HKTL_PUA_WinTun_Jan22

Rule Info

Description
Detects WinTun - small Windows tunneling driver often combined with hacktools (e.g. Ligolo-NG)
Modified
2022-02-11
Tags
['HKTL', 'T1071', 'EXE', 'FILE']
Date
2022-01-24
Required Modules
[]
Rule Hash
088a2ece65eb7991eecc3b926d3389c9
Score
60
Av Ratio
1.58
Name
HKTL_PUA_WinTun_Jan22
Author
Florian Roth
Minimum Yara
3.0.0

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
2
Suspicious (< 10 engines)
18
Clean (0 engines)
110

Rule Matches

Total
Timestamp
Hash
Positives
VT
68
2022-05-25 23:03:14
449bebdc397babe0d23afe5196a97437a529bc225c7b9c87bd6c1ad27262a9d0
0
57
2022-05-25 09:42:22
f151229c2be961604daf35170855dd7d100acdda1711f1773cb24ff26c91f41c
0
57
2022-05-25 08:03:43
39209e8da952cdf56b5cb6123219af3cfa6ffb91d62937824a16106ef8c7b9b2
0
67
2022-05-24 15:22:52
67557d0b5fde69f669d79c2b98cacb41fa1d3a49c8e80b0f0a1aef11694fcab1
0
66
2022-05-23 20:00:40
6f4b4588e3f19fdc678bd6dc95447dbe6303aa4e98ba35038a5b83d572c41f0d
0
58
2022-05-23 08:50:10
4e0468e83d3e2a89071e724be73c5169c86c5ceee51f40c15ddfeb4dfea62f37
0
59
2022-05-22 08:45:29
32fc19c5528650d196d266f7580f85d65293b0a7d1a349a417f3b414bd2efda3
0
66
2022-05-21 18:28:14
9ef5e487b30a4559d24a49c1fb9658075b6c5993a6b47b452be72f781d0a20a1
0
63
2022-05-19 04:08:08
c4eaddc22ebc6244771c53098c734978ca59ba1a2552cdaf033be9ca8bc6204c
0
68
2022-05-17 01:07:31
3d0c9698e244e9f174e89bf55f24c0a71cd241b1b0e32f14fbaff16517441354
0
59
2022-05-15 18:01:32
21103e70e5e06c7ab190b560a16f04c01be362b452bac68a0250dfbc00480bf1
0
68
2022-05-13 23:18:31
02f9ce4616a8717653714b9d4a73aa4c1b92d583e842d894b3932cf04f6dfa46
0
69
2022-05-12 13:42:41
def2e1ce3d21f7c881a8c0251781b8fc35d74fb50c125aebe563669c0fae10e2
54
60
2022-05-12 09:34:41
b5a9281823f10d7f6f3a592d4b84f22fad880087f66ba4534d04a9863ec1b0a2
0
68
2022-05-10 15:16:20
3e6a6b240e7d3018c2913d87a28afec21af6b149189b00571ec629d789531e34
0
60
2022-05-08 20:34:30
1bba81cc4e95bf09fcd1d1d63afa0ec19ed204407aee770dcce647e3c3b04262
0
56
2022-05-08 08:53:52
87dd790acb402e9df9d2c4ccc676741f723cf5c269358ad0974d3ac256ec9e80
0
58
2022-05-06 08:24:20
fbf3b725dfbe0a566834b97baae3870dc27a3720ce4ae38d63f4d7907ff5fdc9
0
68
2022-05-04 19:53:12
48cc13a479fff845c3f36e3e90bc047778dae9a3dc09ec167f89569a649b3414
2
66
2022-05-03 17:19:17
cdb8498f848ceda0d5175e299aaa96d89afcbc5abdd907ce2bd5485ae0ba9e65
0
69
2022-05-03 17:16:31
e36b3193028319d47659874768204f0f5a0226dfa9784fd116203228e35f652a
0
60
2022-05-03 10:06:50
