HKTL_PowerCat_Use_Oct21_1

Rule Info

Score
70
Name
HKTL_PowerCat_Use_Oct21_1
Description
Detects suspicious strings that indicate the use of the PowerShell hacktool powercat
Av Ratio
17.79
Author
Florian Roth
Tags
['T1086', 'T1059_001', 'SCRIPT', 'HKTL']
Rule Hash
fcd3d26462de0a2c3a3941c8090d6f22
Minimum Yara
1.7
Date
2021-09-30
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
31
Suspicious (< 10 engines)
63
Clean (0 engines)
5

Rule Matches

Positives
Hash
Total
Timestamp
VT
3
a7da98a32876db09e18730b9619d982f9fab8e6102b7a432cf6d67cbc5e32c85
55
2022-01-23 03:22:44
3
ed4de0f0a573f75356d1f528b8d530d51ffc9bee2260bf1f95c0ce14cbe1b6dd
55
2022-01-20 17:38:07
13
1a611b3765073802fb9ff9587ed29b5d2637cf58adb65a337a8044692e1184f2
57
2022-01-20 11:05:36
1
44cee06ea8881201cf747b93e12321e7daafcdc4f416ccff1fbbbfd4f953e744
55
2022-01-20 00:41:43
9
8c512321880ca83d0f59607b4c2bbc339b57a59db84e90c8afe8c9467b67c1c3
68
2022-01-16 20:29:37
1
52f10454117f923da3b6f7340628558a0c8d4d335a89be55855c8f5f5eb75a72
56
2022-01-16 14:41:14
10
dc62d6713424a5dd2aa15025504e676d26f7717f83aec9baa9d2908d33e2be79
57
2022-01-16 13:46:08
10
065aa44eb2fbe850300bfbacdcbea58a0783698abe8782dcfd9c4904118fed70
56
2022-01-16 12:47:11
23
b3648d0b7c3648713653e46a274b6c9cebe0b3982b5966d79d384a742df4a9b4
58
2022-01-15 00:05:24
3
db7bfb2b98757c107c93265b2018233801eb5cb902611732d235b130419b7f09
57
2022-01-14 12:59:36
5
26b80d324e376a86c1dccedee29cde4d5e26f5c562193125e3ee9159d32b7e88
57
2022-01-13 17:46:27
0
ea2ee1438451d44351226977813dbdaea6d3773ee6e25448bc15b49d8ffc8cdc
55
2022-01-11 14:06:10
3
437ab10ab47ef95c9c7c921530f15a6ca34fd2582395bade1164fa35dbfb7a12
56
2022-01-11 06:37:01
0
673c926febdcf087391500e2a7eb5810a337f31aee3def1fae0b69f256f8c476
57
2022-01-10 01:08:10
3
ab9e14b58d7faf6022cd7ddb69998f02abd5ad0b45b8d050338a3ca3362208a5
56
2022-01-08 18:24:00
5
c1eecc4761069a52191475856eba38678956c3ead88273eb240ac4d44e4ad814
56
2022-01-07 23:32:07
21
26a59327e3109063ce4ce1c31f25204d502ced86ca6f3613caad1e23dc8fcd48
67
2022-01-06 08:06:38
0
c0053d4b881980df41fcf9ad832ac6016fb719fb87dde5ebefe24fd5da1c9dcb
57
2022-01-04 16:33:05
15
5d83209409370af13b866d7d7cfd296ef5706ed4c483ec751f3f6b1855a4af28
53
2022-01-04 16:30:41
5
520d0cb90b3377f4781599522f2cf9421c98fea05c709a8c96c351eb16288558
57
2022-01-01 22:25:35
3
400c6afd7554f67a409cdf592d3d1ffe24de6a2e47da5d9cf3eea1be12f5fc2c
57
