SUSP_AutoOpen_Keyword_Casing_Anomaly

Rule Info

Score
65
Reference
Internal Research
Name
SUSP_AutoOpen_Keyword_Casing_Anomaly
Description
Detects obfuscated Set-Item by casing anomalies
Av Ratio
33.34
Author
Florian Roth
Tags
['FILE', 'CASING', 'T1027', 'SUSP']
Rule Hash
4d61be88a6790acf6d0ccff14a28bbcb
Minimum Yara
1.7
Date
2021-08-13
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
72
Suspicious (< 10 engines)
35
Clean (0 engines)
0

Rule Matches

Positives
Hash
Total
Timestamp
VT
22
aa85a7c055ffd578cef839ab82a052e55c38040c53d3580983894ee319634fdb
60
2022-01-19 00:56:49
9
3b35f2a8c9b6838db125665eae389ae8e957a1be243b32c5c9e4f9ccd8a7d4b3
59
2022-01-17 11:24:36
7
c713f20c8edebf53ae680c890351e15d2471370ad3c878e7ea4179c50a0335fb
60
2022-01-17 10:36:58
23
669595f354372b2eccc04aabfe9d49be073e38b394fc0cb1e4ec003b6b63810b
59
2022-01-15 06:16:58
26
e03a7b921d3ebd2e5d1f850933f956813abf8abd23d42451f2df9b32e1f8c178
60
2022-01-15 05:25:55
9
93d78b69d7bc8d34ddd4fbb19382bc7d873c2f09425294d1f6aa44a9045cb9a6
60
2022-01-13 17:23:12
8
cbfa5b1837edebe231e2cac443254bb837b8bf37148ea89df52b0863dde48ef9
60
2022-01-13 15:10:13
9
f9bd3a815beaf9e995e521edd22d17a06e5e1c4b1c2fdfa39f3837983716a70c
61
2022-01-13 14:38:13
6
a23cc30cee8228433d9e591e344e0c5f82a15735e606c1bae2d83bf421cea3b0
60
2022-01-13 10:35:56
4
e43ff7a390daad4113952891a23e1db51850ca6372c21b621fddff597984bc71
60
2022-01-13 05:30:06
5
a174609a593caf5f4f9f873f4d922c961b4a7b4c83537cab4802756610d788b5
59
2022-01-13 04:41:20
4
03291da83243416d5ab4a6103d5222fc98618aa32870e76b724982cd8917c775
60
2022-01-13 04:09:32
2
20214ef8eae5a7812bf391a67954164239e866bb38b51dddad5e037709689614
60
2022-01-13 01:00:11
3
23f1be0ebb817079b920a5dbef1b195c352501ce41f3312af7db3a98e3cbbfd7
58
2022-01-13 00:31:25
3
2e367fcfc6583efad45bb8bbc97a77f30853d11322335d14d3d3d9ff4a79ea3c
60
2022-01-12 23:28:17
2
ae7f4faac7b4b37d0e8161710bc29dcd840c9352bb5a051f8550fc293d574deb
60
2022-01-12 21:18:42
2
7c4daba1a3902f0a7c09db447b20edd4eabc18ac4c56ef1483e257e86ad88719
60
2022-01-12 21:17:19
2
b0e5975e66d631a5666a92a177680ba2f6555708305347ebe4aee84914244219
59
2022-01-11 21:15:16
4
92dbc13db94eb14d6f08574ebadfe525b924742ef3b61d2be1a4afee2ba7c7ef
61
2022-01-06 04:07:44
4
d483dd45b022377427dfdeb2d22b5342df7dc1307cacfea56e993e7181b85139
56
2021-12-24 14:34:47
13
4e4102e3942e197273d43ae8ebf1c80d2da25ceb7d875e0b7cbefce1f1552c7b
58
2021-12-24 13:56:56
5
759088fa00c418f4f26cf074a6b016610e58198452f602169de1caa246d64946
59
2021-12-24 13:44:45
12
fb428b6bba9366dc3f1a571cb037d17a341458ca9cd4e7c47295597485545abe
58
