SUSP_BAT_OBFUSC_ENV_Obfuscation_Apr21_1

Rule Info

Rule Hash
7ddd002f463ec1ba5b50b0bdae434160
Score
60
Required Modules
[]
Minimum Yara
1.7
Av Ratio
22.41
Description
Detects obfuscatation used in Batch scripts using environment variables
Author
Florian Roth
Name
SUSP_BAT_OBFUSC_ENV_Obfuscation_Apr21_1
Tags
['SUSP', 'OBFUS', 'T1027']
Date
2021-04-19

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
62
Suspicious (< 10 engines)
63
Clean (0 engines)
1

Rule Matches

Total
Hash
Timestamp
Positives
VT
57
aff9b0b08d5dcee1da9bbf6709c36db2bc65d5d0254f6c4bbafc3697cac8b1f2
2021-08-01 18:01:13
1
58
29daab142686eb745b16e164dcc2da35105c5aa10f4fba13b0b5b750f7c66f84
2021-08-01 17:50:29
12
70
c199736c065f83a6d0ddda96c552671a2f747c77ec34d3c5b923276f7f32e60c
2021-08-01 14:41:40
40
68
c1a115165a7f861746852f175d0a480889dfda29f1395fe45be87d48ca2cb812
2021-08-01 14:15:00
34
58
c73a691f93e467ed3bf0126d1c61746f4114a5e67831886dc949174c1a248215
2021-08-01 02:40:05
2
57
cb507ccc9783156207e993c00a4dfeae8fdb83fade5e75b163e470b26cedc33a
2021-08-01 00:28:24
1
54
06c326813cb47562475b448880c8a26c80e07c380c72699a4a97fc08644c40e1
2021-07-31 17:56:56
15
58
1fcf60e6c1292810e1c0c20fe5937763e61bf90f5c29901482ff4ea821c3cb8a
2021-07-31 12:45:13
2
57
4382115061f4d6753dec2d542c3562c6b7403ca699bda8456ad02602ed12a596
2021-07-31 08:02:44
1
58
ca230d19f985a2e60a043ec8c57c9a9d3029f29c1d9806652b6b4f313e352618
2021-07-30 20:52:45
1
58
651effb91eb255b9d91bd151f5554f2a6131b8e9c9ce55ee99f04d23f4734792
2021-07-30 15:37:52
1
67
8e27ff853af6ee6e4c842ca3419d466d7a1899af4f8ef8360eab3cf376538e48
2021-07-29 17:18:59
31
58
df6169e8a806ef8a9159a7725917b3606f9e686e91425e42718ff0848bc433ba
2021-07-29 08:04:45
1
70
5b81d2763a11dbfbdd6398af85507fa22592076cec8bd8ed41de462b3294556e
2021-07-29 00:45:43
32
57
03155885ea05f875c7a3fa379a001224e8ea084ae403365f87b7f184fe617e41
2021-07-28 13:21:17
3
70
330e45036e39f14a21675fef10ed564a284083f4a74043e662514374bc5a4558
2021-07-27 03:33:51
42
70
060ceef0f87bd99e81bd6260d635ec51fc66867dc85c05cbc2d0fd47a04e4ad9
2021-07-27 01:19:17
37
70
6d020682b91dfca7ee63ee7300b408ad0ca0970aebeff06bb44edc85cdab64e0
2021-07-26 23:33:01
24
69
34518dbd037e7465b22e891d5aaaa11a84bb3ef7a89343a9febe04d061353837
2021-07-26 23:33:00
25
69
8f7dcf47bc58cfac8b02b0d01bd4cfeb1cd7fefb29201d2b1ab4a58e6737086a
2021-07-26 23:32:56
24
70
108c154524e21d71d71dc005194a4ce8564621e240a5e46351d2f3ff08d4d604
2021-07-26 23:32:54
25
70
59c7fb47c63d944b037199bd69682b1cbb272a195b239245af551cf7fa8654b3
2021-07-26 23:31:45
26
67
75b0a42922c0b6e420c5f4ed53ad159116068f84791276509fa96fd5698865f0
