59
2022-07-27 07:07:48
1
c87394566679b8083de08ea6f96c962a8d1b3c19e27cf9741f944ab2a6c5d4c3
59
2022-07-27 06:50:36
1
7f6f4441a12d00cec6eee8aed13a73136e629319af84daf6f5d5bf26c67a4b25
59
2022-07-27 06:46:16
0
acff0c4abad2996235d8f246e0512397a4f2f2ad3962ffdb749764cac80310bb
59
2022-07-27 06:12:19
0
ce11eee39126f0932b295ddd357068fb055d8861e5ed4abf8d9d916d2387d941
59
2022-07-27 05:49:24
0
43f003e200192f2d25d31d1398b3592ae9e5d845803a0ac88175fabf71f5555a
70
2022-07-27 03:20:42
13
3e80b142fe42b2f88f9e93ac4809754611391b2d7d358071b32dcece974a9cb2
59
2022-07-26 19:37:34
0
4e32ec9ab5beba415e7a842b62fe6be860ee96e9e79538d92be108e26707ef71
59
2022-07-26 16:47:16
0
9913541f69b84c5d0b7ef08decb5dd690dff2ece7730e7cc620fae3c6e25c5d6
59
2022-07-26 16:10:13
0
bc9818240e468c5bde8f150dffef2a0c491a4c9ff764d3a9e3edb3f94fa0dc83
59
2022-07-26 11:28:32
0
d2910fe2c1e80ec9c4920c18f3ec46c864550d0db88cc42cd4ada7285edeb2f5
59
2022-07-26 11:25:22
0
68b86dda35e1e808fdbd3cc6c46c072a79427a2ea2933788bdcc070042738bf9
59
2022-07-26 10:48:06
0
d7ceb1e88be9d31b87d59700d540fda14b5ccb9772851b437c97e8f5609d64d7
59
2022-07-26 09:24:16
0
1ab6d8cbefacc6c7831cee666455e26a24c85f3a8ae2cd7ae56138bbffc3f360
70
2022-07-26 09:05:50
17
4af41f2eb43c9bb81bb6d42120d4329f73ba46b74f45cec1442864932e8c5606
59
2022-07-26 07:16:51
0
6049a11a6eb111dc932fe8362f394a82d08063de24114da5fa26bdea8425f080
59
2022-07-26 06:24:41
0
aaac9cc952627f874965e75fc301aa2ee226e4894895b0ce7cd941d540e0a1ef
59
2022-07-26 06:15:02
0
0fac4790ea4df10ec93093c9faca7673c5388566a6ab695107ec86d2cf7ff543
59
2022-07-26 06:10:43
0
3622a90ee7af79f6631bc6e2ab3228fbcc1c79fa38b9a64b4a14dd3bccf215c9
70
2022-07-26 05:57:39
10
18fe00d46d94f3491414e0118aa8862a2ceb60507df2401b1986f2bd01d32e3a
59
2022-07-26 05:29:50
0
a4e28a90086effbba97468b8b27162be434ce29e6a28f5ed8fbac02764395407
59
2022-07-26 05:24:35
0
1e96d421574d958dacc771824a2a21d02e0dd9212f190afa711c534551311007
69
2022-07-25 22:37:25
23
943e9a22395a6cd9e551aad49c425f76783928172d801ca37f95e02ed53c8053
59
2022-07-25 21:26:20
0
1b22366bcbabeaebc42a4c60f38187e5ae6db4d77fafcd12e9733a92c0bdd179
57
2022-07-25 17:37:58
1
31227f5f6062f3ad09429aaab07b50352d7bf19b8c82b82a1738b5ed266d8081
70
2022-07-25 12:26:26
27
9b73ed9263e426ea99140209abe9612ba3b82551ba9ab96427f4f927183b6476
59
2022-07-24 22:03:37
0
cbc988436005a79d12c786a4483c78f91a72eb22b59c03c289f63053eb21d598
59
2022-07-24 20:52:28
0
4199f0691bbb84e0e172b679c7c72ffa2cf2969054ba4095870f4851f4bde0e1
69
2022-07-24 19:32:16
22
0871a0cd2c7ac704517c7f4a703c3f3d73c4e9024cf09d98b381de8293cf5a9d
59
2022-07-24 18:13:05
0
54d02ae447ae48f2dfa795ace958663dc3146cf928cc89ea2e2e83b18e2fb79a
59
2022-07-24 16:33:46
0
d394e842733ca93a1d1eae88704d83b6f01f4f6ab9333140bdc25cf7ab56c2cb
58
2022-07-24 16:29:11
0
246d93f3f8181b75006ea5f921509aaaa6f0f6f377a5af4f86ecc15312da4e24
