HKTL_PY_RevShell_Feb21_1

Rule Info

Rule Hash
812ede867272b9d4d9e11ee18c26bc50
Score
75
Required Modules
[]
Minimum Yara
1.7
Av Ratio
25.09
Reference
Internal Research
Description
Detects base64 code used in Python reverse connect shells
Author
Florian Roth
Name
HKTL_PY_RevShell_Feb21_1
Tags
['T1132', 'HKTL']
Date
2021-02-12

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
97
Suspicious (< 10 engines)
33
Clean (0 engines)
7

Rule Matches

Total
Hash
Timestamp
Positives
VT
68
9ca3a8aaaa40c3811ade15bc3dd96cccabaaf00559a8cb68c77db9423b4eb36e
2021-07-31 17:40:10
14
58
3da934fcb203e3083a7510d638d8151c161f7a58590c679b3f2576de73451717
2021-07-30 13:39:52
1
69
e011c988cbe8871eaa54d538dfbe607e578428104b35ac62a25fee14ea4211b8
2021-07-28 22:16:48
20
69
2ab9ffd601d197d47dfa2af06fe0de9bb0d3fbef6523e44df8bf195f8f08bab1
2021-07-27 18:15:30
11
70
0958f0ba8bfaa812ae824e5a3457eb8f9acaa8ec230953498ed4203e43289cd7
2021-07-27 16:32:19
29
70
1dc2a6842a3c1e9469496147107a52119542760195ed5ebf8c4068cf92333796
2021-07-26 04:24:35
19
66
765d87b84071ebacfcbc0fb244882e66599efe7e939b5eaf4dcd4705d0f64d18
2021-07-25 18:18:36
25
68
284b3dde6049c0d9be0c3cd55b0e5c286796d937e4964347e3d3fb8fda495cfc
2021-07-25 06:39:42
1
69
037bf1f9c223bb2c473634334a97b77fa8776b39b4c62cbb848af68e9c83c1a9
2021-07-24 22:53:10
12
70
30e56c3e042192b040dc487d079866467c589b6d9c6c4d47a50077004f31d6b2
2021-07-24 20:29:24
37
70
eef1500fc2df4ae69f3f63bcd6a90aee28472a393bda345ee534b9929f7405dc
2021-07-24 19:03:14
15
70
f56b42b3c3f0715113063a4b82b79ba32d9d39d039afb4c51b9c41019b3e6569
2021-07-24 18:57:59
13
70
bcbcb50e9f35eff8376f8963e6f2b12a561294d7e5684630e4d3aefd4ee47ebb
2021-07-24 17:42:27
14
70
4950195ebf1d961604822e8e8a9ce1fa7c75bc38d01b6b704d42f076f5a8f588
2021-07-24 17:22:32
13
69
d601fef38ef54bdb0fad279c7725005814b8e64d71f1d7e1b3e13ee32d56b75d
2021-07-24 17:18:20
13
70
2890ddad08d7908a51eba109398b5b334bdce713de55c9223f0a45e198d123dc
2021-07-24 14:38:09
21
70
8d59f54df01cf44e94371a1e636e6c61799afdd3248c950cf8e9def0e4681c70
2021-07-24 13:37:19
35
70
fcc5fc00bc4052693137283bb2dab6ba987627ac7cd6ef8cc132b712bdad9a75
2021-07-23 14:32:55
34
70
455536fb4d8f18b7d2657efd09ad72d886f50a9cad1a3a5d8a1560d9b24e6ff6
2021-07-23 14:30:32
34
68
2784f9c3965232e32764b12d4922cb006d53ef47cd77e6f8521fb1736800de59
2021-07-23 04:19:10
29
69
8a293645f296ebe9a0ff8661355c28c829b70a2a8e95cedd36087d81226aabdc
2021-07-22 08:42:10
32
70
50fc8c8954e586f6241151c955ffe012017410cf61b67d7f2a74956e16c63248
2021-07-22 04:59:27
28
70
f84eb6a6d7fbfb05374afa363f6c829caac2b1175ebd41c12226f72457267eaa
2021-07-21 06:04:27
26
69