2021-12-31 18:08:33
4
1bafc50e1e09b88151988121bd56ef1c5af6316d77f6663aa96fdbae33b2eca3
56
2021-12-31 18:06:03
14
633efad59adf05977657d63c9aacf4ca57bc9dcada088edcae29ef2a22998af8
57
2021-12-29 19:31:23
3
3023adb3b5ccbfd7d13da07d377c0760a304f72b67d6361289c615a58e77806d
55
2021-12-29 18:26:12
3
08edaeaff3e7da2c6a1d70da24199bad060c27dfb1ffb308e2581b06af0bf7b0
57
2021-12-29 15:19:51
11
829c404d2d0fcb5c9baa60ab12b9f41153724d5d755b3b25eec1c8253f45cf15
57
2021-12-27 05:48:58
25
c55672b5d2963969abe045fe75db52069d0300691d4f1f5923afeadf5353b9d2
58
2021-12-27 04:46:15
4
31f769fff219bb1d364e777099d34b96307ed0a4c4ad152b24fa65270537f0b2
57
2021-12-26 18:53:40
3
05289263ca3d2a5de258e755d35e20c6130851648aee4f526e071d1ae6cc190c
56
2021-12-26 18:33:45
4
5f76cdf2a9a942ebf2c20a280724c8818103954b05c9c2a32dd6c3417555a7ef
56
2021-12-25 19:47:31
4
2d8e3d7d07a84b7fbc42837fc4eee6906afc21011b863557e123bfc295ba1a01
57
2021-12-25 19:08:53
6
43b285bfbfee7a9c9ca765b3d831b7a41db90ab79978d13da74d161affa3ea3f
58
2021-12-23 19:21:51
4
2f2383d53735b7335fc9dda9c68abb4c2a7c9cc3b29f9d623555b97257f17aca
55
2021-12-23 18:10:32
6
a996af3b21265764d2d8f4fe7a4ffa26a0c0aaa674d5d52edfa46105e0600264
58
2021-12-22 11:13:23
4
f683068b39f65cfc38a45819457615390a12a71fe08eb81ed8f2a3cae27d1822
56
2021-12-21 12:28:34
3
03f74755c53c629be3d7aa695a8bc561d2e6456e53523400f3761da556d9fbf3
56
2021-12-21 11:07:45
5
38e8876923680782760ec0cf440134f9baaba1bcf3c91c7500fc787cbf67ce43
56
2021-12-20 15:35:35
8
87131271971bb3c45b2784780d8bd13b03e19679df88a2c051d573a1dce3ed01
68
2021-12-18 15:16:22
3
4aa8d876259d40973af4d0ee80cfb8dfb4d7a1cdfa53ed3a169bdcf857091db8
56
2021-12-14 00:10:21
19
6895001e08f3a543d5f1501325a880a44054043b28c6d94d2189b85e27126d76
69
2021-12-13 14:58:16
19
1fdda6c558eaa927baa6bc1e2dff83082540f0e2eddccb52d087ec51a8e83093
69
2021-12-13 14:51:16
31
a5448519b998c1e4d0be2e52f68113a3f15659199e5d7a1c5cd2cfd7d74960d2
69
2021-12-13 14:30:24
3
4db8aecbb1a4394273bc80aca3a81278ac85712a491e4161862727d326f25eb6
56
2021-12-13 13:39:07
3
a003554e5fc3baa6970ba4f1a1d59ae5ae0639ea1336c2a8b73c2b024f077179
54
2021-12-12 18:35:47
3
674d3891bda810cdaae018ad8ac90137173175c4245da2ca5dff71879e6fe273
55
2021-12-12 00:49:06
4
cd1b2ffe8a3165f4a29200a150afba0e9c168bcda5aafc42024ef5ddc96709fb
55
2021-12-12 00:47:02
4
3493fe8592f0cd837d7f58b923780b23ab120b2c8b6f99b2e46a24a6531b7a2e
54
2021-12-11 19:18:50
3