62c4678f8717f777dfceed434909871fd068c49a726b849fbfa8a58c5ec616ee
0
69
2022-05-03 04:50:28
747298610f61b78d65039a720076efdac6d644ff62879f7cf6fc12722d123cca
0
67
2022-05-02 18:12:49
a93642ee41c940035085fd19ea9e572ead79177ffbf72f564ee4f43c8f5a33bc
1
68
2022-04-29 17:38:15
dbaa0c124df8d7940d324215b1428008ce0e62ee9dfc45cf6363832f049825e9
0
68
2022-04-29 06:24:23
62a92e451239392ee62c054caf02a4070dd0e2c71b0688b88504527814281f58
0
68
2022-04-29 06:24:23
61e55d533a0a7ca3f0bddb36d6e6a639c3a536f907b8c4e25e5f9335e6c689a6
0
65
2022-04-29 06:21:02
8fa387c5080664d771c0c4067d57a9abe0137e5130145594ef78b4b75e3a9919
8
68
2022-04-29 00:48:56
c7f9ef75202ab7c82ee2d0a66d955ce72cb678c13e088a5c7710fa1bdbdb441d
0
66
2022-04-28 15:56:31
5c3835bf347b6c40ef4e4294b9df1e99ce3739bf57f61934eb88bd8c36507864
0
68
2022-04-26 13:36:14
c257eec92537ac25e79f0345e1836e52cb3d616e59a889aa4ff4e293d15a6404
0
60
2022-04-26 08:59:27
2b29d80c12457d058bd163bd6f65136f873bff93ee5595bf01ab90b44c11265a
0
60
2022-04-26 08:47:30
1c2867dfea29d26616be3d757c6d653f2ec4eb23aec36d7c36522c64540476a1
0
66
2022-04-24 18:37:46
5d578992267b8a5c31a5ae31bac8455453cb924e59e7ac63b851bed2c1d0c08a
2
67
2022-04-24 07:26:43
73e2947eb552a14f6e071835b88d2ac25c42d9cb4dd8503eb3144aa20b7d0003
0
68
2022-04-22 20:35:30
c7be044de240c1f7f06f539fcc9869140403807cbc6a8c34374cc72840e6c41a
0
67
2022-04-22 14:09:43
d694fa46ab4cfebcb2632d094c7aa97278eef2f8052438621766d863ae98a931
0
67
2022-04-22 10:54:44
ee820275e3384efc5479fab75ccb79ace723de0f08023f8c95486e1dd5b51c01
0
66
2022-04-22 10:53:05
80512e7b84105b663da3c9c3defe27d0ccfb4a386cd2f27275b14fa7e9e53da1
0
67
2022-04-22 10:53:05
873447818fffd365be599d57637a584b2b9e9d6bf7940c49c808be78c0865e02
0
66
2022-04-22 10:53:05
552c36dc0e8181df8e8318d3c7a1b5d0d95fee644a3b6d8e986983689684cab3
0
60
2022-04-20 10:10:46
36066db46a07554ba35d13d46f040344caeea7beeca1979a8d5da03744d7954f
2
67
2022-04-20 07:35:06
0a4ddd3df0bf1a6a221cdccf10da1b76ef7235ccac2cd50163eaa5e3760f1705
0
68
2022-04-19 22:49:25
c850c4f2f893c1a6f47714084576a51385014d0590f9701eb83d43490e53167e
0
67
2022-04-18 09:20:27
e1d85ba4c3cf37e5491a9c3584cf8e93769fc8fe482b68e4e581c482c81615f7
1
68
2022-04-16 12:57:59
ce3b807b1bba425662b46befca9812f95254540d9b0c963e219d8ddf4dd5baa2
0
67
2022-04-16 12:57:59
7bc9c09c03550449424eacc25672f1d49f7bd5cd31455cd635971710bc34ecd5
0
68
2022-04-16 12:57:59
6cc0b115b4caa3076f55b1f226328baa6558eb57979f8019f98ccb0665b16f2d
0
68
2022-04-16 12:57:59
eb6fffc965c09e518432f0db6f0ca7deb4f11acd7dc05ebbcd89916aa28427c9
