HKTL_Go_Encoded_Payloads_Generic_Mar21_1

Rule Info

Name
HKTL_Go_Encoded_Payloads_Generic_Mar21_1
Author
Florian Roth
Description
Detects with file characteristics found in encoded Golang payloads as produced by Ebowla framework
Score
75
Reference
Internal Research
Date
2021-03-01
Minimum Yara
3.0.0
Rule Hash
cd5f07ccc9b17e32ac67d07d68176da9
Tags
['FILE', 'HKTL', 'GEN', 'EXE']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
69
Suspicious (< 10 engines)
21
Clean (0 engines)
0

Rule Matches

Timestamp
Positives
Total
Hash
VT
2023-04-17 02:09:20
37
70
0010f7b671b9f603eea85d7bccff93cb6b72d4055cc0c5306739065e08890c89
2023-02-11 09:16:22
35
71
c5a0c8b8fb9c066a7c0c4e59b8d5bf7b8c62435b6da558b4fbf64cd887c024a6
2023-02-10 09:21:47
14
63
6fc3f2f9a1104031623d9a62bcf7744e8b3b549cb0c12beaa127b022f0474403
2023-02-10 09:21:41
38
70
880d4209f49bb492ddf7bfaf656b23962cfa1132dcf73cee29354715b6ad7263
2023-02-10 09:19:13
32
65
6bfb702fc1016e1819cfb2fb93b908877da42f20a241fc7a889850bf500dec00
2023-02-10 09:19:06
32
69
4264c325fd80abeaf80003f1b731c7f89657111535c2125fdc6a33563ac31a29
2023-02-10 09:19:03
19
70
3be17eac5f8b9d1b08a5cd37191d1510dbb1a1f4308a9182ca813f39e0ba8317
2023-02-10 09:19:03
41
69
2cdb39cb92bfdfd87ac92aa3bf79ed0962f609341fa49545122cf1e59e58bddb
2023-02-10 09:19:00
14
63
5d30b5952a8ab01c12e12f23de6f359b77dbbdf090fe7aa2492003a84fbdd1a6
2023-02-10 09:16:37
38
71
3dafc92097723bed31b64ebea4fe00ecdf1f14bd2cf8f792b0c5ed0344f97e25
2023-02-10 01:19:44
33
71
d32b651bbd4b5d20bb05a61e23447b99ff5ca64ad2b5c36b9d8858912a759206
2023-02-10 01:19:43
37
71
c31c826cd9d72520c31ab492726baca8e9aee5c94a59a4abc1af55dfbbd72a80
2023-02-10 01:19:39
36
71
d14628efef4a52171da902859583843c1bdfbc26aee9f951120a5910502d539a
2023-02-10 01:19:32
35
70
cef45544c0ba0e08d05622d937cf4ffcd232745322cb1334d2cf2f4f874e432c
2023-02-10 01:19:32
34
70
d04ac05585e9dbd3c6a7e0be8b3c031509b6f95ed67ae320ed9668c87edef0c7
2023-02-10 01:18:17
32
68
c23453960712a213facc5b222beaa0f8979ca2c0a41d65abb72e7971c9f358f2
2023-02-10 01:13:10
37
71
123e8b5c0c6ac25a4fff347c1874727e86893e904c377ec9eea9e5e5535383de
2023-02-10 01:13:08
34
70
193b8edc010d3199bc0a143f11c757d320e5fdea6ebd4fce836ce99b3c65a268
2023-02-10 01:11:15
13
66
07e9e4c572b060b9d2ed4cc05615dcc60bd6e7293e24240206614604d606ee46
2023-02-10 01:08:05
41
70
014009e300d518a1ebe4e8358747328ec555a6d5bc174eccb013b9670a2db2df
2022-12-16 20:12:25
22
71
fbe55d4152a64520a32682b390bb149a4a0dc51f7bf6d7e19d4acfbdf0588bd2
2022-05-10 09:21:48
12
68
acf1d90c399b47252b98742ffba2bfd758d2935cecc868a8e611ea42e7a7714c
2022-02-25 13:31:50
20
61
6aab6324b86122715ef182e12e156c085749b7cb9cc1d808e5d5f63e4d3651ba
2022-02-09 07:35:37
16
68
b32a350328c38f088b6bbae7fd07bc9e0be7ddf733d8b30a9ae817c3625f2432
2022-01-16 02:34:25
22
65
3f75cd387654460ec202c4ce28ba3921fdec78b987241f0830cfd7b7816951ad
2022-01-13 11:28:30
8
66
6a1d356e89bf02512690a1d8ce6bd6e3a95f74eb9664ee276c2b048dbdceb917
2021-12-24 02:05:47
