HKTL_VulkanRaven_CallStackSpoofer_Jul22

Rule Info

Name
HKTL_VulkanRaven_CallStackSpoofer_Jul22
Author
Florian Roth
Description
Detects VulcanRaven CallStackSpoofer - PoC implementation to spoof arbitrary call stacks when making system calls
Score
80
Date
2022-07-05
Minimum Yara
1.7
Rule Hash
ba2f9faef739ea7cb0738fb025f0176e
Tags
['HKTL', 'EXE']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
75
Suspicious (< 10 engines)
30
Clean (0 engines)
4

Rule Matches

Timestamp
Positives
Total
Hash
VT
2023-12-12 16:35:02
23
72
d93e32955a37049099ea0be2ea535fa2339debae96421c6a04c3360af4c9f470
2023-11-10 19:47:45
22
72
1b095abf0d156559010b35f53cf74db94ef6a0710352a169c19dacfe9abf7540
2023-08-27 10:05:19
32
69
ee7c46b5d3169563cf1c8b967678c61f01a7a1e5d1808f55e1ff5c07bc7aaf28
2023-08-13 02:55:46
37
70
e465349bb5b899beed4831c7fa0233a95c0017ed2595a4f1978a85254054a2b5
2023-07-21 15:32:07
42
70
2467de13cf941eed87bf4ca7e1b7f979439ba10061ad6983948fbffaf3cd3c35
2023-07-21 13:08:36
29
71
7d666dcb7be5a72c3db8adc814a92718eb7954902d67106802d69170e65e6903
2023-07-12 13:03:59
22
69
0f81e82eecb8bf8529558671d2f00135fa2203842754d5bc7951fccd35dab691
2023-07-12 13:03:58
20
70
8ab83f8707038485f70c9134ec197ed029d5f6083b5692f348956a3a3f62d30b
2023-07-12 13:03:43
20
70
f33dfbc982a8b3dda5464097ff1f3a298820c6ffd9aaf3f971d5143d2f4a6a64
2023-07-12 13:03:25
21
69
6784eb98a4081e3d0a85614ce3543bc90d8105d978ffa7b8a8370399e4982da7
2023-07-12 11:35:30
21
69
f4f6ed8d063dff1958443c95722fed7d4e9cb6d426faa0fd9da6fb7438b8aa71
2023-07-09 18:04:52
21
71
cfc44e90f5b72eb0af70761875d09b015e32379d252343ac29e31f281609e7b0
2023-07-01 10:22:02
36
70
0480d9daea93fbe1cb40239dea0c1d5afbdc14613c84a096b78e7e0e1e45c02d
2023-07-01 06:15:54
25
70
04ec5eda0fbeb4fcd2ca021f318ca89802ba9a6fd3e0a5d33ccd8f4b8d81fa24
2023-06-11 03:39:29
18
71
e09c1340aab2be66114afa99131b688ecff0daac328cfcc9f7b578b0379cea9d
2023-06-07 19:01:28
39
71
fa84ff4021b700686b8f36a612af2f02b20a1c52f6048befc2f786e5e0dc2f1f
2023-06-06 09:21:25
33
71
58d388f162a82629d94d1cedcdb55f33f8691b2d550b80f7aa09eb497e5c4dc3
2023-06-06 04:27:39
34
70
6b23a1ab7cfcbf384aa8d000bf114d8fed310e74a13a74c7b6f34eed3a41146d
2023-06-05 21:08:07
40
71
60e652188cee4da8373e03169a7fff77ef45a11067508da6868628bae8f2541b
2023-06-02 10:08:44
35
66
5b787eadd4c7b2e7a7ea8dc4a95bed6d3e99e31e86be18f8ba5899bc5834082b
2023-06-02 10:02:40
34
66
e0c756b26f25a9ac45bb970467670746a7610f63e8d548322d17939d00450824
2023-05-21 15:11:05
38
69
806739961c0496ac5c87674016f3ad1356ae6ec65e339782a7e37b346da3b788
2023-05-21 15:10:53
39
70
444b40e7ecabd0c20f57cd1c06b0b5c0064b7cbb106e5764cbf8bcfe10494e95
2023-05-13 17:08:16
