MAL_PoshC2_Implant_Mar20

Rule Info

Av Ratio
26.43
Minimum Yara
1.7
Date
2020-03-25
Name
MAL_PoshC2_Implant_Mar20
Author
Max Altgelt
Required Modules
[]
Rule Hash
902a7a3ca9606344e37e522f70a080ff
Tags
['MAL', 'T1113', 'EXE', 'T1136', 'FILE']
Score
70
Description
Detects a dropped file from a PoshC2 implant

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
55
Suspicious (< 10 engines)
8
Clean (0 engines)
1

Rule Matches

Positives
Total
Hash
Timestamp
VT
19
72
daa14a66ea56560fd0b4a282ee33bb65078986d91646f6593b53ee9a39df06bf
2020-11-12 19:08:50
13
71
4621345a5a0a03968d69763b9a470dfe5860ee96e2d7136b208236b932c6b3e0
2020-11-12 19:08:19
17
72
d3a0e04eb9c4aadc81d6523e8704a294d849cbe2bfe924c9867cdfb2cbe4be85
2020-11-12 19:07:49
10
72
9d75026c585725868a03c724d579935e9607741fae8224dbb93f3e75fef8c458
2020-11-12 19:06:50
13
71
98fe3fd6379e1274134ec3465d5b46aca34da4c6a9fce2fb36719b0c5244db4f
2020-11-12 19:06:18
12
72
23adc1eb87e6d12e4b0f1a1e0a209309a461c158e6b4473214b93962b5e054ba
2020-11-12 17:09:32
11
72
027d8d1d0340a98a11b787564ea652e41675e3f414c9e852b0a55511b4f012d9
2020-11-12 17:07:07
18
72
2c7fbe295a51d23e035b6868372d5da4917e077fdbfd79f26f81568524cb76c0
2020-11-12 16:34:51
17
72
14c2ab5ba72ded3501e474cf328753accbdeee32a5ca40606ee68c9527e55058
2020-11-12 16:02:42
11
72
a854134b49c4713d47cd4ec5b46ecfb367c8e97ef2538c43cb3dcb35b87964f3
2020-11-12 16:00:50
20
72
38ed0a276795ac264c3b3cbc6dc9126ce3ce14714793188d64490f003726b242
2020-11-12 15:58:43
9
71
6edc695a79f5431ba7a4d717ad16b8aaf6706f04919cd0503c08379c7c938076
2020-11-12 15:57:00
9
72
d61c2f2fa70b10ade136e8987794ec336958cc30420310a86dee1098fa90382a
2020-11-12 15:55:09
21
72
7612fc00117769d7c7617f9a01287a46da702d7068c4322f4ea75bebf8b9a375
2020-11-12 15:53:20
18
72
49f9c5f8777ac1a13b6d33df1882bff0c42058ff2cca7746c24753846a7b2e84
2020-11-12 15:51:11
23
72
f2d3b2603b252c160002a257ffae6bb6d6a6c2f1432e499157a67bdb11b4a702
2020-11-12 15:27:31
18
70
c8c297296bc70c7deb4e827f033f0ad11288f94d693d9e243b51f5215d199871
2020-10-21 21:04:58
31
71
5ac29e4a9ab409fb2db66991476475d8d4fa96bc6863d967e40f89f1c51cfef7
2020-10-21 16:29:58
0
67
0c4def9162f56b4d591f0a523f373991fd3b5abff4476fb67c496eefc93478d2
2020-10-21 07:40:12
21
70
a99664cd6282a5375d14333433f7257fba45e47df9db73f422bc52cdafc7a08b
2020-10-12 22:10:33
29
70
9ebf56504d8b2939ec30ee0428dfba7df0a19c3607eec99aec4d48007fba7a8c
2020-10-12 22:09:39
21
70
f6b59c3fdeda996faf11b2e8eb802f959de59c20c90f4c8af635739892569401
2020-10-12 18:36:12
29
70
f502c8023e6aef6f1e9785a11ac07b408acfd1a1e2c8f78503927095966fae90
2020-10-02 20:51:36
18
69
ebd2b58eedc93e4401938a8e559bc5fac647314fb5d7cb9019f76147ebe3ee54
2020-10-02 20:12:57
9
69
256b78db468fe9c42a29965b08e0a675844a9dd15a5b01f0401dd0dc68cd3a5e
2020-09-26 16:02:13
31
69
24958f2e10a907916942cad6add896dce94a401cc6e2810777841880b7b249bd
2020-09-24 09:54:03
27
68
93c991dfd7f881389b7f632a9b5f670a646ad0a11b9e10c5c2215ed3f7dc552d
2020-09-18 16:55:38
24
67
7cb004f1c6f79622609a8cbf15aa1c4d391c51b69c5947cd403204880e2592e9
2020-09-18 16:50:36
26
69
3500667e8569cc1b3ed3c9d9e98cf9572ce80a5a8466547dc06cf1b33a1e231a
2020-09-18 16:45:23
32
68
0184463430a671fe299827a336c262a924cf8855d1afd4d26289860fc078d842