59
2022-07-23 23:13:04
0
dcb20f195eb244e033a7e8969a16072e6c2ef115e44490878e1f0e212b011431
59
2022-07-23 22:30:54
0
37dafac6f23002990c10f4294638252f3e62050a900d931de98ab787fa8edab8
59
2022-07-23 18:43:40
0
26cbc967cfededd4b8b5d077c8692494337dcd55923055a9200a8d04730cabdf
59
2022-07-23 14:31:52
0
1e589a61499d21fe23641613441c553dcea883c74fefb920d38c649b9c85ba03
59
2022-07-23 14:13:44
0
169b1e9782d821b64fc25f1f87fed02738b908693dbd9f5a4ffee0b3a477583f
59
2022-07-23 10:47:14
0
27d7ed0d6354af158bdbfa639f81dc9909fa585b971bb7688a6407907a5ee680
59
2022-07-23 10:28:05
0
bf589b88ec395cc9df73762f3a9901ac4902f3f909562074eaed6ad7cc2843ea
70
2022-07-23 09:00:24
27
c883f453141e17f1dd37961b1e8473fa34b1e5ad92720e3a90820335e5e47ad4
59
2022-07-23 08:56:52
0
be5dcbbf0433171c4543b6fd1b0a9edda323f10c41279ae1fe7fd12b7f9444b1
71
2022-07-23 08:52:23
43
476ef3d0894bef546ebf7ab4ee67a9406d96cc0175dc89b573b6cfa43a1b3c63
70
2022-07-23 07:23:17
23
5883a56aa62e997c5085b87bd041bf0e55cedbdffc8867d041bb1dd467365f0b
70
2022-07-23 02:47:26
34
13b150d477feea6bb668a94127cec9e710ba665688620d1eb568a4622bb10116
59
2022-07-22 23:37:56
0
6f17490dc2149d0816110970ff7c7c042e0c17cd3e0e814946f6dc19a382b8bc
59
2022-07-22 23:23:46
0
5d3075b1da94133ce2019f7c2d86b5550bd3c912f5fdd8c82f6b1c63019a0d6c
58
2022-07-22 17:16:49
2
6ddcec34b62521ff3f8c281e0c0ca437792b096c2aeba93c214fd87ca1ffcb6e
58
2022-07-22 15:18:10
0
b0150a66aa7f3d790139431390d4396b23ab9713debca38d75920a187544321c
58
2022-07-22 13:42:50
0
ca267afafd70926c20bca1fa16a9a9936e86cd2da2c2c58ade8ad6ff6ab60285
70
2022-07-22 12:45:54
30
1b290f87725e52e7b3346e81446b87881317c22c29be479e94d34e73161240f2
58
2022-07-22 10:49:44
0
5912143ab6b98e4c708f5a897e7d0eef3110ccb6ab043d1f144baeca6a3161dd
58
2022-07-22 06:58:49
0
b5b1086523ff06e220e55c6efb65f3ae55a166a26e4ccd7d4a8ca84766e6a72d
58
2022-07-22 06:36:25
0
5ff376a6412dec934eadc9e1d0df6cdee738d58159e2615e6f53e7d9d15fa7f6
58
2022-07-22 04:41:41
0
b3973a8e5cf6288c686dfa17c57f20672abd1d23a4a7c47372949e73772538a3
58
2022-07-22 04:40:36
1
8cdaa11ffce675ad80e9a5f88ad68b0c8394735bd6a1dd0ff018839607fba204
58
2022-07-22 04:36:18
0
55ebbf813b452a9215cb1842fdac9d510a622068b2613a36180e423368b0cb64
58
2022-07-22 04:34:13
1
5dd516fe362f23679da1feecab17e3a6289e2d876bd89e4d5dde2c33f31e7985
58
2022-07-22 04:20:29
1
2549bad466503c9140e1d42d54ac1868ac62de66f5ed9e8c8358cf78cc660f58
69
2022-07-22 02:36:53
30
c70273f991e0a9481351c017471617620334b3ae0fd3b44603b995ad5d220d17
58
2022-07-22 02:16:41
0
e7de700755bf6fbfc4390773802421ffc2ef3308db75caf88a2ba2ed9de70ce5
58
2022-07-21 21:35:25
0
abdee9aff8595ff1bfb1de114093d05d106127384308875f790255c6767a50f0
58
2022-07-21 20:55:09
0
97a09efaf1841e6bc8c75555341083bc7ea0cd82bb30401a464ab3a940c7a2f4
55
2022-07-21 20:19:49
0

Rule Matches per Month (last 24 months)