2221416cae64e406f571be07979b015b5c2122288f69ab10d7538268891e6a72
2021-07-19 13:18:03
16
69
53eb6c8b59a1a798f5d27b05dd18d6c354417c5c7c29954ff0abca9da480a62e
2021-07-19 13:15:09
15
68
065b1bdf11deeb7cde7103a5f0567a880bf75776bf2d0cf666b153f564fb8a8b
2021-07-19 12:52:52
17
69
564a9427eda0a3ec119e908b219dc044f524c9cf5038ba28a5dfd0ae724384e7
2021-07-19 12:49:34
7
69
9808ddb58b63a99cf2dd78c083cdb15f318093b25a40bd2cee2879baf33f6c9d
2021-07-19 11:55:38
15
68
1857166296daeba02125505cc54a911c06f7b5edef1153b68623e6bea722bcff
2021-07-19 11:53:07
16
58
560c06480e8df272fb412d2fbad4e6e723f5f3967d23d32eb8f6f5a1771e6a06
2021-07-19 11:35:15
0
58
de13482f705740fd7ad288bdde704dee980c898be24338099669ca4d95f8213b
2021-07-19 11:23:17
0
68
3f76cfb169effaf0ff3a7fc10368374f5e2f5d08771d4696017799031ed68f89
2021-07-18 17:28:03
9
68
9980bde412abb29a7f36fdbb20b26f2811b03bf3598140a89aba5b4c916b7119
2021-07-16 15:28:30
19
68
d28b0b215b91169223e6d329179357a41c064f7ddf86e94bf8b4d6c392bdecf6
2021-07-16 08:17:17
23
69
b570330d5921be3e51d6ee89e3835dbf533cc55f8763cfaa26167028ab40c44f
2021-07-16 04:43:44
17
68
e7b59a765f62405df3c75bb9ebb7be531db8a3a7ea74f2b4a03704c60887b209
2021-07-15 21:18:32
11
68
372ea9f1cf5ff5463e8fbae818c0bedf138010e484b08a395cd924018f9c15b1
2021-07-15 17:43:14
8
69
e62721325092bc887b49092c4d68a8dd230a6ace3322bc886d53e550e3c947b4
2021-07-09 14:39:34
19
69
fbf478df3f6e88e40d1d1742d5afdef157e4af2136f89707970e17c591958212
2021-07-07 12:53:07
9
69
94b84baf403258e52b41e2fb12be880146d40e3ffea625619ad9afff5c679704
2021-07-02 15:40:04
19
69
01d26a920dd97f7bb745364a19c148421736fa851fd43722d4c31276e390e937
2021-06-29 15:02:55
7
69
41aa0cfb5341fd97cf01c9b8e87c822a7221a05c79e27edff873e127d274e747
2021-06-29 05:39:52
19
66
58a2181375d11f94f32a249cbe7c925aab71cbf4d4c0db440cc861ae843b9bf7
2021-06-21 05:04:40
8
69
370e1a221485fce212ca256360e4f9b7e46ebffff0b39fc762845dbe82b6728a
2021-06-19 07:49:39
30
69
58dcd85a944ef45253c4989a044fb2f97376330f62f12fe62ededa06f270a07e
2021-06-18 15:33:59
29
67
123c3967eebd40c09f5f9a9166306237a73c5dab01b126b8b14a99af78234d94
2021-06-16 10:24:33
29
67
d393c7fe55f201af24e3ffa7e94d3ea04ab73ddd1077724f3713862926a0054a
2021-06-15 15:39:08
30
69
a332eb182d56606b081eef5c89edd1f8e008e0d979c36c8ca6d8c1041f59d1eb
2021-06-15 15:25:20
29
68
095c16f1eac1721899934c706422d930d1170eee422d77439a5244d3bfb51d23
2021-06-15 08:19:04
30
70
88bcc844786c7ee6ce57838b2a6876742c37e6322ce7cc5749117c109165da9c
2021-06-10 10:37:57
34
69
b11d9d9fa501ba54301ce1de07da32c3504a783259abbba23ba4fa65cb780a48
2021-06-08 20:09:08
9
67
72b87260986d71beceb02f7e471c6a35fa79beb228b62370769e9e2934191fcf
