HKTL_CobaltStrike_BingMaps_Malleable_C2_Profile_Indicator_May21

Rule Info

Name
HKTL_CobaltStrike_BingMaps_Malleable_C2_Profile_Indicator_May21
Author
Florian Roth
Description
Detects specific keywords found in Malleable C2 profiles for BingMaps
Score
80
Date
2021-05-06
Modified
2021-10-06
Minimum Yara
1.7
Rule Hash
24757045858eea57b057bb36d0be0579
Tags
['T1550_002', 'COBALTSTRIKE', 'S0154', 'HKTL']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
6
Clean (0 engines)
43

Rule Matches

Timestamp
Positives
Total
Hash
VT
2023-10-18 11:21:19
6
60
0d972aa01925e14a61805e22abed872249ed32e0aa2eed920117ed78a53b895e
2023-10-18 11:17:34
6
60
71e8544720febd36c191cd24dbd431bdac3a7f6e392f5c30e92de8e7ed19f364
2023-08-24 15:23:23
29
60
d57402dfd8b2c562d87744d1d251acf479aef5357cca6e230a1c45b6a4cc15cf
2022-05-16 19:34:27
2
54
9d2474656b72d9704507e5178407a87c0bdeccb52cbd71f0778b9fb480861ff4
2022-05-14 19:40:31
2
59
d7eae096938a4968e141b0f44a7400e08c2b120f78caebb4b2677c96aef313b4
2022-05-13 19:34:16
2
59
78c191245bd3e73657856bb4450c6586087484c3c9855e95546f1d51114051f2
2022-05-08 09:09:56
2
59
e430608e7c3b4a9fdfdb8d177fcb69674233aae2a30d33f8244705329258e9f6
2022-03-30 11:55:38
0
57
b354b4c8aca007966997a5cb43e083f649bd3372bf093282b5b36be87a28194f
2021-10-29 10:06:30
0
57
36f38629f01367b520450268a81b60d1b1906ec0ad71d77af0333d83016774a2
2021-10-29 03:11:39
0
56
e61b4c7463709c6100159a53a8580acdf2e091d03cdc8148356e5dcb824fb189
2021-10-29 00:04:31
0
57
797db2b7edbcb7b7eddc62b214a4ab0ae23a6d90de524b2b975c70a4f45f6108
2021-10-26 13:12:12
0
57
650247e93809de2a9bc7097555894904422505f974dbe89984d4b5c3b15be855
2021-10-26 10:33:38
0
56
204e80913dba1cc8d9ad2087befe95d11e80e0ae657f390c6f2e1e6cce0fbf60
2021-10-26 08:54:42
0
57
870584bd9622cc2debb5aa2a2e8f06df60ec666c8a968f99a9c34d7648524867
2021-10-22 18:30:08
0
48
93681f8a9ddda5a6d2c428ef9c6dee750293c5c878df4f12c039203d0d348164
2021-10-21 20:36:22
0
57
7fae25d23ce586d19a63b76c469f04ea85e062c47e772320ca9a0145c6f615da
2021-10-16 16:44:50
0
55
90a6bbd822c3d065c4957b404a5eccab9679932fe394a40e6424138adad89c6e
2021-10-15 10:44:47
0
53
b8d0195fc1d8e0af49e3fb4a7ac7a3c7b45e10fba4005c5ce510f7b0cfd50395
2021-10-12 08:02:47
0
57
cb38c26233a2dd774768a9de297e1a6586bcfdd5e98a14680898c8881f292267
2021-10-04 07:19:09
0
57
d63444b844b0a81dab9216558f75a52d0227fe72f5475488194f09535f176094
2021-10-01 19:11:06
0
57
ca70ca017e3d2dfa01d4551b808e95d851edd099c36a4c48b101b9311277ea46
2021-10-01 03:22:29
0
56
f04debd272a21b4d9f93fb58367a369c9c17a9bd8a9b00529d5a04ccb3a63c1b
2021-09-30 14:14:24
0
57