14
70
4574ef40c88b75cc22c8256333892de9b7a544aad5f6355f92fd936068f3912f
2023-05-13 17:06:15
4
70
7cf5bd8ea277609531e95519997cbf69023c4f8052988f769a1c6119ecb8f9d7
2023-05-11 10:09:41
34
69
522b4820aa90e4e8c4b2fbd599249c1143e368bbb94e57f65c92563a98e4b67b
2023-05-10 13:06:25
26
70
763a6e232d948ed71bfcc83ad4e63d159eb88800f74028ec5ea0d71d34595a96
2023-05-08 11:17:51
35
70
317aac415f54f4843a6404b7947d7181999af909b003ed4454905f2c81ef5598
2023-05-07 17:13:20
20
70
021623063ea27b5434ed66be31089e2ecf364451b936a84cc30c564673d370d0
2023-04-20 04:18:50
31
70
36903b6c4bce613d5782a0911bfabb06649d51c6d3bef51245af838105d4c88e
2023-04-18 13:13:07
38
70
4190df596a52b0bad12f39ea1f10a135daed2fd81f54145d5f5c09ecd15d7eec
2023-04-10 02:11:04
39
70
7292fec1800de630e89eb53a7d968c59624c13f315ac809b4a2ae0c6df0cf98d
2023-04-09 20:13:44
31
70
7dd5e302dcbabafaa90a9b2d2a01ffecc975f4b2c260835e3a478cc5217a724b
2023-04-09 17:17:10
35
70
9e1631ed4e60a46b15a500b3c0fde1007de8c7d1ba91224db340ecd0916f4641
2023-04-09 14:14:50
29
68
5fe7ceffa0e4c9f693ecf3ff6f4dc63bfdf10053fc19bdadc53207dfabd7de21
2023-03-31 12:13:43
17
68
72896e481674088e4ceb4e8e92840d0811ca265493ed488a09346f7cc1a1a911
2023-03-31 11:14:58
18
69
b9a15682eb276f50978567e03146dfc3f3fc590b437053aca319d0020fc4ae52
2023-03-21 14:24:56
15
67
ded1d2ee5b3d4ef79c3db578d8b009f5144ceac3e4d2844c59da509c4c6e1e43
2023-03-16 20:45:00
8
59
7d0e3f0677650cd5d453c2ef0980edea0269e5be530f0c50cc82ede5cd573344
2023-03-16 20:45:00
0
59
2edb6b6bc5b6cabf015787d43ea55fe3b5cf042c05e41365ef012f8fa07d60fe
2023-02-23 09:16:46
14
69
33d6eb7b415dcbd43107de6132082951abfd608e15a7a0f66d768f889ac27e65
2023-02-22 11:25:00
18
70
1ebea125fe83bd83228468ee22eaf11e04d3e443d23afd16a39f6185ccb82df4
2022-12-13 13:46:33
25
70
3454da3294a79d98c10193dafa5d0b955f8c502b0fbe719420af6c1c2936eb65
2022-12-13 13:46:32
23
71
20f6f4d8e9c6546c9d499e358542716fea469dc96d079c8c8e24faecadf78cc9
2022-12-13 13:46:32
25
70
50bf5d5b83521607d760a6e943f66efe9dd32c8e6c930f535f8d4e9447816cb5
2022-11-24 16:22:22
25
72
7e2263a270a0d3463ee3e7a250d46e693976fb7aa02e2e0741be4ef050438177
2022-11-24 13:05:35
21
71
f28ba265efb95d2d9e6e9be2198cbad2244a67dbeb2fb403e9f29e645cb9617f
2022-11-24 11:38:42
17
71
76b2141b46427fe5fc891600b4a3561371ab45509d446e852180f1cf4191a66b
2022-11-24 11:37:30
25
71
5d00a9f19a9c73c8ecba0183d695be57d3e6ad0a921037b8980c559bc9b486e8
2022-11-22 20:09:16
30
70
2138f1917c3bc94ca76befa53e1b622aeb7fd7cfa9986d8aba1c97e65df2c023
2022-11-22 19:16:59
36
72
dd23b8d2ce3e6ade831e5dcbd4a3dc15df70f4b0ada840384ab88c5c672b550d
2022-11-17 16:26:37
0
61
d2cd66f019ee994d0ca8b2c5d919ebf4c73a7988fcbb09071fa7b993ae1262a0
