HKTL_CS_PS1_Beacon_Aug20_1

Rule Info

Reference
Internal Research
Tags
['T1086', 'T1136', 'HKTL']
Rule Hash
1bd37077badc6c32e9776093b29fcc68
Av Ratio
28.13
Minimum Yara
1.7
Score
85
Author
Florian Roth
Description
Detects PowerShell Beacons
Name
HKTL_CS_PS1_Beacon_Aug20_1
Date
2020-08-29
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
93
Suspicious (< 10 engines)
14
Clean (0 engines)
0

Rule Matches

Positives
Total
Hash
Timestamp
VT
5
59
e9f068fd6e412eb632a60a5c1a04c730c9832c28b6678727744fdcd2cd6e8a7d
2021-01-17 18:32:24
20
59
ac4557b564299ddf829df676c0cef7f0eee057eb2d79d8d8fe72944e6f9eda1b
2021-01-15 23:39:51
20
59
4453aa7965d9955c907cd3f48ba0ca6ce367210c430b4f3478548ef400a5cd71
2021-01-15 23:38:57
20
57
3a768adb9d84c9faf010ec7cfd70b6c1e08deb9195ecff6a17a198897858271f
2021-01-15 23:37:25
20
58
812ed1e14024999595c1241171b9534012ab453319fe489d677f0ab4c9965bae
2021-01-14 15:47:16
32
70
c802f65e7d2a4745659bebe85f4e0a84f4ca303bc31d5dffd45cb33ade5f41bd
2021-01-14 15:40:22
24
60
57de98703ad1c1e568a43d56aac23cfc4bd63f5b6050b73e578097712d85f8ad
2021-01-14 01:35:16
6
58
5fbb12094db96e47097c5f3aff4a8a26832e7d319041561d2e90e6c714f7c870
2021-01-12 13:01:20
6
58
13dc7b16c2f7b87f8aa90abbe39699d5abc520b2b641940479711127f92fe31b
2021-01-12 13:01:12
18
59
35ddb0beb731f8fb53207aaba1105e0d9ac34dd4723bd9b1069f812f531a32fb
2021-01-11 12:06:44
43
71
e89f46968b5c2551227ed18633b4b5f111f9879d69d69c0ab537e0f678266d11
2021-01-11 00:40:50
20
60
634b095c9f8a743dbea198cb3bf9aeb9ae3527e241f2d131e209cc90e7412116
2021-01-10 16:09:05
20
60
b0986f5bc6bff749f52580550119a34b51d43d312332e79b73aff826241edfec
2021-01-10 16:07:38
20
60
d759a568860b03c7e63823b4871d8af11ef0e7b769c031eb059e912bc112a138
2021-01-08 18:02:08
11
60
9af512f7775126cf58700d5a0b9ed4bbb6ffd62225bd21b0de2ea219069a5526
2021-01-05 17:55:25
40
70
bd99ca26e2f40c709e8b777e86c039f04e60a5865ddc930ea233fcd259c065d0
2021-01-03 02:35:06
19
60
673b386b3b6dfe7dce88737eb0907dbeafd746586d5d4cf28e3276e9f24fd4a5
2020-12-29 14:14:19
17
60
cd2849a616b79ef91724d56ebd436000d2849733d33c5779371a0f3298df8819
2020-12-29 03:30:17
18
60
6ef17302c43f67aa1b2c30d86d5b13e592a1abd5b5aa2cef9f21e5ed0f35cec1
2020-12-25 11:18:57
18
60
233d711be15f3046d160b11f6d329843f0754c0b9794094ed99cc6592ac4bd8e
2020-12-20 18:44:07
17
59
39fe4bc4dcd132764a527764bb2d5609a0a361c9ccee178955e733b848a3bfac
2020-12-18 13:48:25
19
59
c5b4239a741059703bfebdc3ea310e2e939b24ebff94b921b94694b7373a7ffc
2020-12-15 15:05:03
20
59
c7f7e2c3bc7e2d3a1a04bd14685fd5f4527cc741bd53b1661bc64be85b582fda
2020-12-15 14:48:27
20
59