30aa01d0456b300214c397e8ffce9264afc9384ab6241c802e0e1c6962104599
2021-09-30 09:56:59
0
57
46e4ab937b713ce07cf8c2d2f791efa2653a9655ebea8551cf9cf003e2544c8a
2021-09-29 00:09:11
0
57
8e313d4ee37dc1201a0a75999ace44772ad9bf77916ff70766c892be4a314f7e
2021-09-28 23:11:42
0
57
c3e551307293d479c51bd828dd411b984d7410d30f336860cc972b5bce0d6aff
2021-09-28 09:05:29
0
57
eb9a06d9032a87e8e7ae227b914fbb9b457138c75b911c9229a62f875395ff3f
2021-09-28 03:08:13
0
57
bce86310104571f7f8ec17d8b32e953e7d935b2a74b18dbd79ce8c69db8febfe
2021-09-28 01:05:45
0
57
ca5e5757cc8311c6e1ace21a9ba62e1ec6643d281ab9fe613418eed6253b6a89
2021-09-27 23:15:16
0
56
339097e83af78c18865f3270bd1a0f56c965dcb049af82e8fb6aef0cdb1f0a36
2021-09-26 12:50:44
0
55
39b198eb17d20b7755fe7b045314a7280349fb84cf703f83175d4c2362a9e294
2021-09-26 08:52:32
0
56
26827486f48fe009c06ed4c31c5a52ab029b885eb51a400669fa04ea7df8dcbd
2021-09-26 07:19:58
0
56
2519f6e646c7d5ce2d0bbb947f411e7d86cec78bebd6a061c32ffa5d092e4189
2021-09-25 14:09:26
0
57
a2b9b882134f88c6b9a2dbbe3645aa939c5e9c474f5b4d865b6dfcc1c2b2b94b
2021-09-25 11:18:59
0
57
999542ff74043f8709f36d6bc7984c0c53b507d1f57f870ba68e1df21c50ae92
2021-09-25 09:19:13
0
57
d4ad8293b54222464a047e2f52959fff1eeb965ddd42dcc6f886e282fd7f53f0
2021-09-24 05:07:09
0
56
6deb1427ad6679b185b07a1c43aa156147eeb2931d8b27c9612ceae436270771
2021-09-23 02:40:37
0
53
76ef5d6ed09ae598eb51574ef46eef8ddb385d9da987ca3e3ba63fe2faab2003
2021-09-22 22:24:24
0
57
ed6202af9feefe68c81da5bca33a885cd3cd696ab841f32bc6ed92e967566d23
2021-09-22 07:19:02
0
57
99f1429a7bb908f35e844c688c6f5b73c5d4f5100b510e441da10cf2fdb0cd73
2021-09-22 04:36:12
0
57
7f8f30c21c03a8fe4b379356bfd7da58ca579c3108e71d9acf3c8b3378de75d4
2021-09-21 19:37:40
0
57
30cb9683cfb62fab97704121a31b685b91d73f601cc80ecde3cd6b0fca695bd0
2021-09-21 15:13:16
0
53
6d60db2ea11226ffe7599e76273f00e37f3e07c439ad79e5815095700fab0bc1
2021-09-21 14:17:59
0
57
f81c428d060e88e53698c62e4cc4086332ff4c1b71f49011ade6b9b59cd4c59f
2021-09-21 01:36:57
0
57
cee9f3e4507a7a7a09b96646fbd4f6e2288a3f72ee36f45e51b7b557a71a61b2
2021-09-20 03:21:11
0
57
ca7cf47dcc505ed073367954467b3b18724da691cbcd7d250708340ae7c8ab80
2021-09-17 17:40:05
0
57
91f679440f0244fd9d7053e24175b2abd71cdd35d0c04863148199c2db4ccea8
2021-09-17 00:38:58
0
55
7467c877e11ef12b94e51043bd2ff5e732a6a5c82e90dc4495c57ca28535c39d
2021-09-16 23:22:11
0
57
1e3124008246dbbc77e6ff97b6f7c40da15a8970ac9a3109de0d981ef582b78b
2021-09-16 18:53:14
0
56
65363c8fe2100483694c21c9891b8f5fe92e5202e0ca1cea013b9f0c77c978ec

Rule Matches per Month (last 24 months)