HKTL_Beacon_Analysis_Oct20_2

Rule Info

Reference
Internal Research
Tags
['EXE', 'FILE', 'T1136', 'HKTL']
Rule Hash
5923d178a52b5121c03ad511b9a2329f
Av Ratio
32.37
Minimum Yara
1.7
Score
75
Author
Florian Roth
Description
Detects various beacon variants
Name
HKTL_Beacon_Analysis_Oct20_2
Date
2020-10-08
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
73
Suspicious (< 10 engines)
17
Clean (0 engines)
0

Rule Matches

Positives
Total
Hash
Timestamp
VT
27
71
fcd8e45939dcdee9bf10e8393c1f81768f4c30bda9ea9a0639b1d83a719f1bad
2021-01-21 16:12:54
32
69
ee4d38263c1081aded45a767cdc33fe4c2764cadbb9201b31ff0be2c2fc4469f
2021-01-20 05:14:18
41
69
4331f8f9304dd732b3da96a7c9dd7bb15e0ea25eb9b8ab0ace773518b136e168
2021-01-20 03:25:10
26
70
155c08aaf64c04dd5b6691c0cce4878b958b87ad9cd3a63f334ffeedc53e026c
2021-01-18 12:11:38
39
71
46b9271d4b02e07e9fbed97fad0d57121affb49fc8ae3c9be01e5c1dd733568e
2021-01-18 02:03:16
17
61
33b43c002ba533e3565a28f2535e003d586f29a4b142dfe3f208eaa6415924ab
2021-01-17 09:53:59
7
69
afb97366ededf3f41f2f029d54f624c943772ae0e32ffe57476b8da5ada459f4
2021-01-16 22:34:09
6
70
8dbb901e10cf031167a792e71e4a3abc9e2642810a76f595fd25585a173caab8
2021-01-16 22:33:30
23
70
1994156a1601efcc3b2246b1958171f1197405d0582146d3be383c15984f1d84
2021-01-16 22:32:00
7
70
21453beccbf027b9972d2a2374f9e5dcf4da55db04e6ff6cc4a9d637a74694a6
2021-01-16 21:59:12
7
70
e9d4a7009e976e1f4bb87caf45bb66ab4b7161f189d7bd8ca66dbe49cea61533
2021-01-16 21:56:14
23
71
eff0d28e0b84f2b9771c265df6cdb045db5ba999f78776996382a88cc1311c5a
2021-01-16 18:56:04
41
70
60bb08bd19de45640722a1a282b6cf7ff32ba9ad71465cd4766c5459a0b6cbbc
2021-01-16 08:17:08
20
71
a4453affad1c165881fbbe9ac9868543ea358174bfc197b44da2ca4ed7128545
2021-01-15 22:43:29
23
70
62f1f17b9e03579690b89f2e7e71f9c817b9382d74d777638e91ba66042ee991
2021-01-15 16:45:07
41
71
5ce56760a9d8879a90e36f76eb9e2ed46007edb1d66f1e57ce753db8714276db
2021-01-15 16:42:51
24
71
a3288217291eddfb9e077774c56644c9d78e7ee7397e80081d9c65f517b6b6f3
2021-01-13 20:17:39
43
71
4b7447ee027c91021cdc6eed2c21f8a468fe3c9deab5b9bd839fe8d8f48d6a75
2021-01-13 05:19:12
46
71
77a037344ffa72d9f8e474aa984f00d27946f1d22c97099b53d29de97c2af7c8
2021-01-11 10:20:59
43
70
e13f965864ccde799eb85b769514c9bf440e403183531037f4c023bf7bcb04e9
2021-01-11 02:37:25
23
69
90800a0afdee9a136fbe34f2da609e13f934ef0f9cdf487970080d94ed5cc24a
2021-01-10 22:51:15
23
71
272367a2b9590431c8844b749d2fb953f74292c35ae76ec18c3cc0f65c6c5f34
2021-01-10 07:29:29
22
69
ed5f6e545ca06bc276751235a45888fa24eb26ecd2909c3791d054d96846d3f4
2021-01-10 07:08:28
25
70
d687acd97298270146a2b0aabf88c7fd1f2cbb5c40814fed2b1914bb946628fa
2021-01-08 16:46:55
29
66
3dcac05079f1b307f2afd14b83ad4b3a95f8bc24ca44bf0da7fda579e9c50d38
2021-01-07 11:44:40
22
69
4c1b6da939f9c0f95cdf8449a3bf97168dde777e49363560111db1a97759fa5d
2021-01-07 11:32:31
22
71
582f7b19424e21f4ce21e57fa7ae00ff0f061eff7c1c607ef39699db63cf76c0