2021-12-24 12:47:39
44
6e17738a369355078f6aaa59ee919dde4970e021d3c30acb7e13a784c3d1eeae
60
2021-12-13 15:12:14
48
2f4e05aba86609b12b323aef1b605e5aa09e9f3e0df44114ae8d77d432e5ad5c
61
2021-12-13 13:24:22
22
143c1783047cdcc75d0c8a986f68403d74bf3f42ecaebefff445b9a73635cc01
59
2021-11-30 11:54:59
30
7803659c2d09886a65f3143cf4e807aacb95af72facccf8e5a7fe87952993788
59
2021-11-20 18:13:09
23
caf198e7bba87b0f3678226b286f62b3c2d765700fff21f8b619d27522642457
59
2021-11-11 12:34:33
15
b5c3d144131f4aa264de0bc74da9cf3ee4768d8b8b60fc82546b975db168e452
57
2021-11-11 12:30:33
17
f8715cea7a15a5edb538213ef48875f6aca8b66ca5af30f55e3dc803c4d85867
58
2021-11-11 12:30:16
24
9ad5e9323256a2884413525ac1797d5e78d6104709c830f12cc22e3f70e96c4a
58
2021-11-11 12:28:57
24
87956d1e47abdfac902b4c50363efab98cfdae1c52a480ee82ecb42a9319f956
59
2021-11-11 12:27:23
25
9ccfc81e5972572f72f13c08bf6b5c9b9605bcc1cc17c5cd9b316c03c5eb02e6
59
2021-11-11 12:27:19
5
5787ec8dded76ad1ca0b101610527f9f3f497661de78ac4552b38c14919e02c6
57
2021-11-11 12:27:18
24
5d29cd572cd220d1dc9cb874d6a8b545e4760801b3c9ab36dae5fd40b5795db7
59
2021-11-11 12:25:39
23
705c7740f051115876cf3dbe6dc00a529a3030161120063c9e59f8d063e02018
59
2021-11-11 12:24:25
20
54ab1e04dd68c2e00fe5fe87586212ee0fbd96a32d75b6bf5beda5d3b2eff94f
59
2021-11-11 12:24:11
27
3c71b8462e0980f8ab75797db2a66746f15d5900fa06e5743b0ed5f9147f0aff
58
2021-11-11 12:21:40
24
355d3eb17f2fe082a072104bc90af584f7dfdad2e7319de2e5aa2c3662abb15a
59
2021-11-11 12:21:37
19
1ea5af37fdcb8f0114fa2b89000169ce76294eebfb9c0354bf9625d8571bcc4e
59
2021-11-11 12:21:36
15
34f474139e90ce57c4a25f5e68bcc340906ab8250849a82c7e2269d30c343f60
56
2021-11-11 12:21:20
22
061a1b55f973fa5b9932a613fb1aaa17daa267e463ebe2b99d9a17981ea259a1
59
2021-11-11 12:19:58
22
08e9945c2ba4486bc2044f0aeb34ea5dea8ee03ea75077cd6ef235ef3034e411
59
2021-11-11 12:19:41
26
0dd70a97513ad129cc5d26f030004a9b8b5a9f39a2568d5b7e0dcdd3fbd91a74
59
2021-11-11 12:17:06
31
59f8fd8a3abf55c87f82e10322f32ac6e252bda715119df529043edbb68fb5ee
60
2021-11-11 10:10:57
42
b98abdbdb85655c64617bb6515df23062ec184fe88d2d6a898b998276a906ebc
61
2021-11-09 11:37:43
47
6a47bccbb82806007c3b2e3bfe71ebf02dea39786710ba0c22156d132cdbd3c4
61
2021-10-24 13:49:05
37
4a9e4428a8aa35cf1d1b07d2b22fe90b11d507d01b27c9ac40133b9b063be15a
59
2021-10-21 18:46:46
46
f952362137d0a432a220f04959b808b30d2399f9dd21658b87f341616bfc4fe1
61
2021-09-09 23:41:11
28
a34a2369ba6ad8116fbcf8629b0ce014c4e9b2f192ad33c1a318aad5f7a1ce7a
61
2021-09-07 18:15:03
31
49a17e0171fc3d46a29fa709d8e2e85f9a70ec283f9cc47aa5964f622e19a540
60
2021-09-03 22:46:56