2020-09-14 23:50:29
26
70
4b2bd597f763ef0eec1b23ce6b73f517997720ccf224cabad8c8f03eef51091a
2020-08-20 18:46:56
31
71
983267c975831ca8b732b4564dabddae308f0a4b0ae26b25816b62a95d93aba3
2020-07-26 14:46:58
31
72
6c7e848cb2a2a9a5da2d762054177d89791b6e4c25072349b4139353290b2fc2
2020-07-26 14:42:18
28
71
c67c8dde8cf27bf263b817e7e64c1c9c7d6381efbf1cbde45b37a66057ee235b
2020-07-09 15:06:13
29
71
b20df3aea573a116911b7dbea8ca91f41b3c583b627fa35a9e673104ac1b7d14
2020-07-08 19:21:12
45
73
991d29ebcbbe3e3c2b9cdfb12b3678a4d14d19320aa2e8aca83cc490fdaf5055
2020-07-02 16:01:56
28
71
81119ff462ebd24217b1a56bd6ad43c614640bdd9023b7fa9817d08d2f8cd503
2020-06-19 16:52:16
4
73
2ac3003fcf9f5adcba81c92d8f25045a28bdccc8254e8b468277b41d7bca8530
2020-06-12 19:27:09
5
73
c616a8d9bf0b1f1af90bf857d6d2fa0a2da068cf2a2d82ba8b8e34a1e8689fb8
2020-06-12 19:12:59
12
73
5c6a46800bd531cab3904dc7b85e3a9aa459d49c41418270d169552a08b4e4c6
2020-06-12 16:45:23
12
73
66ebe83a8eb6573e92bbbbfdb75c9f87d20e4bb2c5a5307b8f53cc5ceef575df
2020-06-12 16:42:32
15
73
8a16a73e6186c56bd878b382aaddfdbe20cf61a0f45612837b1dd655a9b5a101
2020-06-12 16:39:42
14
73
d96f1eb04f9354498e96b691f8e8330f31d5cf9c6e01f1fb4357c27ab64941f5
2020-06-12 16:39:02
28
73
3ba5c68a716d265eb211d28ce560031d3e9d3a6e9a77b8e5ef5cb7f1edc41819
2020-06-12 14:19:54
3
73
79b29b8b2d24def600d5d9ef0b556c0b83e0d3b9e700bf6070c9ff0e8182c408
2020-06-02 20:26:27
22
73
5f677db3426d4c7047adbc8c384adb8d5d36eab05e5efee4ee636a0017519c2d
2020-05-28 02:31:16
26
71
36174a46b0f74eb351baf49612e71c934068ffbc64b21134923498fff9b2ceae
2020-05-27 04:16:39
13
68
84a96e0f71e2fcc3749a1d931610621bb25bf035743f4d10045db31c83a57970
2020-05-25 11:53:11
10
72
3e3fa36e887e1384d12ee3cfc52334b8d5664a1afcc5aedb35ecf375f58d42d1
2020-05-15 19:37:54
10
72
b8d9d9a675c3a5b4e37abcb33274f8c548b51724ab425a3f7b90adfe4da613dc
2020-05-15 19:35:52
21
72
9073e645cc7dd41b3ca898a7fe41e360a04e986aff0f20bd2a7e011033616659
2020-05-15 01:19:04
33
68
c2b171dafd9b9577903645ec3253dd3fa88d08f624af1a4f4dd6cb90abc64e1f
2020-05-09 06:31:31
1
73
66aca6181d6832113790acf7af58be2b96dfaaf649914028ccb14f3f5f9d0c70
2020-05-04 12:33:45
12
70
08b9ec1205ad2f27b38d705fad023cdfd374e25928f7784608f4df51e0acd7ca
2020-04-23 08:42:56
25
72
6716dfc0ddab9dcd00d1d95f44b65282efd20b5575fe7c184469db3d2acb4370
2020-04-16 07:50:59
18
71
fe7e37f0e5e3151bd826d4b5aeb15637e014eb61135941d51983a40c2c45340c
2020-04-16 07:15:05
27
72
21a3b0682d6672adc1cc94b026539f3a61a6a3d0138bd82372fe85789c3dfa7f
2020-04-14 01:20:40
23
70
6c85e7c180598795bcc2e69d95ae6b46ec134bbba3fb530547b09d9303e95183
2020-04-14 01:13:46
22
72
4e0a28ebcc8ec1ef8eba536d2b84dc951d58bbd5d9d3221b7343e50e76dab8a0
2020-04-13 19:43:53
17
72
33a87c2a0e430c71e0aa3fb4a260885afb61bc13038101a0e5f080cea33aa664
2020-04-12 14:07:09
19
72
65d10057fa0846ae7578c9ad537ee7970d8d4db32f2d4699c9eb98e520d46be1
2020-04-06 06:41:34
17
71
9d63a3b2902e1ea350b2f6e6cb75c8654786e7f43facecb0a951d1acd6f73c98
2020-04-05 16:06:42
12
72
8ae8b5cad760108d44934aff06cee8218446742b36d4a9497359509750a1aca9
2020-04-04 03:07:18
4
72
fc303788f5ffed2f7d2e26129de8784943dbaa67dc7ba92382e8192e0898d393
2020-04-03 06:38:44

Rule Matches per Month (last 24 months)