HKTL_CobaltStrike_Custom_ShellCode_Aug21_2

Rule Info

Av Ratio
8.99
Required Modules
[]
Name
HKTL_CobaltStrike_Custom_ShellCode_Aug21_2
Score
70
Date
2021-08-23
Minimum Yara
1.7
Author
Florian Roth
Description
Detects customer Cobalt Strike stageless shellcode
Tags
['COBALTSTRIKE', 'T1075', 'HKTL', 'S0154']
Rule Hash
0e092cb8f7c325a03879999e9117ad59

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
23
Suspicious (< 10 engines)
32
Clean (0 engines)
21

Rule Matches

Total
Hash
Timestamp
Positives
VT
66
07e45c9e701151ea97f2066071e3292484b607b059de5dc7f4862c72d1e77d41
2021-09-24 13:40:56
5
57
39c14c0cc61902301774ce7f5196a4bcba97815609faa4f03987e007d98f7ac4
2021-09-22 05:12:11
11
66
ac21b0aff00154f6cdc48ae71411820404c84eae41135970d1daf9d968401519
2021-09-16 02:04:07
2
67
dab1770985ed01bd34dc4d940ca75556d050190462aeb9df4d5e65d95de5b433
2021-09-16 01:53:02
4
67
a63c33f9b0c6941da3fd795028bf50f7a540e6a8e6948277d7d04ca2cb8e065a
2021-09-16 01:50:48
4
57
add888181c2082122e71ede5c10f23741b86ffa9a9bb5f989658770fc0bb4083
2021-09-15 06:10:28
10
66
d09d414608504e189da7094dc0f1766fcc2b60369beac22b76375bcadfa487c9
2021-09-15 02:54:20
4
67
02b9f34de49fc2611a29b25dc8206911ce03543d0a000f7f42efb461fdab109e
2021-09-14 06:44:53
3
67
38af9063d205d7aefec3d261b942ee308ed21a41266fce27f754a7074bf279ec
2021-09-14 06:20:26
3
67
cfa1aed4dab7be99a9019116058f821c9f98cb94c0cfc8760682190f520ffc4e
2021-09-14 05:45:51
6
67
5e9d0f4e6b2b473f2832e2979dbbc74da6ec29563907ef0f60a60bf7a1fa21c1
2021-09-14 05:33:33
5
66
3734d8944963a6270518b28341bf64780342e71a4fd150b32e9208f627f8c5dd
2021-09-14 04:51:20
3
67
a769d5a5a4bd715733222e63d05b1d76379868cf48233f538d4e8544e1896069
2021-09-14 04:49:02
3
67
852614efe98fec7649884c82426d1162b3d5f4f00889ca3eeca5d71e54a76ef1
2021-09-14 04:36:40
2
67
86aa42c4807f1b0955cc9089123a82345087a37af897c647a060a7eb1beb9573
2021-09-14 04:30:29
2
67
081427077adc483d4dd54e9eb2786c2bbe0bf911497595e4e2c859e856aa94c5
2021-09-14 04:27:02
2
67
f3e4b759db37234b266f833e9c4ea173034f887e36a891142c90141eb4b72fde
2021-09-14 03:22:16
2
66
aa560357291c37cea353e4b5c6086a29df9124c7db2330baf412526430c3eefe
2021-09-13 11:05:26
2
67
8f873de730b0fba6bb65d6fa33faaee2b837f95169e19377f59a98cb51657b2d
2021-09-13 06:48:58
0
67
e2ecc6b0fc6c7760281bb8c6956a3ae0d129ce7dde50ce4c3319dd656ed5f259
2021-09-13 06:29:39
0
67
d6c7f7c57196c8962cbd9947663ef87c3be59edb13e221e72d1c3ff0507aca60
2021-09-12 22:58:35
0
67
bd07c899b77ffdd1500b071e9ecf4bda9975626843a9bf0a8b8bbdfa0b624ff1