2021-01-06 17:18:01
41
71
404434c7df020c2283ff14c967ad36f594d1605d90ba9458666e0a258f6669fd
2021-01-04 02:59:23
37
70
fe85409a8433fa2012026557badc08a0a4f136dcb1d35bc5e3f7aec6bfaed440
2021-01-02 09:21:24
24
71
73af24cbcfc39e646002047083af2b76250e2a7d79bec9456767cc4c7b1ff5a3
2021-01-02 06:55:04
25
70
a507344b0a35c38e7da6ae13f636a6b9b5f63338385411f373c95326e1e910ca
2020-12-31 03:04:08
42
71
8b94e2ed4a83eb90bef4fc03e62be73c9f32d7e2291f2b8c8188c8404d8cae32
2020-12-31 02:44:02
16
69
882e15e03a34260a9082a0fc3e972551e2d76fef3bbaddc70197d0e21e1af976
2020-12-30 11:19:13
22
70
6946250dc5a67a68220b12f4710a97563d3a5edf3c749399fc9ccf986b5eda35
2020-12-29 18:29:12
41
71
ccba22a7cf88b186d0b8d9a7f8abf12d2a156527f4d90ee251b0737cca1175a7
2020-12-26 08:47:34
18
71
c0af6af71bb705c0e8783719f97506a80216e76f249f26659bf804dba9206084
2020-12-19 13:16:23
22
71
1ac4cf21ff21d7611d94df4e3977d6d3bb5fa2ff4a59c003ef2c0a25e464ae26
2020-12-15 21:12:48
23
70
9b6d4ca02aef485d039a7f13f1c299a1b94f49161710f45ff747d91d0493fcd0
2020-12-15 19:23:03
21
71
d7741abd82e430b3d6b5f5e80a98ac24a0a1710e918a0702c6350171dda5ac5b
2020-12-15 01:05:10
27
71
32fc6262004c4f944a586a204cbbd15e8e2aa94115f825d61bca146179304568
2020-12-12 14:27:30
16
71
4c33381feefd16837241eff6d69d17d6c30ae21f37f6626792cc501533af7cbf
2020-12-08 10:08:24
20
71
49428bd09675b7a4d5426fd3d95fd823c80a6dfb007124bc8325b24f71eb2e59
2020-12-08 10:05:18
21
70
05ae96db9008c6f929f2d9d347670e1d1b689c1c6e9347e60e1311c3f1542265
2020-12-08 09:00:17
20
68
2b9166f8289c81e9b3bf4ce6503e8c7c7c46894046339c7f6c6b4be3fa6b1843
2020-12-08 08:17:37
20
69
db7ecfc3b30d8a7364432e9ee9c5d8a497e50da9a569b1cb58c886d95469b4f3
2020-12-08 05:21:50
21
71
8b85e12710bfb2b50dd1897d652e88da3efbae404153036d94d7a5a96869e59a
2020-12-06 18:34:46
20
70
d7b6e97cc25633162b9818630df6a13f5e2f7f64a4d32ce6d50a5eea1f5d51da
2020-12-06 08:15:35
19
71
eadb38a58fcdaa282397a8c09cb900e0c30aabd7dabc555d305e60375b10f3df
2020-12-06 08:09:09
20
71
489a6ad181a2561a1b1b82269ad2461e1181287f9901f894067967e172852b3e
2020-12-05 19:32:09
18
71
88086c4bab494951218953699574f7a002815b27e23043f956ff69343cfb1da0
2020-12-04 05:52:36
20
71
7e55af1598888a5f155b3f34c318f95089b4fe6b99e4f01b6c1d66a39929ed59
2020-11-27 08:06:25
20
70
12b734ee2ea95e98e710eb8f0881d78fa786970e7e2c2dda4f9d4bbaabd7ebb6
2020-11-27 08:04:40
39
71
50366dacfddf49fa7f3757a16af4c5989ac5930bd8244f07cb6506aec318317a
2020-11-27 05:03:41
30
69
8ecab07b0edf35d5dcd070e18adc530514111d995ec1b1c92beb5072e1402dc6
2020-11-26 15:01:09
18
71
c446800f6d54a7595b327d9771091a2b5b2566291b5d0297fc26848b55733e56
2020-11-25 19:54:24
4
69
7aabf8d2903071df8698762299b77e54e187ea0600f265b33f582e5c57de30fb
2020-11-25 10:57:23
8
70
6de5fcd52f0cb1674fa949b1a0a498b457294f3da9409d4d0e7b369b367e81d5
2020-11-23 21:49:08
36
71
bf1266530df9c856f5788562872a0d2e4588460693b05e49483e12451380834d
2020-11-22 00:39:58
9
71
550450bbd26b5be83f112063a57c19bf250322316f9c09c8e7ab32eb388964a8