0
67
2022-04-16 12:23:34
eefbf50ecbd1b3e7868e2fc935dec992b490472b2c06113e3747a97cc325e022
0
68
2022-04-16 12:23:32
2b9a62a89bbd25aafe3fa7e3ffa8387478336ed55e191b9d678833be6a081dd8
0
68
2022-04-16 12:23:32
a15e7cc1abd2b03c799245409044a68dfb24526b6dee2482b767aa51323a47c8
0
68
2022-04-16 12:23:32
8824ba1c2c58b0a2099c36e98373c36b73830586a302d9037c2e98a0aed06a75
0
66
2022-04-15 00:57:19
9b07c7504eb5f750f6cb568fb39d77878baa13859b7a6b4c8ea5342060f9a818
0
63
2022-04-14 18:29:45
79e54b97f9cce58a414e2eb7d88a444feed7084cf472475a6ef2c69d65c9885a
0
68
2022-04-14 18:29:44
ef7a465531368125c3e4ce78ca3e1a84346a44552a43ab8eb7617ffedbf8a6dd
0
68
2022-04-14 18:29:44
9d08b250739d10669d2e477ae57bf077033cf25b0371746f712936aa85d83d3c
0
69
2022-04-14 17:33:09
4a08f70dca078bdbea9bddc0d2a5172d1219a862420a101dd51d2496de0de682
0
68
2022-04-12 00:42:56
0730564096f3e8a9cdb29d804cbc7ac4d7386325533ac65da5ab89eec2ddf98c
0
68
2022-04-08 14:32:44
a6b647e7c99bcc26179afb6ffe43762bb9fc6acbb44fc362fd1ed67c061afea5
0
66
2022-04-06 08:23:19
42e5e551770b8f183858714441127a66d26cbdb5090327290da643c6d08c533a
0
58
2022-04-06 04:29:30
11cee958d62aa39d66b30309a38c11f191ddf7856f4f4cfaaf0ad2c118d4c1c3
2
69
2022-04-05 19:15:37
fa2a459ed28002fd8e3795c6bf646f99080477f096fdcd82be80f77a23be353c
0
68
2022-04-05 08:43:58
6ad78fe64d72294b9aab8a46a156a3af374a4995a268903a4a27a851bb9ea59b
0
69
2022-04-03 09:44:17
199696716647304bccb8d2f0403110c7db8dc547f593d744774d751b72fb0ff9
0
68
2022-04-02 03:11:26
9fdcbbe786f2cd5741ee6c22090d6101b7622bd0f2f4f9444ecf352c108f9a52
0
68
2022-03-31 17:20:22
8ed88536319283fe6f016ae76de1137d7ac08e7591d89435e98ea427f081128e
0
69
2022-03-29 21:59:54
ae60c1bbb32ae1542e80cb366b1282ccf5a3c5639c1ea2b708f1a491dee5bf8f
0
49
2022-03-25 06:19:58
01eeeedc87c8a0321a38a09662adaa0d9ae40ef64f1853f4faef7748f5d01eef
0
66
2022-03-24 14:43:25
232949bf44120db67925066e41a90878dc172423a7765a4cba889110272a1ca0
0
56
2022-03-24 14:07:33
91594a8ae2f3ac398715aabe106576a07f459a10e8bb975f649f4c837f8459ff
1
59
2022-03-24 03:12:14
ef0c920be01729a9b76e22f6c004a0bc12d0e77a01ca7fe01303c1c8eee01412
0
67
2022-03-21 20:50:27
dc54b99c41d4d535b984e71bb338a90544cec05f05ac46267ddbe98698a8d77f
0
64
2022-03-21 18:17:36
c538dc779167804c26c35f77666ea3e6b59b316a2847bbd10254a0bd61df492f
2
68
2022-03-21 13:10:43
c7f8615b68a3c4dbb4a22d779e1c8bfd5c54e74f7f4932890bb708083cda61f0
0
58
2022-03-20 16:54:14
2a18ba01925a13d55f74150b347f2830e8c0b708bcab00ced4c5587a791070f2