b25e60769853942967698b5f76351b9a7b35b0d662eca41230de5e177b61fc5e
2020-12-15 10:28:17
18
60
7c35885540eacc15930b1f9cdd2541d69a299d0dc89bd7e5764213986916a908
2020-12-14 21:47:27
18
60
369c7f4ef0ca549b6d3ed4b11c9d069836414300f5903c19091072ceba8a3062
2020-12-14 21:27:34
20
60
c8e92cbb59a2e40a93eaca3ae6312c1545e76d9c4d7f05f43aff46054fed3722
2020-12-14 09:35:13
20
60
bf2a7b1ea9aad1ae14eba6ec585a72fba04ba3bb87632dabf35e408c8fbcd6bf
2020-12-09 16:24:28
16
56
cd280191dc3fab023532820180856bf1f2551866de3b645e24d0c70bcbf81ceb
2020-12-09 16:18:58
20
60
196159529401333bd5861820b949382ba940da0ab6c6fc802fd42b048d65e135
2020-12-09 15:52:47
18
60
c36963ae62350d6ace7e47bed0c3c8a59797170b96dc758316aa6d389f59b3fa
2020-12-09 15:29:26
20
60
237268183116f8220156e3cc5200629f52f6c30ac278262d0c23bb58a88eea2d
2020-12-07 13:15:47
18
60
377d6989262f844c56c5dddc8b49d9160bd10192cff926da5930341807f96778
2020-12-07 12:37:07
18
60
f53b6a5d442d2e2e4c09f98d9c0e95305acb149a4ec8dede399ca738ebd07075
2020-12-07 12:33:38
20
59
c4bd0a7f13f4f9b00e8d88e0b0d37f554e1bd7bb8f80f255d1da7ff7b7560145
2020-12-04 20:28:59
20
60
4fcda3b513c839905c502653cf9432db6332a6d62c2af82d8d9bbde468ceef3e
2020-12-02 00:41:12
17
60
7c46315197dacea3f1674a539f6a226ad20955a109107b2e3f1d4be2d7ac4f8a
2020-11-30 15:36:17
18
60
63c6e8392a75af901ad7bfc3ad600bba36270ec05b5c3763596dec121fb12213
2020-11-30 12:35:27
18
60
3585d6dfc41f7a2c9bf2847e9bc6302a6e399cfe45dd94c5fd6660fd534e8f2c
2020-11-30 09:53:02
18
59
1017cf8bac37cdec7754ccb1e64b6f3942d5259fc1ed4f566f7ffe4f1ef361c2
2020-11-29 06:18:10
18
60
8c8e99f5632b2d70da05fd7a33e796f3a27233416beb9e49eaf73816b61f0f26
2020-11-26 21:35:16
17
70
563537c1a7cbf93f555b4f2f825e86bb1a63c26db1ec812d02d79be5a05053df
2020-11-26 14:55:09
17
60
ef5415185cac43cd58a3e55237b7a7ff758b2f8cbd6b69f5257c262e55e8e7e7
2020-11-24 07:17:20
10
60
7a886cf196ab5ff6758b2e65d6b7026af4a136c41852138d8e51da18c4d70ddc
2020-11-24 02:57:01
18
61
b7fc5251e8a6c5d9d6f785b08b2ef8c62897a2142c9d5f3775a7e75a4af71fb2
2020-11-21 01:38:51
18
61
831427245b05f068005a6af550fde0f277c189b58ec3cf28d034a4565101b158
2020-11-21 01:35:31
18
61
daf4d6019946e4d447afa90d61b04a0e94b058422ac5fc910d5c74f5a5d92cc9
2020-11-21 01:33:47
20
60
203e77b812545e621d13f76f05560a7ef9ec6e13aad5c3fdcadf9b20dfce8cd6
2020-11-21 01:28:26
10
34
ca2e5dcb6757a8289ed3ea426ffba0d1456ccea055764889f5c83c4b827779bf
2020-11-21 01:23:57
19
61
4bed4eca49a642aa228dc5081bac0f907129935fdc30b3afb2f329bc44f43053
2020-11-21 01:23:02
18
60
98c5c269ca21715e58cfca5777bb4fd0ab5d0dedbbdbd34b34c982f890fe8174
2020-11-21 01:12:00
18
60
