HKTL_VBA_ShellCode_Loader_Jan21_1

Rule Info

Name
HKTL_VBA_ShellCode_Loader_Jan21_1
Author
Florian Roth
Description
Detects unknown shellcode loaders
Score
80
Reference
Internal Research
Date
2021-01-18
Minimum Yara
1.7
Rule Hash
00dbb34727aab586c58d3312316eb89f
Tags
['HKTL', 'SCRIPT']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
84
Suspicious (< 10 engines)
6
Clean (0 engines)
0

Rule Matches

Timestamp
Positives
Total
Hash
VT
2023-12-14 08:25:45
19
58
6be35776ea62c77013bd5cc9fcc6ba308cd29112e68ab883b53f4951bcd82e12
2023-10-28 21:03:22
36
60
097ea205509651594e5806e9684609e16325a125d0d22b92836005fe7a9bfd90
2023-10-28 21:03:10
37
60
dcc8fc7df367b0716416718b114ce7131ca54619391355ffefa73393c0930601
2023-09-16 03:11:54
37
59
8ee30fde223cdd79ebc7d114809a93802ac1efeae085c5afbd803211bc148caa
2023-09-08 23:04:31
2
59
0ebecb2f209ff6f2c122e5ce790850d0e12337f528b2b7b47e43b31f8098aa9b
2023-09-04 10:04:51
40
59
771a8f83a0c6f08b2060d86fcbd40d36ee3a681beadb32ff6f288e2648c64bf9
2023-08-27 12:39:59
32
53
0a94be3e04dfa86258a417f7d440bd08409b3050632819d166c937c05c20be38
2023-08-02 14:11:24
20
55
7ac10d0d0a3b7de3d7923fc71469e167bb69a0c62fc6298cbafb07d2c354ea44
2023-07-23 22:00:50
37
59
8ec6b5abd70fc89f9f5e9056c769ef3dee927f1e9ebdd05dfa21d5a130245c5f
2023-07-21 05:04:58
37
59
9b4270e0c7aaafe373c3cd844209962cf0cae231c074772b4fa40bbf5cd5b023
2023-04-17 16:21:01
40
59
67b7e1ab8088cfa50d8856642eed95a581f232f7fac6213966ced2678931a9bd
2023-04-02 12:53:06
15
59
63ebaa4f5b0be2c2fa5599390f72eb2fa2478adba786c1e9f6f0992aa3c6d38c
2023-01-22 04:40:51
36
60
a791f18b85518f2b4e56c89d164a03d052f326345bb19a67651b5e5d542af94c
2023-01-06 04:16:35
37
61
85d29f026fc215810f9a2881cda4fba7c2fb3b360e016a11fc49ae46ead7b548
2022-12-25 01:17:47
43
61
7bd6652c566de04a37bf020f1a5c1b9275ff30322f44cce8d476fa61a6bdda16
2022-12-22 09:06:45
26
49
7dbd3520667ee683404aa083ed745db5f26c4db5769cc21fcbfdb58932a802e1
2022-12-01 18:29:57
23
59
49794020853b22f4dee17a8ac00ca2b29a68e48d2af3560dfc2692dd2fa2da40
2022-11-20 06:49:28
25
61
564f929bfe83cdc77bc0ca437088d91d6ce313f860b6ed3bc42c91c7ec91c679
2022-11-07 19:22:43
40
61
93d3b04a3eba1bf356212e7e04456a78bf18f3c04ee9a05117ccdfd0a136846e
2022-11-07 11:19:25
35
57
4abe558249e2111b31243591dabe8e9637364a5f0a4b5107a826530c937c8be3
2022-11-07 10:17:45
30
48
7157a9c800b3d8e6047acc162664fed85e700f6d29be67ebdaf9bf7d06d1124a
2022-11-07 10:17:35
39
60
bb82c1891d880d345fb0cf6c41256b539025ea4918ff296c63758b1778f5ab2f
2022-11-07 10:02:07
37
60
5e5cba747b369a9e287d47d0811c1b58cbf7c53b0a9bbba9751596407514e8ff
2022-11-06 14:44:20
25
61
8d2e248a459c6cdbba9e7871062d25fc63711f767499e4637674d338fa5cd945
2022-11-06 13:49:24
38
61
769f70cdf8cb09ff512cc72dce7274d5ab0e7bf8f3ccca0b4248071291475d85
2022-10-04 02:30:20
39
60
013c4ec5cd406c901883d0a6012c23e0d138280819c54fb4a7ad278d90a5b3fb
2022-09-10 01:53:19
39
60
7661754652f66519bf794bd1ebefb522da65f0e3ef52dd46c7621adef707eccf