2021-09-11 21:26:41
0
67
ac861ec0836ca0f4992c5ef975db20ad6b7556c324f36e8f2fa8e786a26a2320
2021-09-11 20:47:48
0
67
16f05e279acdcd92552fcbe718337c21634929c87e3f60c06e22e5338adc895c
2021-09-11 20:35:04
2
67
0073834cb842be0e03cfe66abc9b8ca34073fe6e7698d8e65f2b9522b2598e34
2021-09-11 20:32:49
0
67
57541e637d5de4e17a29fd4d99aa34c17aab155c91ecd80426f01505867c2474
2021-09-11 20:16:26
2
66
4b04cecdc46e48b3703502b6706ab12c0bffc9e5181c848359327a13deb2a87b
2021-09-11 20:11:27
2
67
4b6790d21f1e67466b1f47769fb09d7246db2c2df2ca5782f600cb30ca5fe55f
2021-09-11 20:10:21
3
67
8bd04fb2ca2cb1176df6aa45861ed13067941dd328c8d785570394c6c5acd14f
2021-09-11 20:06:54
2
67
f34fbe91f1b8f135a50f1612df9320a37b7dfad345a6146e7aad85a4e73c642b
2021-09-11 18:43:20
0
66
8babf84856ef69bc31342d3dafc016458e177764c131497abc972c0e139a4b5e
2021-09-11 18:39:37
1
66
4d3112df4e0249f5faa32c4837f61d181f2657e699f8a2480d8c7c901f79e149
2021-09-11 14:12:01
0
67
5c1deab71e746bd7afda103d389fa869ea5130c627cd4b80f8b10f415fe8ae68
2021-09-11 02:20:12
0
67
c4baf74cb4060fa78dbe204249b667345d4e5ad27a4e7084290c0800fb7379cd
2021-09-11 02:13:24
0
67
61dd9466ce1d00f67706d12414d500f9b29156775fcb58f82bd82305d678a61f
2021-09-11 01:46:39
0
66
62733065d5b29f9808c8f3134eda19798de502c7bb316a1486a5257b9a0caf45
2021-09-11 01:43:09
0
67
ce8b90af37d631369c49cfb4e1336f8edfc866ddbb50dd5a432edc3049550234
2021-09-11 01:16:53
0
67
f4973316ca2012e2b22c735d8b79f35d0d3f573c65191141663a67fc7d9721cc
2021-09-11 01:14:44
0
67
eb065c12f4a18f9e86ede5d1988171d00892ef81145e19fcc0381c624d5f3ba6
2021-09-11 01:10:22
1
67
dc240a33694178d25ecbdcc2d2f55d9eebfa64eadd85579c9d3243f6927731b5
2021-09-11 01:07:02
0
67
f2310de9076971a505b03de1e635d9ecc539e2fa97ee78e73d92ec56773f8ea5
2021-09-11 00:00:14
0
67
2f9639e9b6af872ceb66f16833e60c0c15e007cde3481cf28b0cadea49ddadef
2021-09-10 23:55:42
0
67
0691dbd8f88819abb5b4365a0481d0b11b8b18943a0150d5123779f429342df4
2021-09-10 20:59:28
0
67
fd09a012b9ef1a61b2b5a09d569ce1b3ff11660345a2cd28153dc41eec2c1c85
2021-09-10 20:58:20
0
67
b30638a7fc077933ef56c7f9c1109f49017d0210a1cea47d28858267863d16e2
2021-09-10 20:21:25
0
57
8d4e18be18bf0422a3dd27e2e1ec2ca3caece1ed4b9e34b6ce98e8d14523380f
2021-09-10 10:59:56
12
57
19b314290d72d80cbbac4021471cb840394aa569d4dd14f0e88a1369124476f9
2021-09-09 21:47:00
11
68
0292c1045a28952536eb272d1fb5875b3ea5eccdb14887f5713a5800bb8446a3
2021-09-09 13:23:07
21
68
31991dd9480bd5f4fa07ace76ea5057a4591b648683a72b2d13fd6ac299dd728
2021-09-08 20:08:19
16
66