2022-11-17 15:37:46
0
61
502ea50b706716930685cc952c8c4b76b1a3bc56fcebe80a693dc592b1bfcb83
2022-11-17 05:24:36
17
71
c448186224997f1d7c170e12f6003243c76983d6368bc0a03c200df44a37dacf
2022-11-13 04:15:00
27
72
c15bb2824f7564b890f7508dd719737962ad45625bcc476666b78fd65fc62e61
2022-11-03 17:54:10
21
69
58cc317dbbb25bd62b01b922cabadb446a840d3456dd861ff635051e3095600c
2022-11-03 17:54:05
23
72
feaaf1585ec41e8a6a25a71e701b05760401d6bc4c4fbe5c598313ec60d3f500
2022-11-03 17:54:05
23
67
af177d4aa3e6d0d0b6a23ca6e51b60dcd7cdd676b91bed87919c71758f98e03b
2022-10-31 15:42:51
18
72
e83481debf5251d2bfef95f2add66797918bb393758d1d2263caf32085fbe4ec
2022-10-31 15:41:43
19
72
2c2e86d8c1bc4f7ad7cecb793eeb9295aa3ea46a2e1906ee1e20f8a2cc9cdde1
2022-10-31 15:19:15
6
72
030f396a6d852566edf79be21bf969b055686c98b2f4c421ce771b839b7b741a
2022-10-27 18:17:00
16
72
8e6e1d5236b964170e420411842e8d18b7b956bb69e133b7ba695b6831743cfd
2022-10-12 10:08:35
2
72
293ea746bc22cff5bb4abfbbf260739ff4f9e2958971ea2524b894a27701b13f
2022-09-22 23:39:46
16
67
32bf8c9cef8f1d8880c408464da0b6150690cc1ddfa914cb34082cf55d2180f9
2022-09-22 23:33:18
17
71
ba41a2961279e342c784e9ab77e967cced26a3e1b2abbbff692b1b5d2fefe3b2
2022-09-21 23:12:53
30
71
be622fa57ad77310cb4c9ed8fa8a2a9f0db06f3f07e02e6b95e83af7b4b05a40
2022-09-19 17:13:10
6
70
1b0d1fd6876a0e0bb95299f7e781d80f35ab2caf0097b6816a7c169b53cb0192
2022-09-14 05:07:26
22
71
b9f6519d2add618b62befda29a15b5c2c73a785838b937c7cce9698488020723
2022-09-12 15:00:42
23
71
b77399f19e33191bfcb3f3ed63122b730dbc7eb73eecc8fafc8f2023fde0742f
2022-09-12 14:55:19
22
71
96890f2b48ed2b79b57c0955033440fd21f0e3eb15fd245da8c7d08f091af090
2022-09-11 16:10:11
31
71
5aaff354c73e03f770f47642d405fb45380c59bd46030313ac03cbf2a706d5e5
2022-09-01 14:12:41
18
70
abd7624fad15be9fec1e194b611630bc7763c0560a74b5be7004aa9fc4491c1e
2022-08-25 14:36:34
22
70
8fff06805609947dd608c8e11a2a9349024a1d0c834799e4d18206a548b7d468
2022-08-19 23:53:46
8
71
0c31114b80ddddac6e1d067c73dd8d8c46ded313eb329279c751d09ddaa6614e
2022-08-19 23:47:14
6
70
7ab722bcacba3d3e45beb740b3753b335bdae8b1e73091564bd0cc9cd8cae1c6
2022-08-19 23:40:24
6
68
ecfe713e1af9d4c4f0a8ba9edf8d7d885d92566002e5a17d2b10df487c8933a6
2022-08-19 22:11:15
5
70
680cf046ed93339ebd68ab7879a93d8abf1d4e5dc0ee08a57b196682fdd6e3c3
2022-08-19 21:24:48
5
69
454c069e914303de3fe9c07847e0f9775f1f0d1724e75b0f92709a41d750268f
2022-08-19 21:11:54
3
70
cd8afbf3fcd90314894f7414edd30bc6e0a71fee1c4c4aa7cf8443b1b4272315
2022-08-19 21:10:14
5
70
433cef7c84f11f155362dca45991ef80ad23fe0f5ee16cd1b9db90bf386f7c6e
2022-08-19 20:35:11
5
70