9667f21564c4aaf798e74264c2506e4c11e01a9c066cebf5f632d051bbc945dd
2020-11-17 11:23:29
20
60
479a2098e53ce7957ea10c878d4a3084e0eeda2a1707f8c76514b15a7aba9be3
2020-11-14 10:07:19
20
61
40ecfb47b754dad8809b80ae2ea5712b9d3ed3e927cea3d4ffeff073edbefa4c
2020-11-13 10:37:17
18
61
ca62d4baf7971e224b11cfa46e843e642ed58285fabbd4f936a5c5a55b3053d7
2020-11-12 07:21:49
18
60
bf79be26b88f022419daf41dda2dd2fc1fd0692cd811a715af870892073ac79b
2020-11-06 21:45:22
18
61
951e6956b4e9e90d84e00291f3d8919263ba5576e2c2be77039a1218526b7797
2020-11-06 17:16:00
4
61
471b8671c216a7f2d51fcec397142c4e4657534ffe9df349bbaeac12d2ca8adf
2020-11-06 05:04:51
4
61
f6b29bdda1bdf3475ea1e8962d1fd7ca386e235fd237ee901654b3f5334bd100
2020-11-06 04:37:10
17
60
cdafdeeb7d47ed5a9dd004d98d085c446d6cfe54399706848c3d423f5599d0a2
2020-11-06 01:03:13
19
60
fd38233039490f88da2ad17b53297a60ba603dcfdae7f3f407a7496648778422
2020-11-04 03:09:10
21
59
d63005760f98e05e0639aa8171555d1d07a7737136ec63d31ef1a9227f8ab127
2020-11-04 03:01:53
20
59
92156fe5a80e452108feb837f4d9bedb6bc22781f2600f3346d634a6de8f9d82
2020-11-04 00:40:19
20
59
710e8aa5b5f0ca95fc5cfa196d858dc2ed49581849a6369fd91fdc36a17178a3
2020-11-03 08:01:01
21
60
3eed754301186fcb39b8829c171da5e7ce740c649537d091e86484bf57579083
2020-11-01 13:59:49
21
61
2675e2de4a680dbfc94d26062924f38f9f5a111d39d03dac90cfb55a1f3d16d4
2020-11-01 13:34:09
18
60
88df98200069ad1501e5cf45f2378ab6a9b98e2277018b4bf8f8008aa10bd6b4
2020-10-20 10:40:58
2
60
22cd6aca343283ca9751f66c98943f45d6e91834bb06c5389749341147e7e1f2
2020-10-18 22:14:18
5
59
61fda9d2222d313995f94f18f144ea1eabc77ca62a23d4c6a00da9a371a0a8a1
2020-10-15 18:51:06
5
60
fb90bddac65265eed1ebbfc65fa17e4d1aa777f5401391d4a6528dbb39a7e01b
2020-10-15 18:49:23
2
59
fbaa2e69eb298f8d57383a6be2f6cd700c10d521adbc57be7fb9869e2e132606
2020-10-15 18:41:22
12
60
04d36d9395e7ca4fe1d7ab82015c31fe3c59f8a5b4cd5683a7caf784ba423cf7
2020-10-15 18:36:23
20
60
8bbc8ea6f64edb5cf4ec18ecd6792cf38004d2bb1446e32df9cffeb413bfa54b
2020-10-15 16:23:40
20
59
8784ef91976dd23226f1940adcc9cb146029e2bcd4e8c1e7a9aad4e69e1a7d87
2020-10-15 16:23:09
20
60
2652a70f1cb2b6fad773741b32a85585dd34f4ea68b3bfc1d02b92e8c7cee843
2020-10-15 16:19:56
18
59
1fc402e580077c2d4a17120c5280e8f6852af22ea8dbdf6d4c3e9575cd02411b
2020-10-13 08:46:16
18
59
26437060ca60b5289567b565c4e13e0ca28186f0a1ae7b98555389d837153aa0
2020-10-13 07:58:23
20
58
8c6f262934a14c0eac87d7dad1d478764bb635681c4ed268e54fac6a5d519659
2020-10-12 21:07:02
18
58
e3f80a860bde415ff64865ae6e146dff24bd5ebf9ffba8629ccc2dbc0369bcf9
2020-10-07 19:41:36
18
57