2022-09-08 16:46:54
36
60
9700c8993d5f678dc52e1c2701c531398fed74f2fba8c88739187d2fe200d786
2022-09-08 16:27:07
36
60
3f987b44c9679102922d69d9c68ae1eabc56fec0c0d101fd2f0bae74337d6f8e
2022-08-19 09:14:37
20
60
8e2a1fe05a5aedd02deef7d96b75c374fe7b9ac509bba028dd35235c03f3b441
2022-04-08 13:34:40
37
59
5315f1075bc3cc8d28d3c1979dc7b3fa5b8b8428bba15465fc7d9f5112b6be4f
2022-02-27 22:17:43
21
58
8e392fde0145b6b89725efeec743cf12cc18f00be08d585793e13f7abf715027
2022-02-27 22:14:27
10
59
52556af93f3e6bdda00531e9ede218cecf2d19e94b35145507577a6c2d5e48f4
2022-02-27 22:13:15
10
59
136084221223a6c0934aa4a51abf340ca347072b3e826b1d60d9a64600b3a118
2022-02-27 20:41:41
16
58
52f56f6daba7c27d02a9ed38e8630d7aee4ccb401ee86529f65193cf29bb3956
2022-02-27 20:18:14
17
58
34c7fb7e8412019f030306368181ee825eb26d8045b707ae4ac155b173c04f75
2022-02-07 01:28:08
38
56
1510342f427176d9cc5032a7f9cdf5ccd38486b0dc3e75316b4f052cd841803a
2021-12-20 14:47:09
35
58
62db9f81e6daf96897a40d9381d6f70e59d65aecbc1b38c0ab6532f3569fbe78
2021-11-09 12:15:03
36
58
21062145f36a21cd7d8de7066f18be71f3f5bb16b1347c6d1f1065f627744fe4
2021-10-28 16:02:37
31
58
12d62d5f4454d7ae8f042bfa80d3b6888c8c70600ed448aeffa2c0706f7d80b0
2021-10-22 17:46:56
33
58
9c9863668163cf48546d6bd981c1e78d61375390f2f96c4efcc770f68126e314
2021-10-22 17:46:56
32
58
d65ebfe0f6ced5f355df11f7e97fc5359fef45b39ea55f378c1def01e5318cd8
2021-09-27 00:12:45
16
58
e9ff01384f970a846b1f265849b7da6fb590939f64d06682d28715dc00f6b8d2
2021-09-23 01:36:33
2
58
c251c07ce7acced0ff58dc4e36ea2b57e3e4d5db4689bcf0e844409788adf281
2021-08-23 12:28:24
10
58
992c01457632579df77d6ba7b9e9fcc6a7aa5bc889d948570a2becbb87f2f521
2021-07-23 11:36:55
34
59
f55929e011b4c439b9f32b206d6f899a89ef7d65ef2a507556605ee4ae562bdc
2021-07-23 11:35:47
33
60
1808958095cca63b70eeaacbcde7003ae269767931125e81da6b27142b2cff04
2021-07-20 05:33:57
36
60
1906595a9513ba6338174ed11a0744afbb949bd32a81e4fe6b13113b6204be27
2021-07-08 17:13:02
37
58
1f1bb98b7e4e23913ff25b50d1ffd44e6ef447053188eca255d9bd0378602625
2021-06-22 01:08:37
38
60
b23d370ff0010718f12efecf5ec62487ee44ec8fef006cf2c00ff12689cb3c39
2021-05-30 00:09:18
23
58
1b48d656d04c7eab2e61ea190bfbb4b32dd3b1eab479b1f40d72411925c12b4d
2021-03-22 12:14:05
38
61
c47cc5f160915b2675d1cdc7560d070cb844f6972a3735e4979d41d0a06a637f
2021-03-11 12:49:32
2
58
369710a02a926fd7bd363bf5b4a1480c14639a1b8676011c0ac8da84f92b2f94
2021-03-05 13:11:25
12
60
ea4215386a9203383ecbf67e0395f8d91ac663f22194cb0ded4dfe8bcfc45155
2021-02-28 14:49:36
4
59
5609f768f35ad35a3de649fb184271ab3919653bfe9784f433495a24753872d3
2021-02-28 14:16:02
18
60
b9dab858fe67de6d3abf9d15321c304356c1c675894f1058cc53c7a8130c4595
2021-02-28 14:12:27
18
59
e0f6cbe43f3175e78cdeee58d055401e66ac047dfe11470bf2f7b8c8c8241629
2021-02-28 13:28:23
8
60
0d46033d4ce789fea3dda90b5f1f8c3fe195935ecc251cdbefb5ea1def5e79b5
2021-02-28 13:10:09
17
60
af1a0fc0f8c75193e8444b90cb8ee4f97bd0913d6c089d0d6de3e5afa934f160
