PUA_Ressource_Modification_Rcedit_Oct26

Rule Info

Name
PUA_Ressource_Modification_Rcedit_Oct26
Author
Tim Rauch
Description
Detects rcedit, a tool used to modify meta data and resources of files
Score
60
Reference
https://github.com/electron/rcedit
Date
2026-10-01
Minimum Yara
3.5.0
Rule Hash
21b9440638976135f6bd8b74ee571daf
Tags
['FILE', 'EXE']
Required Modules
[]
Virustotal Matches
https://www.virustotal.com/gui/search/pua_ressource_modification_rcedit_oct26/comments

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
2
Clean (0 engines)
13

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-10-09 22:06:36
0
72
8cbdaca4ac04c8d3d47609a622f12af61b7fedfff0948e8413e8c10d11fc279f
2026-10-09 22:05:58
0
72
005d76a431a696c73ac3cfacb71f5561fcf61a99137c434eccdd25632da0c832
2026-10-09 20:35:12
0
72
210ea2cbc0271424eb430c57363d5c5e7d15b163d8a9bd911196c79a84856e0d
2026-10-09 20:35:04
0
72
2ed6ce6524fc34816233319047d1ce931cd0fd2ca74a27469846f80c274c3c79
2026-10-09 18:58:55
0
72
be685a54ee7ced6dad6876eb75f847fdb458e76ef797a52df9d73d80e9e2d79d
2026-10-09 18:47:16
0
72
cfd5656593c4a7b5cb7e5e0ec26d96f1c6cd26752f428452a191c4ec5b96820d
2026-10-09 13:50:11
1
72
8e7e4ee7a9f2478b0a2dc3a4f5496e04cdc4a8035d8cb72f54a15e8d764c7b96
2026-10-09 13:50:11
0
71
5d8fafef612ab0c1ab2b241506c7113127c67423b6e667b4714581c6be9d7203
2026-10-09 11:33:05
50
65
bbebc335e92928bd411f5178f467890dcb20b5c68cc0fb5eb5497290e70bfafb
2026-10-09 08:10:48
6
71
c9dfd9d9888309cd2338b6eef69049c54ae8158048e4c859479fe8883695fe13
2026-10-09 01:23:18
0
69
3e7801db1a5edbec91b49a24a094aad776cb4515488ea5a4ca2289c400eade2a
2026-10-09 00:08:31
0
72
9adf1876e9042db05d4d1d76d424beb3aa254b29daab3637807c388cca36b521
2026-10-08 22:00:36
0
72
70adb03c56f56b8f6bc43bc12e218458a9a916074a407b61bbdc41128a46f8ce
2026-10-08 22:00:17
0
72
5337242447876bc309591f6489f1313e42d4eeb4b0f710f5fdc796c8099a9d89
2026-10-08 20:33:53
0
72
a14960fee3d8a29e9063b08b199fc3f6251d7bae68732fb073bd6d6bd08b0a81
2026-10-08 20:25:13
0
72
a326c5c90101257fe775d0d049e71d04b458146087c67f1b3efb0572a4f7bd73

Rule Matches per Month (last 24 months)

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022