HKTL_Empire_ShellCodeRDI_Dec19_1

Rule Info

Description
Detects Empire shellcode RDI
Score
75
Minimum Yara
1.7
Av Ratio
42.3
Rule Hash
da9a57d689dbb4ea1d7bf1ae9229025f
Required Modules
[]
Tags
['HKTL']
Name
HKTL_Empire_ShellCodeRDI_Dec19_1
Date
2019-12-09
Author
Florian Roth

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
73
Suspicious (< 10 engines)
17
Clean (0 engines)
0

Rule Matches

Positives
Hash
Total
Timestamp
VT Link
28
414943e6a5d83eced48a080b2d54518f6028ea1a79ef7f68901bd2d534c485cb
72
2020-06-04 16:07:06
20
f820f33c568749916c4a04028eca84b8e0818d415d7c75c044e3df945795eed5
61
2020-06-01 12:27:09
9
11c6210656236ece3f3a2b4cb160f104e5815f8572f12b8c41a96a5b5fa213c8
58
2020-05-28 18:40:24
10
02d922c35af167352bb8d61103b95d9d4659d5a98bb416dc234fc50656ba4e53
59
2020-05-28 18:39:15
20
ba6d38a01a1008bcf9ce32578601d2d3cf69671b07d7a3c05c25a99756d8eea6
72
2020-05-25 15:12:58
12
bc1d51b468493b37b395f0d3c0d01167c135e4d474b7c9e75cb217d2db363111
58
2020-05-23 21:13:18
6
97786fb375b89cf33835c5c92bb492928c75eec93b2384a768e6d15a9b0bd8a9
72
2020-05-20 21:01:17
10
562dd009134caef404076a932c190fa37b05d86a1fe852b0ea8bd5db0f1fd133
58
2020-05-19 17:53:21
10
eddeee8b71df4414f8c1b151d657334366efd247d00635667f6278ff85f82179
58
2020-05-15 06:44:01
10
497ff4d9f4b8b24d7aaf37b06b53ea7efe753b6581c5e9b0d982e63ec7bca72f
59
2020-05-10 13:45:29
11
7d19e0e8e3920366a22460a92245b8d3983be1d361a8248ab2c8c5f7f53c7fb4
59
2020-05-09 23:05:27
3
485fcc6c4a64bc63a7a9312ae92f69c4123aec81fb9d637f3201111798f92dab
73
2020-05-02 02:42:59
10
5b07014032ff99616f49b08af009ba5a74d7abe2cc49903b5dbd80fff5271678
58
2020-04-24 01:59:27
28
bff921b96bd5541e5cd393684f4f2626b6b0f6a606ff7c3a2cdef878b2c16eda
67
2020-04-23 20:50:34
29
4d120187bb417b65c553c181fc17520ac7b1912ef9f458efb5b5e9cb682cf79c
70
2020-04-19 01:15:18
9
5efae2d2cb84adbc68ef14dc326735d5a357eefb4be6009f468066a4645f2b38
55
2020-04-17 17:56:11
49
6b5a437399030a758f4fbac6d20eaa76ca917c11737b30fd527c53491d9ac579
72
2020-04-17 14:58:28
21
6c80375edb554b570e2b4a5bc5e3236d2eeb0a9bf7319b7cd976aeeba2a3077e
72
2020-04-17 14:11:25
56
26994b554e975b3f8c681c545cae405c33a4b2593b502cea7725caa05262dd37
71
2020-04-15 08:57:27
57
44ac40c74480d247d659e58b14ecc95a425487d887ecf06522ead0870f424ea6
73
2020-04-15 08:47:02
57
f69dfd7941828bfcacc5a66fe92751dd94b6e27c63436a316661fd3f3bc972d8
72
2020-04-15 08:01:16
58
8d6ebc86e25c08e96682dc44bdcba72a0983331480907ade65a78e3dea8d004d
73
2020-04-15 07:52:09
58
51501cd53da8d00a9f92b24901e198eaff88d36e0e81e057607ef05c8c43a358
73
2020-04-15 02:27:12
47
2b6aff6af6092a87cb7abbbe8e03f233426dd354ef0d25eb2be8791e373bd8bc
62
2020-04-14 12:19:36
31
71d4628830e931068fbc7edada005fcf1b7938de8cd57261a77d1e1734512aca
71
2020-04-14 08:59:48
58
9ab1069ac9d067b67ce43c9dd511f51da205079c8a2ecfce6d8d1bd7f429ea0c
72
2020-04-11 12:08:01
39
fec395c46b6cf84a733e9d407133d67adbf649750cefed955a377639d2fd2965
69
2020-04-11 00:01:49
57