c4d030cb21a431f1f1577618048162a654948e92dc9c3a885b6ae920c3809fac
2021-09-08 19:46:47
0
68
15bef3ad418c639141eb932129b2868e55cc297c9c7b4459e34f5c025c7f2b4b
2021-09-08 17:19:28
16
68
7447bbdac1ca07dd536a7d120a2942c3aff9076a3ea04207bf983510f23917af
2021-08-30 18:34:20
11
56
8f3dfbcd132a3989ac48b2375d53539e851c339470bd126a58bf878b6b768d6c
2021-08-29 22:53:16
10
57
2ff9ffbec3bb0c5b040623c7e752eed6e070cfdc3b45fdba25b2fae4ac5bcb28
2021-08-29 22:53:15
11
54
632b376056c5daf2f92ebd55f31b15d32a45c523dcf391836fe7c170cd1fc5dc
2021-08-29 22:53:15
9
57
0e3bae8dc2d69e1111b367f9970dcfc8b8a7ed41a7d2a772654500cab2538ea7
2021-08-29 22:52:08
11
57
bc1a58cf8d6416ff90e68e9361105df3bc8ed9ab6f57b3de84bf63b511b423f9
2021-08-29 22:52:07
11
54
a0f35e04b572211b9b9d4737bd0704da07cf99415bb73d699f2c77ff6c1751d3
2021-08-29 22:52:06
12
57
b44b26b9997d1b602083c5472bdb1e135b3979d0ce659587de2027100c99263a
2021-08-29 22:11:42
3
57
395821c6086603b96109a23caaea1638f1f3ea72dedf198ff6015efe973a18cb
2021-08-29 22:11:40
3
57
a6578d9321e5765868d86a6bd79e40e5259264fd0ec919da41672b5654f616b8
2021-08-29 22:11:40
11
57
b312009409460ba7ed89f4d76c7c98b4f9f14d5f99bc54bc54d9e630faca20fc
2021-08-29 22:10:26
11
56
0e10631d4b3986d5cd3d50873e86709e9b7bd873a63479ce5e4b44c41d4930f7
2021-08-29 21:48:44
9
57
46d39a9025af0aebcea1d9e96657b2231f6a006a62855aa24111b8b25d7aed84
2021-08-29 21:48:40
9
57
fffdc7dc1e71d653071c6a6e85dfbf0e49b44a5825fc6aa4d4bd1a87024324fe
2021-08-29 21:29:17
9
57
24a5e0f676a652b52b949f69beb4d812bd60a139ddf5a33400f17817fbe46efb
2021-08-29 21:28:03
11
55
38096020be82bd4e694883b74d02ad04436d6f667f5d21d5e4634157d32ee988
2021-08-29 20:57:53
11
56
963f9ef5cd64711fdb7ecb1660714eb4a7a7312aced3bb3c285b4e804ca864c9
2021-08-29 20:34:08
9
57
27a947b9c52c78589fb96a55029acc68736307e38d4edcfa3a21e1d8890afc12
2021-08-29 20:34:08
9
57
ddc4ff349a9ab01ae5f94627e5d9dd2ff55ba795cc41a91dc3ec9c1d59f351b5
2021-08-29 19:50:16
10
57
6060029de73a235d2f8aaa0b295c450fda8b57cd00998d3811ea893146ab03a9
2021-08-29 19:49:08
10
57
2c945d90b174e0feb5e8c67b6b46048945ce08b63d47564aa4ffae01e7c14a99
2021-08-29 19:49:08
12
57
2e17e1f587073c8286b89ec4a21f8961608bcffcdce153c562a5fc7ee328b0ad
2021-08-29 19:49:04
9
56
513ebbd03ea27cc27cdd7ff01bab6461070c402c03b4e27bc4b19752d3961299
2021-08-29 19:49:02
11
57
55e67145ad60fe0a630d67f950b4a6e0df83a5f6e84fab0635d404e880d76e05
2021-08-29 19:23:39
12
57
fb43925be7d748789e0fa3f5460d3a623195ecf0d085098c61033dc2155c948f
2021-08-29 19:23:38
11

Rule Matches per Month (last 24 months)