2020-11-19 00:28:01
8
71
d4606ea5e8d7fea20284d182a269f1c520123391ec10e0865627c3be66146ba5
2020-11-19 00:24:33
15
72
046718cb6461f511dd394de7937618f15de2f39a2938bec3c2bc758defc4dc67
2020-11-18 01:32:31
24
72
4d52fdfef2b58152547625bb6eccaf889f991cd59da35c6418e1981b53f2efaf
2020-11-15 12:45:50
27
71
47922cfa40497d97c3c4f631c4a42166d1cd87dfaa79ce3a718dd2ff26086c48
2020-11-13 15:26:01
21
72
8b24a2047f73e364b55733f59fd76be354bf5294bee7f5b2269763240a0f3a1b
2020-11-13 11:25:25
19
72
9d77cc12fa16cfa8b032f371f5cb21be2261285a2ed7fb9b651d50edb96124c6
2020-11-13 11:23:04
20
72
6e22710bc3ac9726e2dc3fbe631475e3f30a946c13843053605872231c71f0d0
2020-11-13 11:13:58
19
71
25ea6ebdba07c9a7f43221a4266878523b43e624229c207d6d2cfbd25f83fc23
2020-11-13 10:58:37
7
72
74ee7a2a639085769bbfe4302e80f7df8285cc5a2dcd3269371550a1e49e0fa7
2020-11-10 14:12:52
13
72
777db90312ac2cc5d4fc2e0f30fdd702fc2f20a77e9df935be080cdaed7cb9ce
2020-11-04 20:09:54
9
72
7289c67c80355dd09379f56ad703d41864a537b843677e3fa27abe13a52ef3a8
2020-11-03 13:00:30
39
72
8c7c453304cd96dbcc62176eb9e0ecfca5a09099c94933349856654d1b8a8ee8
2020-11-02 23:06:15
4
72
26f78c216b42977867d2ec262acefd678d828ea6cdb84bbeab188afba52917f0
2020-11-01 04:15:46
9
72
71d62f8200121bf4ccf04f53cbcd236fd8cb01387396833cff3cf2367a16b37a
2020-11-01 04:15:13
15
72
3d0960afbc1a4e55157523b1131678a4b301925153e3d5ff627bbb2834c014e3
2020-10-30 01:07:05
20
71
c421452ca8ba018052bb5a69fe393cf47e58f4a0efa811af4d04b47c79f16b09
2020-10-29 01:30:23
18
70
b277e4fc4e6711091d61675b6aad39f6bb44504a6f1c8ea8e8772d7d19b570f7
2020-10-27 13:59:19
28
68
d47a883d7afa40a96c65b73b8f7e71f945334adb6369c60c6b1b8e624539b54b
2020-10-26 22:39:16
28
71
6d7355b6fb941e899213ce402796e4b2b8faf46cb411e28e6b22a557f704acd9
2020-10-22 20:08:45
46
70
ec0a96cd0b8ba3df1c73da2e5407ee29e815bd362444a75e1133f8bb4b34a087
2020-10-21 12:59:25
8
71
338b9d41ff7510b88fa2182e1a05e18abe1c8c4d80103ce9a9b1c6df3976be12
2020-10-19 15:01:27
8
71
2238b82d78dc486aec7412eb576a74b8317d06528cf068b906f779d5b775a6b1
2020-10-19 14:58:07
11
71
7c0ef900c1af35be2beea57c755f5b4b5c09a60e1281e163ea3df6a1946d239b
2020-10-19 14:54:15
18
71
934f4efb4c9611f353969cd13a2424ab5dd0ccf1706df5c05efba3a969b323f6
2020-10-18 01:48:52
8
70
e5a4f0d1cb292a88c11f232dc1a539dc38b0c212cc25a310bb921ff4ce429459
2020-10-17 17:23:35
40
71
30c90402556d980420ce121af0256981ee848df018d1ce6795c93c321ecdeb34
2020-10-14 09:13:45
3
70
604a6c99031edd62489ad0427128e0cce84fd3cbc8378b4f15e2d1dd7cbcd851
2020-10-13 19:00:29
35
70
bf56260ff44cdfdac3237a0893d116e337a8f63977cccdd7f1f5539b9b4a238b
2020-10-13 16:48:38
4
70
23f47cd2ae065a6fc67f20929ad57fc7b9b26d0e7a0b6dd92cb12a5c7424ea58
2020-10-12 01:30:57
42
69
d3bd17ca05349d4ff858bb99e4f5be8d11515403dc91599fa5252cd2cb9a251b
2020-10-11 16:28:24
42
69
fd0203b99039abf6f13cc7335f3bc785c5451563f9866f1874d1038f2bf9cf0a
2020-10-11 07:34:48

Rule Matches per Month (last 24 months)