66899b1733dd6ec326e5aa0e5af6630f0c187dc99fc10e991ef4886b3b6b5eb1
73
2020-04-06 20:08:47
56
bc2a9d97fdb694d498a167012ecf1c69d877689d0b46d52661b0b4d8cb01c29d
73
2020-04-06 14:40:43
59
ef99e792e4cd56d866ebc4e60723e7500f36586d9df7e45a629975495d94b357
73
2020-04-05 21:15:58
54
81ce35e0b2853f94e1a9238b0a42ead4051ded6ec3f2ab866ba6ada3d0244ed4
70
2020-04-05 14:45:31
56
2ce9e996bae6bfdb208f229bcea0db910ff335443c5cf3191d84c73fcbf8e806
72
2020-04-05 14:44:46
10
b5df67779ca663eff8255402880757ff6e5c76258e7535357bf7bab8807cfcf9
58
2020-04-04 20:56:33
57
b8f2e59e1ff93b0eebf838ea32f265d5c61248af8eb3f2bec28a91628bffd2a4
73
2020-04-03 15:45:32
30
20a8a9086da883c09c1bd146c80d5e4fedee991c8bc79aa6cc0df510b27aae83
70
2020-04-03 07:35:14
32
29804f44362f87d1cc3641dccb8c8e48bd1642616fb4fd2045ae2b3e2bcda27f
69
2020-04-01 23:24:43
23
bed8c0161b5e7cc1f536eb4b3ebbdc9d3cc0ede5b3ed68b33a1fecc1c8d37fc7
71
2020-04-01 23:22:49
40
39cdb74f93658f65ca6bd63c1db8764e8fa21f20129388360354fd87f17676f0
70
2020-04-01 01:07:34
31
82dd4f7a15ff434cee224ed8b33b06ed23347e218c4f6d1db0e36b5ac8c04834
69
2020-03-31 09:31:37
57
c281ff8531a60130b2fa26b240de25a9aef0b1954f05d8c890e80521c977a35f
73
2020-03-30 12:07:04
3
db16edae1b5969cde34c29634875c0e9a4c49bfad4ad50315cdcc381a2e6a2f8
58
2020-03-30 07:18:35
3
21ffdf403b76a5b516304ba9f1213bda150d93ae7497fe66094d0368b3c679ce
59
2020-03-30 00:52:46
57
aa8f6a6e4e264adbc2a190b8db233fc1d451cbda0e0163ac763d0c663eeb548b
72
2020-03-28 05:19:43
3
b8683b644b82ad4a23c98079b248a1b47d268cc66b81edcebbf8394b02544c24
59
2020-03-27 21:52:42
39
4baa0b3383f848a3ac643f23ce18500910a92a149995a0627a5a915212193c51
72
2020-03-21 17:13:05
3
8344882006326d8855dd09fe0408c9b78a11aa232ebcd80d03520d530b7fcf6e
59
2020-03-17 21:29:46
0
fb8605bf764114c8f80766a5db12cbecf56577683dbae01ec78d878a9301a66e
59
2020-03-15 02:07:38
59
3b3312fe546fa85625f10c172e47018497a7746a64252e80cd030f659d6df9b6
73
2020-03-14 17:35:08
4
cd657946fefbe67414654251ffa472626404bb4e830097b2b225cd1f8c957dd9
58
2020-03-11 16:24:12
40
e6bdeae21f873a739645c0f4cc86c91432ea1d2c229aac9af135f691482fdc9b
71
2020-03-11 16:07:03
4
592eb08cd7ff058c02105b788cf0184959a35883ed6ae1ce1caaf35df8a60d50
71
2020-03-11 15:41:39
9
d15062476cb75ed48e3bb9cd5ebdff02fd7dc020e0a043667bbba4580a01f82f
72
2020-03-09 19:44:06
3
a48c01c88fd203ef36efdf48c8c5c6013116cd718f7660bc00d0a9d91b94ddf3
71
2020-03-09 19:08:10
56
e37009b5197c315e144b930c18bc4b929abb81ef54cacbd5e588691d09fb6151
71
2020-03-08 10:32:14
57
599afadf70af0ce489cbfd39fd0404354c0af85e7d319b273c5b76eb749cb8fa
72
2020-03-07 11:56:06
58
13240d8e1b551e2eb40b0d6132a516391e66cae2236dc305a2fb6132dc683d49
73
2020-03-05 19:30:09
56
cf896da23ffba1caabdef56a89da6bf8885dfbf1f712836240c0de24f7aea93a
71
2020-02-25 03:58:11
36
65d29715d905ef5ac708a31b4e2d796a7782bf06579c005ae2fa6855920abc37
69
2020-02-24 23:11:34
37
e009fcbdd65aec859f46fd1df2125a54f576cf911320d1466eab1eedca2d49f6
69
2020-02-24 05:57:42
37