5e1ff85a753f85f00676d98982e8f507bbeb5332d2372d4d85fe11fe52bf2736
56
2021-12-11 11:06:13
3
d1ca2c8e8891abee8e5b1cc0eddc4a7ca3c680c03f3f9ac1ae74422fcb5bab9f
54
2021-12-09 14:39:08
3
68203af94382b7b4428aa7fa2d187b09f5c84aec9b4d50b70ce753d625c948b8
53
2021-12-09 14:36:27
3
cf00b3738e5b455d9f5b7887c241cd37773a6582999127718abfb13d96b93def
56
2021-12-09 12:54:44
20
38d5e94beb86e0eebb3e888b238d57467c86868f7e67db26aec814bab6695a59
65
2021-12-09 01:16:52
19
00dda2ddf0fca3c1b0b291d707b47d3475e36b4b3950b1df744a98c82a7baffd
66
2021-12-09 01:14:40
14
a31960b2ba21cae7322036553fb017b3bcf56be2a71bb856ea30d5ad3af6f61d
61
2021-12-09 01:02:20
2
dd83755ca0ff162d01fcfba5a5b087b8c6b1806b13b5e7c8d906f11a919d0973
56
2021-12-04 15:36:04
5
0bdd4b84888660a0989ff6fb3240856bfb2a0ecd09a24aa1d452d8a54a5a36e2
56
2021-12-04 12:10:19
3
f567880f3e1cf6077c3595dc5b32e553c653cd5c4b00aa900e02fe0babbb7623
55
2021-12-03 14:07:18
2
f6e1b6c41a1a11853728fac554c3b9acdad629f03c465dfecf8098a74cc6f0a3
54
2021-12-03 02:07:00
7
af2c8006de8d17154d595e176c8417c49d133f1282700a8f1e123baf73de0f1e
56
2021-12-01 10:55:38
4
2500d0a284ff1aa188fe730350b49a8fbefa12047853958b4aa253163012d062
55
2021-11-21 11:56:29
18
2bf730fe355eb8301a064b1fb368abff003e59357ee8e68b473767b41f7e9bc5
67
2021-11-18 20:19:28
3
1ffa877b9505b0193677f76f637c376a05857fffb2c448a7f0542e10e807e987
56
2021-11-15 14:08:59
0
c2f4aaa5df1818d6db7cc0d734a739fb350143de2cca59c947bf8659693a2afe
57
2021-11-12 06:59:06
3
3400579b2ed6cf201f57172359a3db27e91fa222f1a89c2e87fa26983096c02a
43
2021-11-10 20:38:37
44
308a646f57c8be78e6a63ffea551a84b0ae877b23f28a660920c9ba82d57748f
67
2021-11-09 13:13:11
43
cd822a2aba7d7beaea443ebeb20528a71cb87e0bd0fad3da5b06e69849ea0d57
63
2021-11-09 09:18:01
46
7e3378e55e49f93bc1cbe111f65faa89ed0b6765af411bf21547f5a3c909a06f
67
2021-11-09 09:17:58
47
0499aa5c68c59d2d3a484d52d7f1afcc189722ae96dfdde2afd9e12c95085af4
69
2021-11-09 09:16:52
46
38884986e530050311f8ceb59a84b0a5fa99034233fe8b2c4e24febe9798cd5f
67
2021-11-09 09:15:46
45
1fd4d2b24afe772e9e245ea887e7b7546c0e9d5339cfef78549e8d5b0854502d
66
2021-11-09 08:00:47
2
d360a3f2ec9fe24732efb642cbe42641d302b68cd686bfb9184b5c372ea224bf
56
2021-11-08 20:20:25
26
c0e9910c714b9caf2413bf5a438eb650fbf0f9863ff5e3513a5bccd0929bd176
58
2021-11-07 10:05:53
48
5fcc28c618d0338944cae76e3df9ad50e579f265e4b44296506f6cfd05faec95
69
2021-11-05 18:11:11
50