2021-07-26 23:31:43
24
58
fc9855adfcf50e4d8a599847df0bcc1af4b60d3fb72f5bbda70de68b12139daf
2021-07-26 14:37:50
1
58
e02deee48433f3f55851ed16b2a513304f35a05e9aee1099c17045c18a5050d9
2021-07-26 07:11:24
22
57
6a8f4bf0c04e731a91c18eb7cfe972a047d8dfa844c7dd2a210f91d117357181
2021-07-25 03:11:29
1
58
886a4b5d843a85e98f5c8bd9d1da8c8d2df5e1e84eb60a0666053d80d59095ac
2021-07-24 21:42:05
2
70
bd43791c322893179bbe2491866d33a8ca6c9b47bdfffc365964900c208c459d
2021-07-24 05:29:59
40
69
5fefc48ea931365f929149bd13410c847a38098c495395127ca5cbd8d5659e45
2021-07-23 22:07:15
20
64
73805543bcb71c6916d0643728d1b51f54b65d8021b5982c82c0a6c562f607ad
2021-07-23 21:49:42
40
57
d4538d7e2c37e3cd9c13771aa288bd63ef0d2894d9d83974fcdadcee48c90b0f
2021-07-23 04:38:07
1
58
98f27f8309dd969fefa18adea9190d1929c54f3717851aaa8566b42f4acecb81
2021-07-22 17:43:14
2
57
0dffca9038c1e154998358a57f476ef4276a4376d9caeb5e0b1a00d9c2f75f80
2021-07-20 15:37:47
3
68
05836f9bd3e7c825acb45682ce3c8141056b8b323c9449462ede87da5305565d
2021-07-20 07:25:33
26
69
347e3757ae706ff7b1f43f5b054cfa290211ae076718498603cf7fb8124d2e6f
2021-07-20 05:39:21
37
69
e286e286ec1026ae4fb7f7bfbc407f787f9e984fc566e1a4ead586f7c8b904f6
2021-07-19 14:05:14
19
58
cd7bbaf5f4f37e3fa76d96f83c6081ca9f21ac689ab0d9e4dd050807de0232a8
2021-07-19 09:29:14
2
58
efddd607ef2cafc2af920a37761eb3b0e48299a63f5a415939b4df3bc52c39fe
2021-07-19 06:33:14
1
58
d6b2605377111127e34e7d8259663c7743e69627eac721a763aae485035622f8
2021-07-19 06:33:08
1
69
a20c6c0274bf83a23349b9027d02ef4f2192d4ef38821bdd11f1ead19fab8a62
2021-07-19 03:34:17
36
58
6f7813f11be4a4478b0d6317e172f8423bf72261a6278e4e4036babf45c1096c
2021-07-19 02:15:25
2
58
c5d5f73d8ed4805462009dd254f086a7d48f073f68b2784e42e2e6cb69005546
2021-07-18 19:42:04
4
58
54eea240b604f26eb91e05b74347cd12d313bd03ccca51dcae34a84c342f4ef0
2021-07-18 19:26:16
2
68
35cfb2ad89795fad6fd91e4330bd1d968448e830309fc8112edce2728226fa52
2021-07-18 19:25:12
21
68
f52c4ed91b1db82979cafd05d3d2a9fabbf10570f3e274c64d8f516e5567a31e
2021-07-17 23:34:30
20
58
c0336c4d102fa3df2c2ff7c3293076226e12141f05d2bde76638d25c7cae8a44
2021-07-17 15:20:30
2
57
37dd569854f2c5e6c448cbd77f85b95e7e11e2a6ff4f8d5a26c8495dd5c62d0c
2021-07-17 12:07:43
1
69
9ec553573fc3c261c5f33a573148a888003440850e1137cc2bac430d611071ed
2021-07-17 08:02:14
17
70
7d5f173648fc4ba801700cd5468a0ae726b2ec00d5870779044a61db1904e24b
2021-07-17 07:02:32
17
58
ad556ec64d8a3df2559886628b72c42393ba8a8c48c8eb5cf0dcd84cab819c38
2021-07-17 06:56:15
1
58
26da8dbdc8192c0e8ad2f5dc1b2ad8efeed6724d34708fb7db21a295bdc35d6a
2021-07-17 02:38:45
1
68