254751b0f81b3840cd4d47ff9fa5086f849c7ab4cb0c65ba2a5eac5573313011
2020-10-07 19:40:33
20
60
904577567209444fbbf898502929d5c46e70979fa540caca32e08d1fc7060a36
2020-10-02 02:25:56
16
58
ea596579dabc2f32a7f4336c0c48764df8e54de4feba6e6ce7c6ee70675e58d8
2020-09-30 12:43:10
16
60
713898effff32dfe31e5fa93f805c215c50dce0e91d4b9ccd4e2c26072bf2a5f
2020-09-30 12:38:25
9
60
690cc74e28dabc09e45455837a1c3f081b61420f355c2fc54988b0af4a303db2
2020-09-28 21:24:57
11
58
0a971fee55095bdbec731c6bcb6dcd826d21ffeed8131fa556f48f6b396b533c
2020-09-23 12:24:59
13
56
91cf22d437eb5ef89921e199ebfa3bf10aa9276654a16d6c5f7b8701743a20b5
2020-09-22 11:04:35
13
59
b0ae5025b92cba80799383c83a4fbb9433fb2d6ba75555e725d060766a14ef04
2020-09-22 11:03:33
16
58
89b8110dc0d4772eae959e7d5b46ca2c440fb600137231b3a962fd8b009137f3
2020-09-22 11:03:08
17
58
d0610896f1bb806a29afe5c89a0755275e0fd46ac811b504e6228018cdf3519e
2020-09-22 11:03:07
18
59
8f0ec4f34fc88347e22a16bd9c21e9a964b771baaaad66e785be44466de280ba
2020-09-22 11:01:32
14
57
fb49d3c2488b86be9ea13014a95b87b4e08582511bea1432e100c1d31e39175c
2020-09-15 23:51:56
14
57
decfaec979b9e7ab926e81040d6e94012b2a5813d21e932609c2e892dba6fa59
2020-09-15 23:41:28
10
57
15037d4a30ccddb274468b0fe966b37e8a5af21ca53b4a6e827030e2edf40f0d
2020-09-13 00:35:08
18
58
e0c4f92ec67325211eb5a8c27361fa49aa37d9463d16324c30b41672e8e6a298
2020-09-10 22:38:40
16
54
b4861d0084d92e986669dadd51787043fa9160f034777201a031b3de3e6d51d5
2020-09-09 23:39:23
18
57
51a4cb0bb094e4f8e603a37785eea7f35c878b3207f6d6455a22ef2e102a2753
2020-09-09 23:31:48
18
57
0ecaa85a2a165659ca7377b203b5196488bb959f406bd2b1b06940ac775f0c94
2020-09-09 23:26:23
18
56
3436086c7f1e46fb9fff425127cc31d4ba242b53e09c02cb0113cac23403fecb
2020-09-09 23:25:12
18
56
4314b56f733d0ca80bfa767654fccd3eddab918a5851eed94ce1e783d18c49b4
2020-09-08 03:41:08
5
58
b3b6b7b76678791657819cb92c8bfb2dbff405300a71ddfd80b6bf4153e149a1
2020-09-07 16:39:07
18
58
2c7623c934472d9c536ee2c21ba83c06023789e7605e4aee2f9a76150d8885c5
2020-09-07 16:25:25
13
58
4f0702a1f9bf176c12402b32c6b3b51b41e1fa21832c05d7695f3263ab81200d
2020-09-05 08:07:28
7
55
7330367882f4ae1ac32020275b80b479d00c45f59944078c2333d37ff67ba5a8
2020-09-02 03:18:08
9
57
5359b464ab806b6a92164019faa616527ecf41f263b266ece04924d95da46ec0
2020-09-02 02:46:38
9
55
1bab1ec15d34b1cb48cc0a19b67ee64bbce1741c191bf3d8ef9ae7af11fabd10
2020-09-02 02:23:05
10
57
d62711a599ebbd28c178431547e6e18956ea99a0b9f57f85cdc0246f1bb45b18
2020-09-02 02:12:21
20
56
2f01a4122dafb8287c13190502f11fc630947bfc591e6692cc7238de375645ec
2020-08-31 00:13:10

Rule Matches per Month (last 24 months)