2021-06-07 06:37:35
10
69
07079ed29b4fec00a8e40cac38996ea766ce9f9d3ddcdd9a998603e4b87abe32
2021-06-06 03:18:17
32
69
4393197f7a5664602fba22bcf5b95b9dbf589f7ccce993afcbbdcaff4a1cc9fd
2021-06-01 07:24:18
23
69
489c50b6c8577e6320dc11463092965ceea950b662ce09241895c4d6f9342220
2021-05-28 10:34:35
15
69
0175e482e194d9cc87916810f73060e635629d3e65f9d784d760d79b859d886b
2021-05-24 18:17:04
6
68
59cae27054ceaa2a5bc03864bb996b1286a446a9fe9b861b2b130ac5dc702813
2021-05-20 09:43:16
11
69
f4a09504379a7bc963c37fbe9550e131d0b21e51934653491ac4fc24c2a81695
2021-05-16 13:03:56
19
68
dfb21d0184bf9d0e1fcfe5e68396144ec42dc47c2bec749e016db3ae07f11728
2021-05-16 12:59:40
20
69
46a354a9da044cbb373092933d359b604b191579b96179f87fe639895088dbc7
2021-05-16 12:55:30
18
66
7c1c0df5a2249be1045a0468913628be57a59e5b1b64f2cbfe569d6ba45faeff
2021-05-16 12:48:08
14
58
5ced2d98d810e508d9463b49e848c79b1da634e157417f40ab0612cb642893ec
2021-05-13 06:55:56
0
69
780cc7f7daafab009791615045c119009e036d55d17881a4be816f3a4136a769
2021-05-04 15:02:03
25
45
291c74ee656f09a0b4665d7c2848a860280a23c31377f3cfce31bcdc6380c432
2021-05-02 21:54:44
3
68
bd0fc6705150614aae7a74e6d84c810791d192c6264c687b2c5e162ee6560dee
2021-05-02 18:13:15
28
67
f8861b486b81201c339c6353802d9e2ceeae90c62f509a2bf875f452b7b16860
2021-05-02 00:13:37
29
69
4538d62397a7d44fbede5bc5da2949031a227d9f6650cd9ba4b035882e37d346
2021-04-30 08:44:09
21
68
c0086701f75222217fb851855a969964adb87bb692d46668278b9b15d5ea99a3
2021-04-29 16:57:56
13
69
fb52d4fd912156661e9c4b4e5b3bbeac60b172880754f64b063cbd300d679660
2021-04-29 15:34:04
10
69
fd58e64d125d3eb6bc82e82a9e2683a8fd377ba08184a2d3ed6bcfa0982c69ca
2021-04-29 04:45:30
12
69
b4792e475794d6cbe5916538aa9db9896e6df2587c4a0f6f20d9af858ae5addf
2021-04-27 14:06:06
19
68
ea7212b52daa5154d5a0f91d4c01cce1055f145fc381c186a54d5238e3018a1c
2021-04-27 09:59:57
9
70
119294d15ac58f8a01fb0e8dd3a40ae466a5306168fafec43c5a8a22c7d7d584
2021-04-26 14:36:25
30
68
07bc24699bcc9fd61da780ee826faa96dbb2c0c2e1dbb07e67d5040146b44a82
2021-04-23 10:53:47
10
69
80942e357fd045f47ccac77e82b9b0d8d737e021c948220044ad8381f325cfb8
2021-04-23 05:35:31
9
67
04fd5ca443cab04c5596e5835fa868c5dfa20ef647802da5c25e39bb594a89ec
2021-04-22 05:35:32
24
67
055bc1a004249f4ce65c0affb18691b1a865b65a6103924b879bff51383f6a73
2021-04-22 05:30:18
11
63
47902c04f3abafef13f82188828aa0e5d9a97438433c5fd95159035c8339720c
2021-04-22 05:07:36
8
64
f610a6e72cda77bbe6aa1440e09e4764baa81c33456983527cda690c95669dac
2021-04-21 23:15:20
9
70
359c1aabd81d0c8958e777114d4846f96ba4c04923216704d83508d9ee4535b7
2021-04-21 06:40:09
31
69