28
6cdef8c85b0b4bb0f43bcf4b60672e49463d76a30684e0a46a8b836009b9a8fc
61
2021-09-02 12:28:30
28
69de136425f412eb815d693ef2b0bb12b1d28cc5cb6cd8a7f89f6ce1948bf70d
61
2021-09-02 12:26:12
27
31ebaa69ad3413be5c70b88b4d9ba2966dd4055f612f06cf12cd8e296a044d4c
61
2021-09-02 12:25:05
28
a32952a738ac35b03a8dfaf0557a561a114f507379071859dd6d972260853a78
61
2021-09-02 12:25:04
27
cded6611e942a92e4223e7ab99e356e89d2620e16c2bebf79767e802a2be3484
61
2021-09-02 12:25:02
30
a0179b62748e032e2067f2bb2fed68582b6c6191cac84fbd6944a22c88beb3aa
61
2021-09-02 12:25:02
27
e2bfca13be4a069a24be01483146b1570080f289defad63010d99a1cf2affc0c
60
2021-09-02 12:25:01
29
c559e041f5fa4e4068d9493fdbcde420601d22e1b3099ba28293b70dcd7c4607
61
2021-09-02 12:24:57
28
ffde543731ee6b799a641a3a7c2c257df36fab9c4c482737dab83773e064f387
61
2021-09-02 12:23:52
30
7a8e0fe8578861cfe4a75af085043df738e72a4e08a91bde430cac8b9c9352ea
61
2021-09-02 12:23:51
28
4b94ba744128af1b72eee59cbe99b6bd2eafeefe6391daaa2dc53106842c1b8d
61
2021-08-31 22:23:35
30
865ed63d3a57c0e79658730fcf9fd931e7085d8577f20f7084f146ef713c41f1
59
2021-08-30 13:43:34
41
fca5157f976d677b91b1ed194bf10ff42576b9165a678dc8888bb45d1d9d7128
60
2021-08-28 16:03:02
28
275bed2ec66f53098db6dbc85d618fe1b1bd4d9b8044cf5b731dfa980b40e77c
60
2021-08-27 18:07:23
27
6bc467a0564bbc892fa4b91efcc083682fc6675f27253978745abc716a133866
61
2021-08-27 01:27:08
28
f1f00d09988d1adf4314ee3e600ff5203b0710eed4bfb678b0cc1e17404b246b
61
2021-08-26 20:05:44
33
d4d86fc91e4fec9b1d9de30aa22a70cdc3509726bffeee61d526fdfc243081b5
61
2021-08-25 15:29:04
27
f2471db952b8a7a569510aaa7b80d1b659483ca020e457bc53012b0a6d8c4353
61
2021-08-25 10:23:32
41
3782f96c6d9f3136651da208465fa939313b7e4f21bdc4ef10c05926e0428a65
61
2021-08-25 08:05:41
37
46b29281f0827060078adda36e03bb71ee819bc7278700e6ad17a633e50e0034
61
2021-08-25 08:04:37
25
0391c3541099f73d6243e844ad96b2a79930db17847d90885804cfe697534488
61
2021-08-24 21:24:17
24
e7e97997cd1cb7d5120a7cf45ec3ff8cf1023b040cad9998e33136004b172f1d
61
2021-08-23 17:30:41
24
c2d8adc1c3a4241cd6057def9d2495e065f5c1fb20f4ec64ea4ac4ec14d0e7bb
61
2021-08-23 11:33:08
24
fdee4eef6b7311349b63080758bf3ef44954997be3bf372068a827dba09803f7
61
2021-08-22 03:34:57
48
ea824a81d7ff071e98f230779e598028d71cb0a613ebf0edd75f5f800a89fb65
61
2021-08-20 23:29:33
26
52a653b4bd2824a0fcf27872889e865a3e78853ee8bdb128d1d4add22db87eea
61
2021-08-20 17:32:33
20
525e59f40095d0ad39120b8462edd04eca7f9c5886cd2c1255f8992da17dce04
62
2021-08-20 00:22:12
20
5070fb24732ed00daad8d97fc9bb8a8f051c553833312f362ec4d5bf0460f986
62
2021-08-19 21:17:40
20
