Rule Info
Name
MAL_APT_Q_27_Renamed_Regsvr32_Specific_Execution_May23
Minimum Yara
1.7
Date
2023-05-04
Description
Detects specific command line flags and commandline order of a renamed regsvr32.exe - used by APT-Q-27 to load extra code
Author
X__Junior
Rule Hash
69a5697824f3d9c8fb8ce4869ec2b355
Tags
['MAL', 'ANOMALY', 'T1117', 'APT', 'SCRIPT']
Score
80
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
0
Clean (0 engines)
12
Rule Matches
Hash
Timestamp
Total
Positives
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR