HKTL_PUA_ShadowSocks_Simplified_Chinese_Jul21

Rule Info

Required Modules
[]
Date
2021-07-19
Rule Hash
12dbb9e55fb5374970ec1c388814d758
Name
HKTL_PUA_ShadowSocks_Simplified_Chinese_Jul21
Author
Florian Roth
Tags
['EXE', 'FILE', 'HKTL', 'T1090', 'CHINA']
Minimum Yara
1.7
Score
65
Av Ratio
9.58
Description
Detects ShadowSocks (PUA) tool mentioned in US-CERT alert AA21-200A on APT41 activity

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
17
Suspicious (< 10 engines)
99
Clean (0 engines)
7

Rule Matches

Timestamp
Total
Positives
Hash
VT
2021-10-20 15:09:44
66
2
0dab97e91b58d291a82362a03294444256cd14380496736c6a6c90ce265adf32
2021-10-18 16:59:44
62
1
b799aa41c10d922032f3415cf75f848660c83dad61b907d3bd25b86187da8668
2021-10-18 15:53:44
67
56
392577890612ab2501a186ee5db43df0719ecf8adb744338314859a28fc0d18f
2021-10-12 13:41:22
67
1
afec8dface828b0092e2bd068587c06c917f7e70b36cc82e57becd14e3d9570b
2021-10-12 01:35:48
68
38
5c65de316f32e4950cc7faf10428efc5719f2a0a184fd2177f0f1b4441568148
2021-10-10 21:45:33
68
1
845ea8c4253f9b4b66f7aa7962c6092e559188c992c2b430f68ba474ab494b03
2021-10-10 10:43:27
66
1
69ecb7486ab01cb996e8c43d3432da010e17c3c4b002bb1e64e580bba15cfa96
2021-10-09 19:40:11
68
2
ba930523e14a508b46b7c60bed1801b49570984dc5b359bf9466006a33865793
2021-10-07 07:54:57
68
1
47d85ae4fd5925f366b87415109bc1b784d63dbeb88ae34bb350010152cf5283
2021-10-07 07:33:52
67
1
fc212cd7d547441b132f0f3a3d20b2e417cff1225fbd3a653063e2c645a9cd70
2021-10-06 18:28:25
66
1
7c6263f72f4cb6cdd634a92f66616a4e1657a80d8f0ac0289d230ee45fe40bd9
2021-10-05 08:06:12
62
0
5c7abdc97a2e7987168cb8795f4a75df915e612c599044d85c897fd626b49e74
2021-10-05 00:49:44
67
2
0712a67500f5e22335069a6eb21bf2790e95ea67226947f7b3dc3074399be90a
2021-10-05 00:49:43
67
4
ddff314ffece4cb98f26a0307e88e94f9461bb855bd124655787bb203c17864e
2021-10-03 07:15:57
66
1
9e63e17527da57120a1619ec7cef6ac308981cf4944ed3d794d4e13087dd7670
2021-10-02 08:23:32
67
2
a253d5868c949f04c268ced2fce1d22c394ae0f1ce477f853fe4554e74eadbcc
2021-10-02 08:07:38
65
2
fc91201d21c60789c71735be77c29c38203f896892c09bb4d068ef7e9258ca8f
2021-10-01 22:55:35
67
30
7ed6d888a7d53f7b891be1e274fd9c92b83e9e35a6945c5e9e21115ed3d9c821
2021-10-01 16:04:35
68
18
da88406597d5e93b057d281a0dee6176d9b2b168a19fe321bdc41bab9efcb236
2021-10-01 15:21:41
67
2
d7af2ba64bdf3c8e6f207ce1340d37ad57510adf65359ce858d2eeac008476ae
2021-09-27 07:07:59
66
1
9f1a7c96828ab6c635fdb55cd4d1eb3483c96c94d61e23a3d86a993ddab2de73
2021-09-26 09:32:14
67
1
ee9f1354ba8c7ef099fc24876a97f290a8067ac68606d9d732cebfe991d0df8f
2021-09-26 07:49:33
66
1
fd44037723128f25d6723def8e16dfaefa0722cc59d448e7241b3be4eafea11f
2021-09-23 23:33:26
69
34
061b264541f6e3b8f6cddf9ae5a19d9705afe9eaeb7cf219085ef45159302c26
2021-09-22 22:29:38
67
2
867dfb8e35d409cbfad24e83aff936ecd19508445f64a8cdf06fbcf1d2664bc3
2021-09-21 11:23:14
67
2
da9a3feb033b6af94478282a6d245e50f7a4e05699d1ae1f2a615f0f57b4c8a5
2021-09-21 07:12:36
64
1
1edde63cd6990bc5e732472e1fbda511051374fd7d0cef2c653d1b1695980211
2021-09-20 20:56:39
67
1
2773c3aa5b595131ed0b65b230fdbba3eedb7b1f577adcdca82635f2f379dc4b
2021-09-20 17:27:12
68
2
c38bf70c16f207f397c575733b23724dd6ca19c35f3383b8929cddd53adad917
2021-09-20 10:10:34
68
2
1a986b1e04626b85d4aaf11ac34e593aaa5c85961d07a194adc04654df69b8e0
2021-09-19 08:18:48
68
2
c643213f568d9a5725bf8472807b00ab751a13c134fca70a86e98e031fd7d2b2
2021-09-19 07:29:30
67
27
d47ff1aa155d7451a640cdff41729367f6b34e98ca0736ad55329734fe78644d
2021-09-18 07:41:00
65
1
e04b21d7c3cddf78a7bce10966d107e0123ae9e8ace1b117fc3fa0f02970969e
2021-09-17 17:33:11
68
48
9ddbb08d103ac5c73b763835f54070d2df446cff4a13ed5bffefa76c9e819f8b
2021-09-17 10:32:54
67
1
cc06a00c965778e6cb080c66c4480b289dfdb98e45bb074dd97ae4bc3d7c1b3c
2021-09-15 23:18:20
68
1
db1aca8013df607978434b15d6c47e16d0504e3b7a26609aafb6af18006bd480
2021-09-14 20:14:57
68
36
d24f793924617c8682821c22a937e178c1103e20b9fd5f8f648e4f496e6b3b6f
2021-09-14 12:13:07
68
2
df9c08c00f4684a7c449bccfa46462fbd30a6efc23348c9983226e6b2b0c1f9e
2021-09-12 05:44:32
68
10
319700276cb89a7fc44c328e8a3f0ea878ec0ca3962672cd7eb4ebfbbd61d404
2021-09-07 16:38:38
68
4
97ad1e40d1ad35253d7dfe9b1e4873c825677fb5cf4fb5fb0be50dede420f5ec
2021-09-07 16:38:38
68
3
12770c578759bd431707fe84be99b0d49010d30c2e845dd911fda20815533631
2021-09-07 16:25:34
68
26
31e5e1619f4cd355ec0d84fe2f2f042b16f8f38fadcddbac7847a24a3d2fc9bf
2021-09-05 18:47:33
66
0
f85e11a0efff08b386e1259118827152f7b41240bcd4dc4e8746cf963d5e7462
2021-09-05 07:56:08
66
3
020bd91a218dde579767f1cb2d7dbae92533ffcf39589195d45070990bfe4fa9
2021-09-03 11:47:57
66
1
6997b0e77f413c43f827214c83c0824effb35258677b9b8025a4f050bd68cf2e
2021-08-30 08:28:38
67
1
d2f2411a76fab06a6566cd49fe915600f8175153a5ab7781c1e32b44e56b074a
2021-08-29 10:40:02
67
3
3ecab31e17d55cb9443c3b57683ff2bfa9b6902f6b4840787ac4ec8b1a314bb1
2021-08-29 09:51:35
68
1
f10105b79afc48c269a6513eb2de211593be8e5e4f2728a407601bb6374aae10
2021-08-29 07:13:38
67
2
12646ab36d1235f7af6a20951726790b4fdd33a819aee6e2ee4bb17347e69b0b
2021-08-28 07:36:11
68
5
581340b90945321eff5f918407f0d256d8650e835d4029662bbea8e9c69ea80b
2021-08-28 07:20:03
68
1
bb9bd5d792e0a0f6213251d4d8bf69f1e53b97657f8f86a73c26eab6180689c4
2021-08-25 06:00:31
66
22
cad13f2d17ed9efe968f532d59119933b1b5135d35883d86f11d4034d1826d98
2021-08-24 07:40:25
68
2
caf3ca1137051b245639c65ec21e00dd1e7a162fb1233ac2b9b0332444084bcb
2021-08-22 10:52:26
65
1
f7cf126f084be0d216499479af326c76cce8cba486edef9b110e4f05afd39605
2021-08-22 10:49:06
65
0
d8f8921a64cca1ef6bcb91367028baa1cde4144601f2ca11c998b7866d3acd5a
2021-08-21 08:46:18
63
2
2c7706ca276f11de138a05faee9a086898680a85c97930c4e37b53f9af0af3a2
2021-08-21 07:52:20
67
2
dcd9fe75a4986242017ceaf36e831879f3f67adb3b64c8dc2a67c1de5344e2c8
2021-08-20 08:09:27
67
1
d414c5b74eb2e57639cbb445de309ae0cbcccc91099798790ada58568eadc36a
2021-08-18 18:06:33
69
5
372fe934177fbc641d3cbe488d20c23c699e3428697c709f1f29b6186b2eaae5
2021-08-18 08:36:07
68
2
0b585b11f2e05389234ae2da5afd3f1273e0aeeb5d53998b02f76c46e3225077
2021-08-18 08:36:05
67
2
6a57f22b5ee8b4a56ef041d54dcd7af18f9b14991bd03b2095b82b600f1e2a18
2021-08-18 07:47:57
68
0
d0350fd03b61a71e8f0305956af680f1977410ca4c9eedfdd50c4455007edef9
2021-08-17 14:42:44
68
5
6a48e7501960225a7d5a0cfde304bc26e561fed93257d72f9691cb26be9176d7
2021-08-17 09:13:11
67
2
8ef0f0d584f0087309d450c45acf9d253086e5a485736f9e8afb467da52410fb
2021-08-17 08:24:32
69
2
3e15f07e0dee227e6da86616fb05eecf566e7ddf15c4bbaf4b0b4ebeda391802
2021-08-16 09:57:21
68
2
348c70ee241c63458a7e9e4c91d7de1762ff8f86d709a208e2d0cf05bf422c46
2021-08-15 09:55:00
67
2
d672166e561795473d0f6c1f9a4a950d76a0fe024cdd3c1138fc33e4cc33a016
2021-08-14 09:09:02
68
0
364f7f82f08e9e2abb72dd3a1d8300e23c2b36c1d0edf894c5561a1570d5d62c
2021-08-13 03:13:05
66
29
340ef087ff99bba8ca14dc0e4fbd69d40422ef0fc6c5826f9c1b4209b8bbc47c
2021-08-13 02:24:59
62
30
a3ca6c0e563dfcb3e4c018e23109089de8aa14d866bcda6cae0357b2599f0d90
2021-08-11 11:27:42
67
2
355cdcc469882f3bad49dea7be1d4cb56044594ee2d0c94336d5c93c611ee448
2021-08-11 08:05:01
68
2
51467cc504bfb42df93377ab75750119f5d24cd716f41b2d8c9feb47c606f762
2021-08-11 07:53:31
68
1
6ea2e7bae597bfd2ef4e70701c8b22f22fb86915ff902cc2c8b9dfbf285a976d
2021-08-10 11:16:11
69
2
6a94ddd15c96df3b0cb31d067ea6864ce8e757d0f2d3dfb2d4d9208456c9113a
2021-08-08 10:09:30
69
23
bdc5acd637999320846e7f78122707b18010a1b989446d6c7f85119d65e69959
2021-08-05 09:19:29
68
2
5bd02a6f66a87b03623aca27aff12d9693a801fc1317cfe92cfba10f7dd007b7
2021-08-05 08:50:56
63
3
bbb122e0c0a58f5f03b7b3e2dc2d576c4829d0d48621e6fd2e336e1903edff80
2021-08-04 12:53:23
68
2
0814f2e39b9ead38077d1cf847e068183f396a3c29a49b3b1ebe880e568caf6b
2021-08-04 11:50:41
68
57
24c6f48179dad159a5606ab0e40c1f69fceb04bc199e9c032c69d04f22966054
2021-08-04 11:50:41
68
57
9c15027bc98be27366a2eef950cf67477c79276f9f40f1b8d11584187ff3ac88
2021-08-03 08:28:14
69
3
09f763377fe66bc6424ef14969fe6914a2d5b47ffac5502c75d52913eca80536
2021-08-03 07:22:52
68
2
24da3b69ffd1f01b687074ad25e410fd97ea33a4cc7b8d2d6ca82a74690e458d
2021-08-03 07:00:28
69
4
a1ec9d9966d1b22cea68a957215ecc1bfc54941fde03853a0e9429d96d4eb06c
2021-08-02 08:41:07
68
3
e70b912f5fbb5d70cd22bd0f8ded815625f99c40d8cf894c03720de056a2cf29
2021-08-02 08:38:59
66
6
7942aeebef24573ad71982498313f7c0203010a776e2dd3f34153a574c45d121
2021-07-30 23:33:15
67
4
11f343aa97f5d3397af4adeee3b30b4fcb98af93879a86e162439eaae9cc6131
2021-07-30 10:58:27
68
0
bdf37c38a3644cb148ebb141e79e46cb64c24b3503ab9edb43a94859830ce288
2021-07-30 07:48:16
68
4
6e88ef9e07d6afb8267358b3bfa64dcfd30ba6f98646ec97a9c9e6ba9e9607a5
2021-07-29 10:17:07
69
3
894bb1dee2b4441f698faffd37b4571df42a794f1a07267a4f0b6d4ccaed92c2
2021-07-29 03:50:53
68
2
379e93431f6c0426d1d4020c066eff9c4f3eb2ee7ba236451f89018e2819067b
2021-07-29 03:50:52
68
4
d8b391b66665149c907e4c852537928345b1c6bbda2993ee8acd538346801cef
