HKTL_Nim_Shellcode_Loaders_Jul22_1

Rule Info

Name
HKTL_Nim_Shellcode_Loaders_Jul22_1
Description
Detects unknown Nim based Shellcode loaders
Date
2022-07-18
Score
80
Tags
['FILE', 'EXE', 'HKTL']
Minimum Yara
1.7
Author
Florian Roth
Av Ratio
14.66
Rule Hash
86c534084f843dc65cfc0918a583eab1
Reference
Internal Research
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
32
Suspicious (< 10 engines)
47
Clean (0 engines)
5

Rule Matches

Hash
Total
Timestamp
Positives
VT
80dd885f694f6e8f51f9f56860b9a6a2ae0009aabb4a7da52947af7db7f8df48
71
2022-08-18 17:29:05
18
09de32dd363908ef7a25f3c6e873e6801e4fc710227d9ced508f4631d802290b
70
2022-08-18 14:16:07
9
bd34045f91d9188ba4f86e5ac4a1324e006661ef047ca0a4715de97915b3520d
70
2022-08-18 14:14:01
9
6b8c72fe23596b782be027e570ca1094017ab2c556ecf031f7fcdd4601c9febf
70
2022-08-18 14:11:54
10
5d0d8e71361c7fbfa3d94bdb0f254cce41325ec3df0c1daea04f2e402c93ef33
70
2022-08-18 14:11:54
9
0d2a71dd5d36ccf55a325a31547494904a4d1c7d6d3d31449786b23d77339c57
70
2022-08-18 14:00:16
15
a3aeb3a12d15f0845710ab6580e69353eba14e8cab54bf04cddbdbf55d2f9b8e
70
2022-08-18 13:59:14
16
c7e817b95b12b6276c98f6a5c342174e41df3cb327063d956df71b9266b9cc3f
70
2022-08-17 12:46:44
8
d783813aa3259f2e6f06d177e535c5b64453f4003a188d3c050167bbc1769133
70
2022-08-17 06:21:27
5
278680d48e3930a1a5d8bf078e5b3e0ae1bcb32298867a03d90fa3c732f4d5e7
70
2022-08-16 06:22:16
5
e4419e728751f435cd1ec3fbb684c31bf08c0508a3cb41110b29f806fc6d8b1c
69
2022-08-16 04:17:21
3
0c2a4763653eb9578c046c9f22e9c7cb537f870795a3efa86daeea09e06fab6b
69
2022-08-16 04:15:10
3
eec47ad8cfe2731b1a1729087a373ebb4bfd706ffff1290f5360f0cc53ac5067
69
2022-08-16 04:13:00
4
ee214e29c070d7e476efc108168854d992d26df3156ecb4c4ceac5a201db2759
70
2022-08-15 13:52:24
8
c3b6663620d332f93d03b9f801bf43f81859f820323287c9898a1d1d825975e1
70
2022-08-15 12:04:44
6
da13b81be277c3f650f0e0f7fe3d3de4ac139b347aca7f6ad45f054f960f7a85
71
2022-08-15 11:40:16
6
5b9b31f3e9d16cb25b6726bd445b9ca0ed8efa45ef022846721b43f31fca3ff3
69
2022-08-15 10:52:22
14
45ea3ed8a72898994aa39ee8e68ffd32aa2e92360445abb2ded12f54d66f93fa
71
2022-08-15 05:08:36
10
6e9828bd737d20f85bb9d3046864a516a7d7b292fe3a4495445328c2d0c77d5e
71
2022-08-14 04:50:46
19
787114a3db5c0c458ce6a6d0fa571c5d28361dbbed67bedb3a1f89b8302b132e
72
2022-08-11 08:01:31
24
090fc341e441dff4b2ffc0959126b985679e834cb4c13de877dffd8165864be5
70
2022-08-10 09:47:28
16
8c5ba2266f5143bd2ff13fc8caf3ea9f13d7d0a052f36313c0207e0eca56755a
70
2022-08-10 09:46:24
7
6d7746ad7a1b559a7f54f03797042ded26f16b3a20fd3b39ffd9030382601985
70
2022-08-10 09:44:19
11
ae9486af99f612f8863b53af977fe026c133744c24a64dfcf1f9ba3abcbc4c73
70
2022-08-10 09:41:06
6
c14d6ba4b2ea624e348a53620fc80a79803fb4e5ff1cc80d6e7325bf5f3cf729