0
58
2022-03-20 06:25:40
9d0795ce218ec2337ff40953d6429844e448c9ebf0adeb35c3a35d9d4019ed9a
0
48
2022-03-20 02:21:15
0c2a0c43bdef628d767a33b4d90895203288e34f46e201b667b7f5a5310369d0
0
68
2022-03-19 22:21:50
3251aadd8eaff5a07bc0d59b09902d15d962cb83d8dd6ab9ab3fc5edd550ed22
51
55
2022-03-19 15:02:36
d70a5105be2c25dc1c3256c0a0e910a5b249b90e9f21504ddd4a79ed8c691416
1
56
2022-03-18 17:13:41
2962dc41184a567c6b089d0eb5b338dc439d0f5d79446cb69af9c5013b1deb6b
0
57
2022-03-17 23:18:37
fa9780c322bb7466395d62ea3b348545f6b732f64cd6bec559161e29fba47d29
0
68
2022-03-17 22:08:02
be8500bb0c29417d4dbc543aabdfa1817363176e3fdcb651e916015d11d91ea3
0
65
2022-03-16 21:54:34
be9a9405d457ab9455b4b59bb0f5662ecf8a3e466f81e856b331b54cb22a5848
0
66
2022-03-15 08:30:56
b9af81fceccfc85d23aa054ed9c46fd4d0209a31879fdbc041ff205b17426c90
3
66
2022-03-15 07:17:06
983f35c77b9276a10bcdb2282690e24aeb5fe7c396afffa0a24e9c2fff956e70
0
60
2022-03-15 02:07:19
871729f152177fa7b6d96b2dc5a444b98d11da9d63b5647814ded54311e11cf3
0
67
2022-03-14 12:21:10
e931d65be38a27f1dd58df3af5d304b47dcb95e3c206776921f1f872266ff09a
0
68
2022-03-14 12:06:30
dced661bde3b18f9f089198f7767069c2e406cee2050cc90d6da169c745488ca
1
57
2022-03-14 08:27:35
adbaba6b36745768be32086c01b54705a4ad65d22e41cd2c8c64198b5192cdb9
0
67
2022-03-13 13:31:10
f122795e3171bfc96fc62ab2e6989cd75a9d765d627163f003bd5ebb332e7118
2
56
2022-03-13 07:19:16
48f57737f9ad410f8825345d1a31e5567bdbf0f45f116d4620297ded07b28698
1
66
2022-03-12 03:15:31
91c6eac1427de52cb8b54ad6bb43e37de896a7f363e668a3315e6f5f4402b1f7
0
66
2022-03-11 17:13:07
0bc5e816c468f2ba5bf99b6a59d4e57eba11075a6044faf1ee2e0da595a7cf8c
0
66
2022-03-10 01:59:49
0ff9e3e8da2d4d882624507e6d2dbf4dbdde9f346ee45c421247d857833d7d96
0
66
2022-03-09 11:50:11
8cb7df8f4f6e8d81c4e4de47a7b9dbbb9af54e2ff49ac548e7a9514a6913bfb5
0
57
2022-03-09 10:44:53
a1cc0033c4ee7979e0f8817a4e7aa0103abc9da59c289289256447cb77af688f
0
67
2022-03-09 10:14:03
6026942067115dff12dc7c2508bf2ec0b2050ae36db6926de99c370d71a7c379
1
66
2022-03-09 09:02:32
f75c04550fed077f14c3461d4367247b037d45ef8cd198cfa4b36447d721e831
0
66
2022-03-09 08:59:07
d6a8b042a81a3614ca1b7ed3534a97b05c728d4856e2fafb1072f98fdd7827a5
0
66
2022-03-09 08:59:07
13a01b165d5eafa6030a7cba117dd2816fbbc653f1688da551170a1e63450085
0
68
2022-03-08 18:12:59
36573b82b413898ccf7070072ccaf635cddd7d24e84188b6d812a674db7146a0
0
67
2022-03-08 17:43:17
3fb6ae82e31bc1ebfbc8aa3098f2ac707cda290b5ca3edb71f350406366a61f0
0
68