2021-07-28 18:10:28
69
4
8d0e4647344203abac56dd87c5aad20a898ad5150afd80bc6405b12bcc843857
2021-07-28 11:20:41
68
1
435915707f4285c20627e84b879a71078eb19190a5cb0fd83d0ba10960268469
2021-07-28 07:27:41
67
6
c8a0409b0167a92a65d3b21c9ab295ccceec9494eeb33a4624ef11a1f9c13c45
2021-07-28 07:24:28
63
1
4798790c00fbcf103ee39f1f708e4e3e8d01b50721ed74840d54ceb752d25cb2
2021-07-27 10:29:22
68
3
01b8b2b381523812d7549b21e428c9103fc76767f423a8a15ee60788435424b4
2021-07-27 07:22:39
68
2
546c2ea4e6080c860ebb08e781148060bf75eb6385d97cd8121af04620c7c11f
2021-07-27 07:22:39
68
2
b23cf060f0a3e36c6b7d052fbf7ec4d8f578987c86fe62177673a7cad26c6e2f
2021-07-27 05:47:25
66
2
d6eb5c108eb23ffc0a0c6fef80cb378370f7160577f5d5db01ac183c8690a5f2
2021-07-27 02:16:41
69
2
7339a5380da5e15ae305a99b499b5a7ed9fd7d95fb3f052808cee12cdaecdc84
2021-07-26 23:44:58
69
6
15efead8c67d2307d8c39cae71553f62ecb162a8fb8be2deb59379e15a9bca23
2021-07-26 21:16:03
69
1
9ed8c51b5b04bb8fbabe20dc7450ad8e7f98c3173f5861ade5682912131c5ad3
2021-07-26 19:18:38
69
3
cdff51b05e22321bf16f1dab7075bda73a66825cf80a4d4ed91b051b35afc20b
2021-07-26 07:51:27
68
2
6c829a2c1f1a3f84c432a793353e11fbb5e622c5096b4e019f54db5b474719a0
2021-07-26 06:54:32
69
2
32645700be546e823a499e7a53e8aabb6b427789abc2a905250185b57478d36c
2021-07-25 19:17:02
70
22
86677b1a3655128c40cabb242130ee69aa3af73de27ce1a055799faf3341fc80
2021-07-25 14:09:28
69
9
bdf7324a4cc712a3e99c78e83bc0efafee314d366d65014b12a55e7d2a85cc56
2021-07-25 08:49:14
69
1
283afe917785c0dcc6c3fb344aa27ba6817e4f968978bbf3995c1292a0ce2b13
2021-07-25 02:01:17
69
6
65d95d230def6ae155baa2fc926f8004306b02bb15300ad1c39b5b2875befc9b
2021-07-24 16:50:03
68
3
c992759906381dfffb6dd8eaa0ee316d478791f22b3d08078907ac959c6b8579
2021-07-24 09:31:07
69
3
c8eeb2684e451fdd04191b2e0745342c8267df378644313bc7737dbdf43c7f78
2021-07-24 09:27:56
66
3
f20826ed8c0ee715e4b558fe373646f94306e2e5d53c7191e544fcbbd01eb924
2021-07-24 09:04:59
67
2
5b9220aa9b87248257932767fc5c6067297b96b7629ec46b28265e3b775f7ba7
2021-07-24 08:11:30
67
2
40c6a4d5d89e7f1814f238e5c103b104ff89deda94f76c24cc01e75078254352
2021-07-24 05:01:20
68
2
db73148cd74f3320f61840d440d8a5faebab5eb4cd0ac309d21867b1528f3f98
2021-07-23 10:36:55
65
1
5ee306b44879430c12ec894e608189abcaeb704fa4739ac366f2b0fb2a2f2651
2021-07-23 09:06:01
69
5
d0942311d90851d68ed2c281ecfdcbe29bd2fdb8f32e04b99b21efebaad2a10b
2021-07-22 13:52:58
69
2
d39786442e19dbaf592d7dd86f11b4329082166741846140d4426e38d0f4e562
2021-07-21 15:00:28
69
3
0b02754c4b15cdbced6f909cae9d05e74d01bf79f5d5ac3138df912b72ca21c8
2021-07-21 11:32:00
69
0
701b5b239d499b495d2af767cdf9c04352e25234d26464f28e5393ab3294ddbb
2021-07-21 09:57:31
69
2
7418a8f0f80f1bbf638934733459dd6614bdb17e9361ec81f3d69f8f55c7e439
2021-07-20 13:11:44
68
2
9c9e1e4e222fbda33f1d2659dd8174f044fe9d54a2832b21145c778cbb4a4a04
2021-07-20 10:46:56
69
2
5428674229ebe4d1cbcfbdb4f74539919b6b0c9b1c6e815f709661d2af72c491

Rule Matches per Month (last 24 months)