2021-02-28 13:09:20
15
60
ebd5c769ca6018680cbc8a2eac80ae3aeec6920739e29ca03d056f16d8e5d2b8
2021-02-28 13:09:20
27
60
dd20e10204dae3a83f2957fc8a24e867b29be53292307fae646bd2b50f4cc977
2021-02-28 13:06:05
27
60
a06e61d280b49525e2aebffab4655f78ea40f4c3be99f984e100c5767a7a00d1
2021-02-28 13:05:36
18
60
ed306b19851792b34e7d5c246f0cadd232ef7686bdb0d45ee8e13700a045137e
2021-02-28 13:04:28
26
60
e8c6cbb5a4c34e7e8e25ebdbea40a4269ddec6e20e966f381661ec1a6c4cb67c
2021-02-28 13:03:51
21
60
42cfb2c1f3d8e1baded16492b30403c6db5d5f0c48bd944d97a008d41f3e96b4
2021-02-28 13:03:06
28
60
461bb1eaaf21f86fee41cf0430355c0322b35d8c4317708f0fec791213492c1e
2021-02-28 13:01:17
26
60
be3bb008841984ae249ccdb239f49c342f5624fe0cf8c316b813eb7e802c27ee
2021-02-28 13:00:22
26
58
bc5b523a6157285c6fc40b33ab8e735021645bf09642fcac955dba9db75a818f
2021-02-28 12:58:28
10
60
fbf82e37d1914c9dfbf5a35c43c0933775f65b55467cfe6d26fbd6818a5ac7c6
2021-02-28 12:57:17
9
60
7a1f4fb47869110a68df4eb41766fa0c8111b15948e038b7189f54f98ff9c4db
2021-02-28 12:54:19
12
60
18af6f199af4231e4e42201952b875f2e1feae46ba113a0cd62d29ab91e54b9a
2021-02-28 12:41:40
19
60
2e31d46a0b446edc13744e890826e68a1e00dd4c6782a8493ee1bd441321c067
2021-02-28 12:39:38
19
58
21f9451c59d0a4c23510246b7b4e78a69912df8ca57ba3d21488ee9c0291679c
2021-02-28 12:36:10
22
59
5df64f05747253e3452e1df5d5a4ef79aa7dd12237ed36a54c34a3cc7f0ff97f
2021-02-28 12:06:24
37
59
b8a149bd3107c8fd0d18af13371c9f65f215df9bd8de916882dac8a4386947f2
2021-02-28 12:04:07
16
59
f14af9afe1cd5da9913e2cac332ba72baa36f2ab9f39675f38d5f00214c18c3a
2021-02-26 19:19:21
13
60
b281af5b9e44d621152457a5a5faf25c6314e6d5e68029ee18ff217b28c55432
2021-02-26 19:16:53
10
60
f8f3d2fe29b1e9ed62ca952d5499556696f94beae4959f45f9d2d12f3dd13988
2021-02-26 18:46:12
21
60
8e920c05f28028def82a0528af5050a4ba12d7b7cf92cd0078f52589e2750dc2
2021-02-26 06:04:05
39
61
bb6f6d3a4ca8259c97a04f2f39ffdc810e46941363643411c0a6248a00324b83
2021-02-25 21:32:48
37
61
f6bde218f965448df3126da579aa4614b471857a99113bba89dd9629b5aa1885
2021-02-21 21:19:03
38
60
5ddec698adc390c2f725beb0cca68aed8bb197848b595157be416249a84d7ec2
2021-02-19 04:15:32
38
60
12a51a78c65de96cc1413fa178eb14603e8488c450a6d76d55354a4556ad3a84
2021-02-05 10:51:27
23
60
4028150d9ffb1a098c0363bfeb008adac98064ea7c1971f853fc4b975228eb63
2021-01-29 14:34:50
18
56
074bda95bf0834ab5b6616c4a3941c21aedf7734292f6f2cc7772407561b86bc
2021-01-29 14:30:00
34
59
f449c73bd17ef155953f636f6be75d38069e9519b3d5d6ca6baef822bec274eb
2021-01-24 21:02:27
39
60
8bacbb447c3032d8077937b39cedb42281b488ade6cfab93f46496ed8b5a0564
2021-01-20 08:49:41
12
57
db2883375de9f0b7570bc9d1b668aeb4ca32641948492903479e1e46bbe1e3f0
2021-01-20 08:44:20
18
59
8555da5724d8e3893952f3fc94066e3589c2975515a935eaa80e3915e05b4ef1
2021-01-20 08:37:17
18
60
79bf819c7aabd3c2b4557b3578762e09038affeeff630bce053d7f58ded2c7fa

Rule Matches per Month (last 24 months)