adbb1d3997102c0bc0eca86b8b0fe283bb9be5e5f7123e6d34bf4bd543c06247
62
2021-08-19 20:29:33
20
b78c6e2d1fe125dda00b3d54d82717baa0fa60b461699120e3310aa2cc8ee71c
62
2021-08-19 14:32:12
23
0bb28f646c7930e3983c11ed02b390defab014baa1c0e0b5f43e4d7afcf29bad
61
2021-08-19 12:19:41
25
74cf2b51b476863d048a83c48db6b8f60cd7a42ea00ae2233fe2657242e18e88
62
2021-08-19 03:25:16
28
612f29c7a385a863937251b3200b2cdb92674cbc6db8c841e926458af3fa33e5
62
2021-08-19 00:20:14
13
3e83247ebdd89c43bd04229259af76b469d3fba37cbb1e4c44511ded6ba5b80a
60
2021-08-18 13:17:00
8
08403d887620b1590b6e968bb70ef5cd271d4dd9fdeca5ec49d6ac777ff09ae4
61
2021-08-18 11:54:00
8
417248c31afee58d5721e6afb5bb322dc249aa351dce8bccd3a8e96986dc678e
61
2021-08-18 11:43:16
8
0361692f5cb1f940b1c48b3a487b1330505ddc24357a3c639328ac4beff6101a
61
2021-08-18 03:55:59
8
891597b324607ce8359c6ada45ea096cd38c3ad61d1a927038bcadd5ee330e3d
61
2021-08-18 00:02:14
8
00211d34982abb739636cd1a528ad00b2d67454e49253a4aeb01743f62ac5d70
61
2021-08-17 22:46:07
27
a32c2d8f0deecd0ef5afb48dcdf728bc490f18e3347c9f4a25a6bf97c2aa688c
62
2021-08-17 21:58:32
7
6e89c53eca6c6b7e822de791852678f4c87cd9ea1a06af8c03ac652302cc2b3c
61
2021-08-17 19:20:17
6
e002a9ce141a71b867f75af778515e15f2f3ec2b0934a0b27d8224073c9a2756
61
2021-08-17 19:11:52
6
2ff679541ee09b8b69b4dbd35abcec56f21ab1a789e6298c56d7f932f13457ef
59
2021-08-17 19:07:40
5
23881d57ac7df1100050f1b0300f1f87e11153fb4a514e2f8f4e0e3dbae2b439
61
2021-08-17 18:27:53
6
540c3373bf817917f99f02fa5a6730ed5d1aba480d69d02277a3386cb994a6f2
61
2021-08-17 18:13:08
6
8eb1430267a428eab78aebd3e38a79ab1822b2b3681f552d07cfabee6b105544
61
2021-08-17 18:02:33
6
97f589f5649e89b4b901337d8f3da004536c3c93501cce690a81ebd7e5637371
61
2021-08-17 17:27:35
6
8d27150b0861ef853b56e853686785a03b34358a32072edeaa61669828dddead
61
2021-08-17 16:50:24
7
0229fc2e310dae8dac8ce6ea672479d6722f8b665487ec60727d6d6a266995aa
61
2021-08-17 16:48:15
6
8e2d3a6fd7483963853b8ed5710d5f17d85681ad4f3f716b2bc52f41620613a9
59
2021-08-17 15:16:09
30
9866b2d6822235cfa9e900b902e17e53550b2072479469845a3e5e0eae98632c
62
2021-08-17 05:47:27
27
e5257bbfc6bdde3876260584276fd00da57ca6eff8c5078a2b38c7d871c5c6c6
62
2021-08-16 23:18:18
2
b7e1b6ac97071dd2a4c7b565bd0f7f5c274fcf446835d6f1535e6e9063bd01f9
61
2021-08-16 21:55:11
29
35fd00cd63208d90334e94ae6b7cb7a6a4f4a6027fa2abf64eba349b285a2b37
62
2021-08-16 19:47:11
25
4fc9e51e0ea90ee0f7a089d75549b2b938cff08e28ef64c89ee2e8d62ad19b7b
62
2021-08-16 19:02:47
25
d51ddcf4a79ff1144271cd2c868e6af0a492e8aaa9e19daf9b5049dbe042872a
62
2021-08-16 17:53:49

Rule Matches per Month (last 24 months)