0924a95e3925aa0bd5d33dfd0890f4d4ba0b9b765fa98cbbe9992f2f2c5aece5
2022-08-19 20:27:40
5
70
23988ccb37fd54e11406741bb8f93bfc8074ae3205311b05da8c7e60093b24ec
2022-08-19 20:17:51
5
70
c4937653573c96de90a146b89a2c97f3a22f5ecdffdbdcff6c6f9fbcfd774b2e
2022-08-19 19:47:09
4
69
8869a6863b95140839027927fb474425a7fdd29e4357b1d2ef301ec139f1390d
2022-08-19 19:38:14
4
70
01dacf922c7510b81ab2670da0e5d7d83952fbb55ae2fcc2c4c6937fa882ba49
2022-08-19 19:23:30
5
70
ddb30e65ce19d5bce5938f637de76b01262472a542bf71b2873bbb01cc660d5c
2022-08-19 12:49:52
4
70
532d4a63d87d30eea3a44f83b6ebf60fc3f193d849f8a543103b4faea2a16e79
2022-08-19 12:39:41
4
70
6456f89211ffaf9d65b87a6534b220ed95e5346d95dce55e9c078d1ef5158a00
2022-08-19 12:21:44
5
70
ad0ab1b2e4e6786a657f514d765862209150758c5c306f959f5d22a9944c1ee0
2022-08-19 12:06:48
4
70
b5be790f03cd2a8d3fcb08ba61805cb0221873be890901df0af6fbd7bf67a236
2022-08-19 12:03:37
6
70
6f21d47289962e6f2c8be40f7b86d4c4313b43fc2472a9eb4b35f45e52099151
2022-08-18 18:03:47
6
70
db09fcded6d85f0e8503ca0016ba1f9e47e332c366f03377c77bbd5a0e2ecd11
2022-08-18 17:40:14
4
70
0b53516192625b96ff6f550d409da1adb77342c3a75fb437bada72b708f62f97
2022-08-18 17:05:35
4
70
337de0c7df6b105b44609932130633692b9b1b29c1d1e6e3352952f54dd0b90b
2022-08-18 16:51:52
5
70
331076558ffde8d1200f58495c35e9d8a70ce372a5fa700125d80b96abf56553
2022-08-18 13:21:12
5
70
6c900162f0a2b44388d3ca49cbe0542c6acc56c0a27d05e2b25a2a05f6a6a70d
2022-08-14 03:00:35
22
71
eaf4312fc88de272788a1e5ed1692810642da96cfd0e9d37f35fe5c0a8253a62
2022-08-13 00:00:03
1
70
f2155f5693751a5825292bd0da2411c54330604706ef958778b2dd1b47183c93
2022-07-29 16:55:26
8
70
87204a71f037f541487f3fb1393c69653ff81a47562a1cdb374d70f5ba02634d
2022-07-29 16:38:26
11
71
e4a2ab49ce4925caec4447221bc7352a05fce1098522b60b87c728b72eac12d2
2022-07-21 23:27:26
26
68
a1300ec44f2cae8c9aacdcf54510116b9ce6429330615d1e88775aaa8dd4a233
2022-07-19 15:27:06
24
70
a459566b347cde6a8b646f2047d89eb313372ab95f456faae181e1919cc0cfde
2022-07-18 18:02:35
0
58
b20561616dd8530dea43495b60fa9ba000a45832eb4b24289c7aa45bf2e6cd00
2022-07-13 08:26:13
24
69
08b0377a3f68906c532a294721cd0629a2bec4450955fdd3d8b9353c6441e203
2022-07-11 18:26:07
15
67
4420361984ed694c6eb82299f1faa919cbea7b22ccf946647b0a48b4154dd0da
2022-07-11 18:26:06
17
68
5248137eba76bf94d7aa0b7c8e6f95af398b4a91caa0a866d661931627260463
2022-07-10 17:36:54
14
68
23bfd2022e16feab0df970005a72357a232f7e878db834ca820fc8726e23fcc5
2022-07-08 14:19:59
28
69
87998b8b30ee073b12f439408a5c79650869677d45b9e5bae11fed754668e1c9
2022-07-06 16:04:48
15
68
c7130692419e8515486a07463637661a75aa49ca71089fcb371c297674f28c4a

Rule Matches per Month (last 24 months)