9
66
b7a9bbcda2b9e0706739bf4356676e055390e7ff299d298f073077baf9e2a642
2021-12-02 21:09:11
5
66
0be9a145762b45d0ce30a7076a3d69a84ad38197c3cffa18f684b7f7355435cb
2021-11-30 20:05:52
6
66
4d9805ba7cea549f59f3c97958642aa8748921a683f347b77212560399d8281f
2021-11-26 04:51:09
12
66
3c3d131747be36e13a0580498a0013cc6e0f3fc706f211c2f101d87be2a79814
2021-11-09 08:53:08
5
60
8fb113d76199dfb19b29782b3576d80dbee26c8f34019b971a3a0eaba449539a
2021-10-13 16:57:00
7
66
3f0359868775fe5f4fd77cb2e7c91f20996888cf93b1b56a1d5a9f3d596e49e3
2021-10-06 13:35:49
20
66
1ad50cfe82b42f92a5b06d664b7d11a46f91aa990989fde9cabf45e9f8195ba9
2021-10-04 14:48:42
19
67
cefff8db5d0aea6c6cc8b9edf14aa30d47fb2f4f2f4c0e894f93d547d750a843
2021-10-02 15:46:14
19
65
189ccfeb206832897d6392cad0f0270b1e444e411322690429dffba0a68c44a3
2021-09-29 12:38:17
6
67
54b24050f5fe2430e7fb2ed513a60d787e3ffd806a404cf862cade190a181f1e
2021-08-21 10:31:36
2
67
9bef2e11a96b47e27c2b91570be812f3b3ac9e8912ad2c40411d25f52b4c6998
2021-08-21 07:20:54
4
68
10cb2ac32ffc51c55664a8ef75d076c717eaf1e5d4700eceb20f53eb281de83b
2021-08-20 01:49:46
19
64
096fa6c1777e0aa4bc42307b012c44d569144e521e925d66ceac475541800916
2021-08-14 02:59:59
38
70
d34759b1cf6ee5223a71ab6c344c383a35d8317962e4f12bed4e7c0071fbe353
2021-08-05 07:02:48
10
69
cc947219963f7073bf1fb79f14de11a80e24a6c8b26bab208fffb76370b0d819
2021-08-03 01:54:49
19
69
d27c2b6680f5ed52580b09eaf0340676620dab7d19afa2e3de6ccaf5cb8c3acb
2021-07-27 04:39:26
20
69
afefb40f0754390169cb1aa0bd03481c6a425a351d309adc8a6fb3f7e2032387
2021-07-27 03:16:46
8
68
e593613a87e66f9827e23eec55e353200fe5b67c4a44197f50c8ab36bae9f6fa
2021-07-27 02:43:08
8
68
592f41b96853a81e60c776a88427fbefadf270581fd2a4ef313fd4af2a27670f
2021-07-24 06:51:30
38
67
c2817ef155b479f5e5f0cabee5345e3d035a28954384a2d09294c93d82d83b25
2021-07-20 13:26:03
12
68
f986fe6e26e7a0da3053d6d3b036601986ff91052ea9cc4e88f6cb7ed700b4f3
2021-07-11 06:22:25
28
70
c56e0a6b456e23a01e4b0bac7eb08914c29bc037c772b59006dda3eb80ca2707
2021-07-09 16:49:52
19
69
910fbbcff067246d8cffd76587d8ad8ddd18384f08b6f2a948dbaa6429303e5e
2021-06-29 00:29:36
17
69
8dafcb680ceb0e350531c5878e9605354fadb46e2b13814fc4db4e7ada52141f
2021-06-28 01:21:58
32
70
df2a01f5350a27088e24fb7e770f3960569e6022991127b22d91316b140c13a4
2021-06-23 12:47:46
19
69
e005c3ac8e16c75d9a203a737f092c2344ee0df6deb0148f66dd8ed70bd97ebd
2021-06-14 12:26:50
16
67
71bd77196e9d6d53205556833e5c338d394fe81de0107b16531bd335b266ffc9
2021-06-11 01:26:53
8
69
86518322a33781a2cc04f4fc9b61b6c6e50165823f3280e97e3fbce63faf34e2
2021-06-06 05:09:54
32
70
4dd795c3375631fb0298500b3d2e08dbf7e4d49ea44f96df3af95539ada88441
2021-06-02 20:41:28
9
67
c5b5c495702103b2c4a9e323a279f3102cc6195462c865e96ac3df138e3ab0ef
2021-05-20 18:37:01
10
68
f22df7502b4bfa7d486181d04387994ad3b349f771ea8f964b38869c3d3bfead
2021-04-29 11:09:22
29
68
59ebc62e146cc437c7ad47d42ed725b285b135353e9ca93509ad87ddb1458928
2021-04-24 19:20:19
35
70