feccb4e320acbb2ad7541f45424821b2250d2d29a1144a77c12707e8ffbda06c
2021-04-21 06:25:21
4
68
1cecc1a63563e1b12e20d62ac48884c81cf1bf11212b641716abeb29d76c794a
2021-04-21 04:36:47
21
69
e0ace6eb49b00469b1c55535c1273fb02b6b2ffc7cb90c9823a7826cb56b6c1f
2021-04-20 11:15:40
28
68
5fa70c345cc3c22e5d162eb69fe94bf08564d7995fd28b6d2105a32d9480554e
2021-04-19 10:58:34
15
68
1424e63d058dd6a8b39be04f15d762b2752b0f8751c44be41bf6b8219f8c6817
2021-04-16 13:39:56
10
65
4282ef00a00b8c490af7a14bf25ec0ac89e1d398f977eabfa45bc85eadc8a8a7
2021-04-16 09:55:30
26
65
3027e7e25bb9ecaefc19b4ba03485f2809cea607ef27b0081e3a8406bb728986
2021-04-16 09:54:10
25
57
d3ea01070b783177374832d76c9b14d5570c4be40846c802eef2f4d1e09e6af5
2021-04-15 22:51:14
0
68
a7a58d11b0bf4250a2b77c4a632ec5145727f0f8f3e2c8d837ec0a5fac993eac
2021-04-15 17:52:16
12
69
bac4d3a8e4739754a6730fcdc56636308eb900eeebd1cd97aec86e726980dc4f
2021-04-14 05:54:14
8
69
d3d70a9e761b271d17b5a69c7b224f2d8110bf15f48711dd8ac6b88210e18335
2021-04-14 04:54:47
23
69
e9c757a96fddf04dc3a1f649ea64edf080b8978d3a84d15997ebc319954e44e9
2021-04-13 21:14:43
34
67
a72b5e22b2a06caabe802cc3e5281975dad87783ece41c516e4d945cd538993d
2021-04-13 12:06:16
12
69
196971fec63e6074d4b5d6a21421a9ae2ef880fded32d46891f117b0aaaa5310
2021-04-12 00:59:21
6
69
730cb7396298aaeea9d10357892ceb38874dcc3d78ababfd54072766f34bf5ab
2021-04-09 06:42:12
36
61
b2f1945d62e4dc53d1f42c0afff4e363e89e0aaa49d2eee6fae578b528001bc4
2021-04-08 16:33:15
18
58
2ae52e250a3372d31455131b083b593dc34ad48792d991fb497a447921c1dc9d
2021-04-08 11:06:35
0
68
5795f92bbb4f4557d2f901f25903f4eb2b334d8d6a3597095132639c365f591e
2021-04-07 05:36:09
9
70
efe8ce8bf7e8c1bbc974494f50d68f059ed86ff2bb482f1b230047d8e93a8e8a
2021-04-05 07:11:24
20
58
633f5dd6ac0509d84335674f174d1f368eb7c0dc340cfc116906a5511dccf626
2021-04-03 21:20:45
0
66
d94012f97e1897910d0a44b3e9a3ae7e97a5f5a47ca01cd0b8a6c23770818c92
2021-03-31 04:05:05
3
70
f021f4b4b065bf69c44afd65e6970e5387513f3b746c8643d7bac487d7e56138
2021-03-30 06:45:02
22
66
c641fbf637c925a49afc26c8a879d18546473f8cb7dc1561f46abc74d0d57bba
2021-03-26 15:00:00
10
71
0cb59e3602d85337e4e0d777626867ddac582c809f8947e87b58fac73f0c7517
2021-03-24 04:05:17
24
67
65ff8919e72bacc0befda7488b7819c07e11c7333bd0f2b6ef79932264a90279
2021-03-21 07:20:17
2
66
d67486c94049f516bdaf95d69f2a032b1b1fb03af52f024c5747e9eec926598c
2021-03-21 06:44:21
15
69
b434957d1b73b89f9f14d3bb619820039ccc3a1bbd2af66d0e711eb4664fd8c9
2021-03-19 22:33:51
33
69
1e9a7cc0f213954c47414a67bb96204fde09a2368d0122e3e480ec3b1dcc74ba
2021-03-19 09:28:23
33
68
0a9e4867a0dac25055559bffcb18db33e75d5450609a5c5f3da7159424f867b3