6ad8147246e38373e88df519a50cf7519057437500d726fb917d6aea23ea7d36
69
2020-02-24 05:57:07
42
e0aea52c33e6ae0c0ba163ad450cbdb79202049b551bf95b5ebfcd6857e01d4b
71
2020-02-22 19:28:23
35
874ad08ec387fe79bf61045da552ffcd93f5a8a8678f89306d5b107b13fda23e
69
2020-02-21 16:30:36
10
ad8836347d4fb2b92e2f90faafc10c63d93321aabce0e8f520f8dfee00f56736
55
2020-02-21 16:20:14
9
2552f6fb90b08dd9e4de1bc63a6ea078e98a19349a5bd05a53c0b7749b02b200
73
2020-02-18 23:08:04
30
ec37dfbd0e8a34e5654e5320fd1292a1c80941f1d77bcb26594e893802557260
70
2020-02-18 20:05:06
33
5c8d753386a2470c7362456cd039678947f0349ab930bd5d12ec09e4fce02dc3
70
2020-02-18 18:34:10
24
71175bb3eda64fba4b323b9c0ff48e2f1a1f782b6bdb30da6a6abc7fbb009b06
72
2020-02-16 00:33:14
32
0139a1052f3040c268a4241d48bf39e5e1e042a1059f17dabcd0de2b03c58ff2
70
2020-02-14 13:15:06
44
ee25805b05970c8a0b054ca62008db46fd9faaccdaddd08db95ffd7e9ca4a54a
73
2020-02-13 12:52:34
22
d00a94cd9b961246f84935d709c2182e68c308304cc49e2ae57e587e013d1d33
69
2020-02-12 13:37:34
24
386fb415804011b4fdbd93fba683cf4bd59bc99cccf2f342f0d8b25e125acdec
67
2020-02-05 20:57:23
20
c69200562c0505f50b12bcdd7ebed851ba51de09b653f3fd097cceb9c2c985aa
69
2020-02-04 16:07:42
10
b248f0975fb9c4a3daa6c076bf64527fc2c85f86e9f1215b6b0ab5e36ea3a2cb
58
2020-02-03 07:21:05
55
8431fb6a83c528776fb7e8fc5b86478b74b10e1ea14bc1dcb5eb10178bc29352
71
2020-02-01 01:43:04
30
ad2ae4c9ff12b862bb237b54237dc72151c9c6257c0eb43c988498429c514299
72
2020-01-31 23:33:08
10
7cb3bff5e057ce0a04b6ba873be7ea6c0c5abce97d1202fadc5232ab868a9c40
56
2020-01-28 22:54:34
10
4881505d803a1e5db08a63f7430c0f05ac2845cb0e3f84f6773d901ea97b1609
56
2020-01-28 22:53:06
24
a5858623d433f7d4628431f065269d1a1e861cfa5e92cc9623abe576bca256e5
69
2020-01-28 12:42:05
28
8551540cf15a5536591d12095b787403206473160258b8df94c6b2e8f8c61def
69
2020-01-24 20:37:38
23
a1970722ce8de10b2560f8ee48dd561734147b3b029f05d36bb2328d67323d27
68
2020-01-22 20:09:06
11
4bf7669bba71c5743b23796a00e0ee889f61f9b132181dd41dfc5a8bac1e8577
57
2020-01-07 11:06:39
5
d3a4f3b0613393c996b64379882a0d0e289858c79a1e2adb8b52f03ce8880d30
70
2020-01-07 11:06:37
36
e7dffaab132d1e5e10d1660e790a9ea7f1260721bccd87086306f4b0f1630473
71
2020-01-07 11:06:04
50
c124227f71d605988515ecf4e16f96683ea2530eb1426396b28e39b033241258
72
2020-01-01 12:28:06
3
b876b6ba14dc4f833fc04c6b775e80d89727e0d04133d460e7a87da032d28a15
58
2020-01-01 11:23:15
10
a966b10f80c9306aa4254cdfd24a0d1a7678cb155657f871af2e699f52a6f231
57
2019-12-30 11:35:13
33
ab493f02bdee316f5e41a7797bb26072f418ae313c760587e0bdd621997da3f4
71
2019-12-23 08:33:34
54
ecf0542d6a9e6a0b80f5396e6625b1f56708f6192385cbb39233fce45fd51399
71
2019-12-12 09:34:39
52
9430b0c01596a4c56a23f298123e65bffc05fdca0dbab4502b8f5f0a23e40db6
68
2019-12-12 09:22:42
2
24a5d17d38899091118f5a148b4a9004d7285a5049fe24f3b199535145801d62
58
2019-12-11 02:31:38
2
fa12e7fd9573966d0c5014a81a8730ca01f7023d660194b5870e5f6d6195afd2
58
2019-12-10 21:06:35

Rule Matches per Month (last 24 months)