eda5c4767cf590da3d35f89ed214c17cc38135824243bb8526b4aa06dce167c7
2021-04-05 22:07:19
10
69
db6de3cf29a3884f4daddb068ad4c54d937adbc12542265fdd18f2cd6c6e79cb
2021-04-04 17:26:04
5
68
1550a2557b0028e1f8a2f2b896efedbbcfc575f04ff8143a0ae7c462c3f26f7b
2021-04-04 17:22:55
17
69
15097e2068c5cdbe94e5580546b5c4fae2bc2ab2b9aba6f3752698fdeba034b5
2021-04-04 17:15:35
17
69
ed1cc9fd82ddd89895f60142bf59d951f42e501aeb0ae9d8e54dd831e5331ea3
2021-04-04 17:14:33
19
69
34f8699d53e9f131a3d1528d9ab1450fadc05a4a4cee7c2bd15a8747914cdc3d
2021-04-04 17:11:25
8
68
e949633cc6c3a370b4d83dd5844251997ff75a46d595e2f0585e350cb779b1f4
2021-04-04 16:50:21
17
66
01c314deda091230a8d3ea58fc40ed941cb222e1e7152802a51c733831979cad
2021-04-04 16:44:06
18
69
f2f511ed85f9e45e02ff1f3cf5f6fcacdc176ad9c6ce0e91ccc0af06d8621713
2021-04-04 16:41:59
17
69
925dfd7d28c2c44b9edbfbd7ebe6c7113e71e5984596bf9e63a262fd230ee1bc
2021-04-04 16:33:37
17
69
e70916da08db36b92125c150e072daff655b6397119a9fd164f04f108ef15863
2021-04-04 16:30:29
18
69
29f26532475bd4723ba9d3167d0b442948899d8d2247419296af802d0243b0b3
2021-04-04 16:22:07
14
69
b0816543bc685f497b4e32a6b85457315653ad4d3b6c54baaf19f36c7c4ca459
2021-04-04 16:19:57
14
69
3b978984ce78264042493db5789ececec4ef3b987530baf6250351deb54af4d1
2021-04-04 16:13:34
14
69
c8ddece6dfa96acb417b55145aed480b47b0543298c3470573b38fc8d6c662b2
2021-04-03 20:14:09
15
69
36ee21e87014082dd3879dec398ba1d2f5434600b34f5579a7a7b296591cd791
2021-04-03 19:57:47
7
68
02026e8d22dedd108304bdb05ac6db984e82ca2d1ce136c3ede79a78c00e2d6e
2021-04-02 08:55:51
9
68
43fa4ef956c80edd420885a0bbc9f0760b514545f936618fe1300c6437f37eb9
2021-04-02 01:25:04
6
67
67f7ba743f3e2346b8d4bed7f29d162df37ebd9c1730a50977f3ac120e87e404
2021-03-29 22:59:48
5
69
2ee51e02d102d25737e5f48afd589080ed01b46e07df7bf076a4b413a20ca03c
2021-03-28 03:48:06
19
69
b29f427614c40499d9e891b7c6362fc50ebeb6f0f9806c1350add3f44f482ca5
2021-03-20 14:42:45
29
70
4f60b052ea739c593579675fd143d98d9bdc5515936cfa9390e5bba98adc69a8
2021-03-20 04:20:47
28
67
a8c369ed033546d5dd84cc269bb1b443b4be0d17513332c43fe2328558980d6b
2021-03-17 05:59:09
18
68
7d5c40a1fd36e5dcd71f4055d6cf852966fdca2e2996fe77b8e7686be9b4e526
2021-03-16 15:18:31
17
68
480b6cd1b460268b8dac2e58b9d38ab1187f67e352f427b5bfc9e1f5fa4ea981
2021-03-16 08:56:27
26
68
2be0c186e352079e7a4f95e0f4f863d0598e7c1e20226eba74f8469333ea5c45
2021-03-16 08:15:50
22
65
eeb4a679c50620d859ea45f5bd02fa37a24f84787cad17572f4648b90bb867b7
2021-03-15 17:38:19
18
68
a9388ba87bebbe6f003c7d73f9c3c02cb288e274c85d55ac4c44c7241b5f8aab
2021-03-12 21:20:33
5
69
ca3e21e8bd6fddc4e9a4f713db61a9f79ca93a89b9096e7224b7989c5319906b
2021-03-12 20:59:02
10
68
e363c1332ff43a8421b64fe4f50b14182ec44cdaeb3905ad366265dd78918496
2021-03-04 15:26:51
7
70
f820d4688cca7c9873e4de94ba705a5eaf6628ada3c8d0c282e5adf0a96ab73f
2021-03-03 22:34:32
21
70
6b9ffbb8c983c56649b50feaaff2a7588d833b3b103d082c145e3886b5461e06

Rule Matches per Month (last 24 months)