2021-03-15 10:04:30
32
56
28cb837371e8f8cc78ced4f0984495425d402d8052698c4af6e9f24f80bdd5e6
2021-03-15 05:46:52
0
69
efaea5243d437612bc8355cbcc2903676ddb073dd0a725917d7dca82e78505a5
2021-03-14 11:31:32
22
68
2c43bf96fa7205d524e2fc81a16195228677994f5c0f1729be30ea544ee32318
2021-03-14 06:43:34
9
67
dfdb94132d9027065ba33a5b4fc5fdcb89d2c2ae663b700cd9398f367351e022
2021-03-14 05:43:50
12
68
62c423376a87984910a07b63080b4c82b44f8c8f33aa79537f4dba0e4d9f398c
2021-03-13 05:11:30
33
69
41d0cad06093a675c777a7cbb3b3691a82c9eb4a60b7d25771d1fb4d433809af
2021-03-11 13:50:13
5
70
77f1b72a36d1d4fb88058a69daa65ed2778c60bf6817e27730e3b4cd6a744dd1
2021-03-11 11:26:32
29
66
62c3c02760c7d7072af8c3f5da06a0f8faa2d07ce47a2ca8a9dc446032896588
2021-03-10 20:51:13
13
70
b7898b466f9e5429e1fd39fa0d4e7a24fe342175b03a679d27894f0cb34d02f5
2021-03-10 15:31:24
28
66
80ed6900272afd3f960b1cce735e701955fc15780f1a3b244bebf279a58d6660
2021-03-10 03:56:10
6
70
8b1fc749505c8b286cf5d0711bb74583ecb2efb6fca80ea0f274c8155b61598e
2021-03-07 14:17:52
7
70
d7d56adcac5137c1f6c9fc2960aaedd3cb077e54378ea28361dc8e00b5e9e7b4
2021-03-05 11:33:37
11
67
68ae1db05535eb23bfb5fe8c38349cd365b01162c9e95d2f6ebbc2a8a34aee33
2021-03-05 11:33:07
7
70
7af379e43e3c4eb66d619a22c9eccf2ad54b08cf123343a1e40d1b23d3d15090
2021-03-05 11:10:12
7
70
a6272daf0eeda230cefb361a2f0563355492fae7af6d3fc6b3f841df830aec48
2021-03-05 08:14:21
5
70
b4778394ba527b9964166fff5985459bb441441bd5f456aec401af00c31cc9c9
2021-03-04 12:54:37
8
69
30cba74df2f9057d230a24d0771924404f1c58c04d6315e366ad202262f85589
2021-03-04 12:23:22
9
71
fbe1b7e3984d33ae5f5756116aaddce9139849cf0364f4ca1edb74d8a273e766
2021-03-03 14:05:24
32
70
17b0ed4347cd4e5333f6e1b9707bc11e8e4aa1b3a2497d97c269d30f89072c26
2021-03-03 06:20:39
5
69
c2723953f9adb0a247aaff1f93246aace6febceecdebf5bb3e92661d409f9b7b
2021-03-02 18:49:41
10
70
12d8c6f7e345a856ce495f26ec0b286712e9c4192a4fb641858ca308a95971cd
2021-02-28 01:17:36
9
68
f3ef002e39866d1ea2efc0ff0dcc2396b83b87060207f7d3863b45374311ba21
2021-02-26 04:29:29
8
71
646cc5af46abcd312f81f324c3837bc359b207d234a2ec9c533d746804bb6c1d
2021-02-24 09:58:51
34
69
dd6f6b2969fd692e67ecb74a716100f23bc994cdcade5e660c6ccd2285d3cbec
2021-02-22 10:38:37
19
71
a834aa64594b4e41b8106512ba55f96e24cf5d565542d71cffbd790b7c9276df
2021-02-20 12:31:11
32
71
9cbe0e89b8088cbaedcae55e8d679466fa727834506e841de2c2776c633a359f
2021-02-20 05:11:16
22
71
d995eda72c274256027264fad48f4a2604e47a0802dd9cfbf5dd952de56125aa
2021-02-19 01:16:16
39
71
24478fed51a77ad6efb2c75552ac64d794aa24a4d9dd6be76186e9a3f7108d2f
2021-02-17 01:17:27
41

Rule Matches per Month (last 24 months)