82beaef407f15f3c5b2013cb25901c9fab27b086cadd35149794a25dce8abcb9
69
2021-11-05 16:20:10
48
6de32809d046761d43fb249f0b1ccd2fc7eee1c4cb68990a4cf4a6cdc666f3aa
69
2021-11-05 16:19:05
7
49f02d08d6ea75042bd6efbf2eaed098cb324e87d2c353311141429cf202db4d
57
2021-11-05 10:17:43
22
949c262359f87c8a0e8747f28a89cf3d519b35fbc5a8be81b2cd9e6adc830370
58
2021-11-03 15:18:35
6
7f89321a09845d5db2bcb37041e891b45b7c5234abca24d2da77213ff7352722
57
2021-10-27 14:15:41
0
011f289d482562e5afd7852420e9eb90395428725bba867c9381dcab9d074b98
57
2021-10-25 20:48:08
32
9b97720aafae256ca16860c281dd0cc51e9bd5bc3fe3894bdb93a4a4f171f68f
59
2021-10-25 15:07:02
6
28598022f4e010f8e4cabb889b9e54a2be46857a3119ff47fa5c7e8258b2267e
58
2021-10-25 06:35:43
4
31e3d37c41a91ca4c1ad6e29820474cbe1cecab1ed137b2683969d22698825c7
56
2021-10-22 18:27:19
3
0d016ce70c49ce1f22abf415f7ad19f431814709f5ae20099c2243b027611e60
56
2021-10-22 11:14:54
3
d30da8b78f81e7f26c78f8e3eecde2a2c62e33452f217edbe0b54463914d5563
56
2021-10-20 20:45:36
4
5c0fe3a0f34813848de1120e6658ef43c54c61c7398fcf4366bb2a7859a9e871
57
2021-10-20 20:17:05
6
38c70d0e223d0bccaa13154d3369bb707022c19155f7227b75c889fa9f32ef95
57
2021-10-20 20:13:58
5
b9f30067624b0ad0b2536e7adf9d8b751526bfafd0a4379dc134f714e91b3e46
57
2021-10-20 19:48:40
2
5af570e93dfc819ad326e287383e9b1b5f6f9c5cdbb8ece5029a00cd42493af8
53
2021-10-20 14:10:35
5
45213985a2027e895baf6085cc4f88fd346aa78d6122c613a42be122cfbf3020
57
2021-10-19 13:59:30
16
52d10d81484c8802c0fce093a17688eff2903c44081dd68741b37b875176b520
58
2021-10-17 15:07:07
3
f0a58933851b3637741b8f0777417d167e0d802837cf61c6eaae54b9ab742389
56
2021-10-12 18:15:21
2
b72e7da864c3f98b33e7c03b1ee2d3d318f5367a8d1af68c5b54239218c5b754
57
2021-10-12 16:39:49
3
4d10b86c06b752b9aa75300b7000de805cfd96cce686ca752235e340e46ca1d7
57
2021-10-11 20:18:08
5
2704a3013fca61bf6c02d303f4ab0574d9869ac2e0625aa1526583cd9bd122c7
57
2021-10-11 20:07:57
4
982d1f86f77c3beab60c5f0a04da5d8b1b99b498bf2ed34e3cafcbc0b348b187
57
2021-10-11 20:06:55
5
a26ac209389b76a6c8cea8f623934b721fd11f63d9d95240183f3a325414f48c
57
2021-10-11 19:13:52
2
92a8b7a6774f8590cb8db4496a894c63cbdc30ea9a37e4ffef43dbef40f8504d
56
2021-10-11 19:11:39
19
32002a46cd0111a7eaf8321300159b6cdb2e3cd10afb4de6915c4bd9d4298341
58
2021-10-11 11:23:17
40
e103bcb5af92ba7f54dee0f14b002b3edddaaab4d4433cca7be17db973b1a847
64
2021-10-06 18:44:47

Rule Matches per Month (last 24 months)