MAL_NK_Malware_Hermit_BAT_May19_2

Rule Info

Name
MAL_NK_Malware_Hermit_BAT_May19_2
Author
Florian Roth
Description
Detects malware from Hermit report on attacks targeting South Korea
Score
75
Reference
https://s.tencent.com/research/report/727.html
Date
2019-05-27
Minimum Yara
3.5.0
Rule Hash
9b58cbd43520b283c6a7fd9efdf10e9b
Tags
['T1112', 'T1543_003', 'NK', 'MAL', 'SCRIPT']
Required Modules
[]
Virustotal Matches
https://www.virustotal.com/gui/search/mal_nk_malware_hermit_bat_may19_2/comments

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
5
Suspicious (< 10 engines)
15
Clean (0 engines)
13

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-08-03 18:47:25
10
61
37b485ed8d150d022c41e5e307b8c54c34ef806625b44d0c940b18be7d5b29ce
2025-12-24 11:36:48
0
63
3e2a0bafbd44e24b17fd7b17c9f2b2a3727349971d42612d55bbc1732082619a
2025-09-16 01:18:33
5
63
0aab4f6b9f0b38fc1abac2fef2da229c4a9182125bc19069402f3526a3c415fc
2025-07-04 09:34:39
0
63
8c29f9189a9ad75a959024f59e68c62d42a6fd42f9eacf847128c7efe4ef7578
2025-05-23 10:36:30
1
63
bd699ed720e2bd7085b3444cb8f4d36870b5b48df1055ec6cc1553db3eef7faf
2024-08-21 12:21:21
0
64
6392c7dad27384ec6fc616890692da949ae996d00d0ad32a72323c191243b7fc
2024-06-05 14:03:49
10
61
b792867d9275c0ed64cbb501431fe0368c08ee3fa284a72590e46881241b2076
2024-05-17 10:28:57
2
64
ec70b513828b199d4dd1b5a5674b5daf4bfd968fdda0fb5ea0aaf3324c572b39
2023-09-18 09:23:52
2
59
085cdb09aba0024c0cadbefe428817829bbe4ab0f68598572ebccc2f6f25e78f
2023-09-08 23:50:54
2
59
4eb7611cb0dfba53733e527818e5ece76ac032c6ef89338ed8335bf275a14c97
2023-08-18 10:32:18
2
59
a9514d8c7d9e6a58354de7ef04672395b8f65fa1e5457ed0e53e41a6e4f6b72a
2023-05-09 17:11:41
30
69
cfd3d4b534a9099504d73d76a7bc11dda1ccfdf39c18566427a843dd30ebea24
2022-12-06 09:28:49
0
52
52df0021852e7286413c6c91cb76b53242e5916485d3855b9cf80c7e2351f7de
2022-09-05 01:54:25
1
59
cd1638b812e22a1660b7a91401bce38269fabd0bfb95a060b2e430ff8a642ed6
2022-04-08 13:13:41
2
57
5cc43bc4daeeebbd5dd2f7e32cf804bff69901dae2a08c98b7e79db525e56c31
2022-03-28 18:43:47
0
56
ae0baa24ab184d9bc8054329b5cb98d3bd60a8ca18cb3549ab73c07e91c79c21
2022-01-06 17:24:19
3
57
b6845a436df2b3a79dd1b0e4a57a06c60f718eee0272a3eb81183ee4750037b9
2021-11-29 08:33:48
5
55
f01e440764b75b72cab8324ba754d89d50d819a1b2db82ca266f1c307541a2b0
2021-09-01 17:16:54
14
57
b48ef6d00071c09b123278a12db00319f9c05ae58589e7ee739d5ff21888c81c
2021-07-29 17:53:58
0
58
4876a41ca8919c4ff58ffb4b4df54202d82804fd85d0010669c7cb4f369c12c3
2021-07-29 15:22:59
0
54
dc4d06ecfadeb8ec1dc771a6b793f93114a23b7623ebcdbc119fc09d5819bcef
2021-07-11 23:33:18
1
58
37d8c5ce01bb0ca86673cdea782db09e0c54ae2643bec83eaea587a7775d0b53
2021-07-10 00:21:21
6
57
2c958cd3838fcae410785acb0acf5a542d281524b7820d719bb22ad7d9fcdc7c
2021-04-02 13:48:50
0
58
00c3f4b12639138a59d58cbb9143703a6a72e5df068ee7b78928b2e35dc6c6b1
2021-02-27 19:33:07
23
70
636eaf8f7c7e07d4f9420a2c5f041ada728ef898e367defeb15fe6dbc10ac96c
2021-02-25 02:56:47
6
58
e4226645bad95f20df55ef32193d72c9dafcf060c3360fd4e50b5c08a986a353
2020-10-07 19:29:13
1
59
dc414fb5cd0ae5d9d2fad2fb3fda1de0e46a5f29451722f56abd356f2afdf36c
2020-09-29 03:48:11
0
59
020c5f9a71e9c53c60311b5afb7294bd0e7f3e0805044766690e90a46338f197
2020-01-03 06:46:08
0
60
1c8351ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead54155968
2020-01-03 06:35:08
0
60
f27d640283372eb805df794ae700c25f789d77165bb98b7174ee03a617a566d4
2019-09-02 18:49:07
0
56
fb08208012a9152ff078ddd78149c726334312a05462b19fc840cefdf3bbce6a
2019-08-16 15:11:43
2
57
4d42175efee9791449a92ede67596d52c7ac16315b5f3e01ec3a4b357a6e5ebe
2019-06-12 04:22:04
0
58
4f166d95a91d3251d086f6f0918a8f17cb44a353f800e07dc8eaeb79ff8e4036

Rule Matches per Month (last 24 months)

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022