71
2022-08-10 07:16:31
28
765334554a3b653c9ff1563b7ad76a648b149bbbb0cbbe1170ce46f98b4c57c6
70
2022-08-09 20:24:47
10
dcde4c5ab038ed858dadf5dec0d136441ad81890115b571ef34a6bfca4afd5b1
71
2022-08-08 19:34:59
19
e1612c0c87eb09677977f60263994959f36b19104bc7f42b171f174ed93a562a
69
2022-08-07 00:00:05
4
b64ffc3a6814be11b168662256dba92bea9f28f63c16b655852a888a63eee94b
70
2022-08-05 18:12:30
6
8b70270423a892a751d62bd365571d717fd9a42f2e12537bda7e67c373e6794a
70
2022-08-02 14:43:49
12
e979af840e22ecebb28e3748e936d8c98bf60138f484755c7cd10dcd23096db7
71
2022-08-02 14:43:49
17
8282d07b50f782d6b999ad7a84e00904ec72c77017855096c4567b2e632bc2c4
71
2022-08-02 07:09:47
12
d09c83916fd3e3f89bb52fcf7708890b4580133d27c9d8cca240ce124307d3c2
71
2022-08-02 06:48:30
17
a9fbe1295f4c08bad27bbdd67fc3ae3dfbfff1ef76cd42117247484e34f6cead
70
2022-08-01 22:39:43
14
3d68c562ebce78e2d19d9564d0cfe9ef5734147d668b97a702fddc74bb983034
70
2022-08-01 22:36:19
6
6605ebb5828d550749e1275741d2c0d593e6466d4ebcb0e461507b142f08d38b
70
2022-08-01 18:54:40
17
c02a03b365ed051bf529af7fd27eacdd98a1dcfb5deee2fd811a35dfd4bad7be
71
2022-08-01 05:18:13
8
a3bef3ac56e0b82d109aa3bcb2a5dfdeec5aef9fe0e16a15a96d589408ab162b
69
2022-07-31 20:39:57
4
172837187bb7d127dffca1495775ed53da9adaef81d91dd48a331953297e22a7
69
2022-07-31 20:35:19
4
c57aecdcc03d2f8e0e8c0f45d46e80f1be6882e579508a080e5ee9c6bee14de1
70
2022-07-29 00:56:20
4
df47f27823d2aafca34c2d9ecb70de28c5adabed809fac942b585e08cdb1cead
71
2022-07-29 00:36:17
8
76838f65596c3d715dbc69fcc73242e784e63a926c2049b0ab4f637c7e68e8aa
71
2022-07-29 00:35:15
9
ea2229c381c59daf4a8e0fa4b8f7419ca07fc75c8600956b713a1fa75a7d56d6
70
2022-07-29 00:32:03
4
a1354d5bab472c0ca1b75c97a2e9f00c64bd7422be20bcc84e16fd93eaa5c9f7
70
2022-07-28 08:30:25
13
409175672bfc98a8e364b55e3ea800a9ba24b4e93a5510e28446cc87fc233b43
70
2022-07-28 05:42:46
5
f03fd065416181ea766518a9a9b91cc52e7821273ea3ed87881ef68b4cdf0b8b
71
2022-07-27 00:33:48
7
54061ab95fd052c693d17f9dbd701b220290f09b8bf848193520e04495d186f0
60
2022-07-26 21:09:22
0
c3c6f7857de52ac0a1519932b99a2eb59b4359ce2c1d7147ee3153b3410938f2
70
2022-07-26 21:08:14
33
f52323de622bfab91bbc12f2fb0a442d0889b2b2beb8ceee9dcda949102e184c
71
2022-07-26 14:36:08
43
bf2e2648accc2e47d4c4299777a292a4ffd3dd6f4ba8d4fbe25f0657268aee64
70
2022-07-26 02:57:32
5
5a4839ccfb581f6124bbecad42b247728fb57929ed378f8ebf82c71cced0a155
70
2022-07-26 02:55:21
6
7445362f6fe08c027c6a762955ecfd20bcbf77e8f3e1cf9e71a55ba35291e14d
60
2022-07-25 16:33:18
0
c1d8ff22d32074e1484a1a57bf1334f28075f07e311245f6f2d3e5c67d0e4bbe
70
2022-07-25 12:39:28
4
3b8d3c7daf4ad8b807d123a3163a1a45560246b55cd5e09aa25fb24b03c40d8f
69
2022-07-25 12:28:45
0
cfcf528a2cbc66720040dbfc80896072e152aff8380c9a7a616eb5dc81e6b2b4
69
2022-07-25 12:24:16
2
037ba2ce1bdd6545a5eafd21b0a21ea65e540bc1df24f03b12da0eb1f2fe1c21
70
2022-07-25 09:19:08
4
a088924aedc9747acfd2dde2db1694d40eca0854b02e97927e4632f02a635eb5
71
2022-07-25 09:18:06
36
188f98f8cc0a7d058db0d814bb4e16ba86e45df895d2ab2757b1af1f09fa1ffa
70
2022-07-25 09:03:39
45
6f718f8eec665ed49e14474cfbb7776f96bd234946408265bbc4d743d35bd54a
70
2022-07-25 08:19:26
12
5487657f2292c5db8bf25c21457b5e618a93b35d3ba529a4342a7887724237c0
70
2022-07-24 16:53:48
0
9c7bde62480183adc0edac588dab22ed8bb1aa46327a93c972522538b0d81d69
70
2022-07-24 06:58:40
4
b44d10fb163123122bb39d091cf375a0940e021b798f141a4601df4ec8ed20c5
71
2022-07-23 23:27:53
20
659069446f59cc0493a0e9d1dcaae358a5a0e056730b156f8b05e676f536e8d0
70
2022-07-23 19:55:44
0
348aaf6597199576d7404c6750c9497c90e1385d14dfe308e00a6fd3f2dfe399
70
2022-07-23 17:05:32
1
c936c041816aa92c309bb4ef31caed4bb16872de6dc2093d4bcdc37455c01c2a
70
2022-07-23 16:03:01
5
3e182e40b280bb2e29224a4c0badb5e581a19c468d759c68fa1f2e3aba63f96f
70
2022-07-23 03:13:07
4
8ceb54296e6d9196abd4ecdc95d507406d378fd2cc007dd68571333b36945ab5
71
2022-07-22 23:00:31
10
dff88f61d5fa11eb267ed24807a1b034ba0acb63a9ed2991eedca9cf87a616e3
69
2022-07-22 19:29:21
2
71c213a594984d8ae3dc76586b2e6055a835f8dec8a6f6b3233ae68b78614d83
71
2022-07-22 18:15:11
48
156d922c433512efb424a95b7e34f80359fc801c4fb80d49c4c16c720e2b3585
65
2022-07-22 02:36:53
4
de2ae0b7694cf8e14130066f809b9d6491ef520a25cf871c520d86d058cf4c6c
69
2022-07-22 00:41:45
6
f86fb7cf3523bf6af7d5cef34e5e64bd9e5b21caa9a726e706c1b4a54d910930
68
2022-07-21 13:36:02
1
cc74a93a18d0f537cf3a16675f5473ed399654aca2f88a10940edd9db6660ac3
69
2022-07-21 03:53:34
4
a14eacedbe73f329ee8aaf774a07d4774c30d8dce75f9aa39c65bba72213744b
69
2022-07-21 03:00:14
5
33f67a806501a60726d43f956ae30cc14782ddd173ae147d80a2889aeb02d1fc
69
2022-07-21 02:58:08
4
cf7649e015bb3113a5b09c2ede74a9256d65b992173df967248b28515fc88764
62
2022-07-21 02:31:06
31
371801cc0ab72cf29de2e43133328eaf250552548ecde11aa5998d416d27221a
70
2022-07-20 22:41:44
17
1e9df9853f42dab4e2f151183eb2f866da6faae0882dbd5c3e46a3ed7f44d805
70
2022-07-20 22:37:23
12
d2dd62d7daccd71f620d88b08bfa4821fc3f5995b7670687e7e59da7f4fd9024
68
2022-07-20 21:31:39
1
648a6e594e47ed6add134ac2b4bf752ae3143270a3c5e7be92bd9affd73acc93
69
2022-07-20 21:25:04
1
63f4851b32570fb4b4bb14c085bffdbcf1b316203c40dc9b9a0670ec62c645d7
69
2022-07-20 21:17:35
2
8f3c52f010443287a34394e0aa6862bc9e5ef9fffd279c48ea9c7079d346e720
70
2022-07-20 21:11:07
16
d0b95416ff9be119fbeacdfd37b4bd060ccda1df7b854067d103fb5106e80eab
69
2022-07-20 19:27:07
3
a44f509a8f7f572c88a1a8b39c5c770e1bf55f648ae78bb014cb76870b489ecb
69
2022-07-20 19:20:24
2

Rule Matches per Month (last 24 months)