2022-03-08 14:58:02
c8de5b8dbf34aafafc05b481b2191a13c544c19392ca1a04b7eab926a91fdb7d
0
64
2022-03-08 03:47:18
c46301fa2cf996189ab89f645fe29f99763314d767045a7c43a767e0343054c1
0
65
2022-03-07 21:54:41
83594318e15959c7d2e54b5537fee0a26e89b042dd7c4a0b009488aace413bb4
0
69
2022-03-07 20:55:49
61f4628841151dcab20932fb77543f94900f017d3e556df91325d3d5d39ef582
0
66
2022-02-09 20:06:25
82ecd550f92b753600feb9ae6f58f346125ee6e41bfd361b948875701f231c35
0
65
2022-02-08 11:25:52
6c81fcd63d317797d90f0191b5c56053f2a15727b35fb59e7d75bf81f93f3424
0
60
2022-02-06 07:09:22
11a7208469efceb958fee0873b2cd699e9324ca3905a355708bda910229c6a0e
0
60
2022-02-05 08:21:19
02c0578ca0d4a6d5e3e6531f31f58d690ebfab3bd20075eed79cee5c7bb6c25a
1
62
2022-02-04 22:07:25
201c54efd6ef7dbfc752d4515461c8b49073d6b332ac68a30f0910f26f487b9b
0
62
2022-02-04 04:08:21
27723cc025c1337cdc108f0d24685a4063439f33802d7104366ceab1cda342c4
0
67
2022-02-03 02:15:32
ba9f04fcf3a5cac5ed45d23b14138eb489268479bad78bb6ee3678c407916e42
0
67
2022-02-02 13:03:41
0792ea9a31ea2d3426eba104faa34c9b9d04dbff7001ecc9742ea5b77cb434aa
0
67
2022-02-02 10:21:01
b774ef19a2d3632ec1e411c880a08da271b43a0839df0d1a2a6333086973473c
0
65
2022-02-02 10:17:37
fb1cd5e7c3ea30dfafd3cc1862e311388361d896610db28c63716da9d71e8f3f
0
68
2022-02-02 09:08:30
8f43e137262f1f5244be5a0ba91263c17749c39b5fdef1790c38410185075be9
1
66
2022-02-01 07:23:50
09e22d13a2fba8dbda9f18ee3534ef49bc0adde13e8dba9ac523ef540c4d9d0d
0
67
2022-01-31 13:10:13
b5fd8ef2d70498b58e6f07691fdb7456f0e9b106f0674e52f81066c0fb7231e8
0
67
2022-01-31 11:53:27
2a0071cd66ae8a073e53dc4edb67d31e41ab9c14424ad9b7b715b13ea0b69eeb
0
66
2022-01-31 06:18:43
ef8ce010141e2112e5030a816f216f491bf2da88624d1ab6f94de9d2ab54604c
0
62
2022-01-30 01:15:07
aad216579d627c469dd97365cafc302baf616bf8e762d0c79008eefea11ef357
1
65
2022-01-29 10:06:51
c03a28a16492bbb03908398a6626407b30ed9e2d2f85931ea6c16e0e346d0f66
0
68
2022-01-28 00:32:59
16f6fc00e48ed3c71576cbccbdc2de948714fdda2dab7ce5be13e3fb779a20de
0
68
2022-01-27 23:18:27
ea928b0688a3248f902e2ae9dc0a7e0ff28b4cf4991af0d53cc6745cb20702f1
0
65
2022-01-26 18:12:04
d4434b3061ae65824d97b2e0b94575c0ddbbe4f57368b62f4187b80a9b13b1b4
0
65
2022-01-25 15:11:36
033a8fcceb241095c81d319d2ae16a1ae991bd5efdff88111be29436f98a064b
0
64
2022-01-24 21:55:09
e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
0
64
2022-01-24 21:53:53
8a0581991caf829cd92b27aabcb2bab618cc8fbc887d8f86a533c95d2e3f17d4
0

Rule Matches per Month (last 24 months)