52547091c2693641fff573265a009190fe65dd4fcbfbcc41f9e89cf7bcff548e
2021-07-16 04:27:05
37
58
f9f19ebded527943a0d6327b935bf661e1918d952ac6b94a54270d4c8d42c2c3
2021-07-16 03:19:21
16
65
1a351a373f541c360f46895f1ede15d591776d6a61062ba57c8a1fd4bf8a1c85
2021-07-15 16:13:52
35
57
1a0b47de20c75618e0f1a173be2f2bcdd2c45dadac688883c35b8a482d46242f
2021-07-15 01:55:07
1
62
ea820ebb345366233cc6487103edb6c74b9b6c0a1a900f12a47ed3cf24c580ee
2021-07-13 01:01:37
25
58
dca2e23324f7a740d431eef0083c0b795c63fb2f4ae4bc55bc236b12ea0510e2
2021-07-09 07:07:14
19
70
0b3767679490119d5f65fdef9e8d4a531f3270a21a3a82965d0fd51d4f6e55e1
2021-07-08 17:35:32
33
55
26fe7c27235771e10c5b136ac66bcf8cfb402aa00d97f691e5a1e8818799f735
2021-07-05 12:07:16
2
68
40db055015cc73b2fd3910ab3916f330cb32fefa29f31471b3b2b36c863329da
2021-07-05 07:33:51
25
69
f4c6f85b4cbccfcb208339178a52f136892e23d5158b7edf83f456fc3f557114
2021-07-05 00:40:03
22
68
b32e1790fd3787c5d79c7de15318459adbdf155c07ed2d6a918159eb9bd9016a
2021-07-05 00:40:02
24
68
0cd4b4da0b5ebbbb807835a6444f16c4d4f672daf9691e818823e5630b166321
2021-07-04 20:39:34
24
68
91056a0f7c17b69ef65a76c4e856a52877308e08e1912afe0e20fedaa46390f0
2021-07-04 20:38:24
24
70
ac904d36a3aa3b9578f78554f05c54dca5284d8b4e68c9f739983540885ac812
2021-07-04 20:36:06
23
57
9e1df42f00829d16afd97c575f08da45467bbcab92ca5e3d2832a009dddaa8a7
2021-07-04 19:18:44
12
70
59cbc5e716ab8832ce657b322ba52f7f67d2a966a7ccb1121a7c19d5898a76b7
2021-07-04 07:04:53
50
53
18a22f7aabb034d43d1a1938f25c9cd32e451960bdb9df025bec7557544a8ba7
2021-07-03 22:12:30
9
58
051a7267b6897d3396e48fbe5b179d6e4133b3161b8798a6a8665302fd3f949f
2021-07-02 17:47:48
2
58
571e412c314b5bdd8b3d5910964f9ab9660aea0f9269aa7f947c6e90b6448057
2021-07-02 11:36:56
2
67
cd4c72ffe057b6f413b8b4f7c6c4153e8433f915e9c31010ffc32b0b6bf9ad7b
2021-07-02 03:29:10
27
70
b26e554159c6f7db20e27aa78e66a4397c78f3f301e11695a32990c0b3421ce9
2021-07-02 02:58:45
37
69
6aff4c76a6ffbecab46c7831e5b609000a163e08a191bbf75e932c7186a3fb76
2021-06-30 18:32:48
42
58
3673a6bf106f26612c20393c16aebe2dec372afa3ecc066c23850bf04d42632e
2021-06-30 10:56:01
2
58
ab9f1a933497bc9dad05a3d53b1a313be4916a20147a36a47383b6714d1dfbbb
2021-06-25 17:33:34
1
68
31d6dbba4d21bb6b7b68560e6986d8cf1ae89cd136f088ee865d8bd71dee8afa
2021-06-22 20:28:03
38
70
aca5dc69bb337885c351389bde056386aa04ce530cca5aaf9869e5366298b97a
2021-06-21 14:23:03
45
58
7f10b3ccaf2326a74deefc0f3304717196d4256686574bbf549577bab414db91
2021-06-19 13:11:42
1
58
44feebe62660d41c129d2b2dbe209e735d019f1f0b80eea092d6560a37229735
2021-06-18 16:50:52
1
57
6137959b1a32a18bfc1ae1f5243be990e1fda1c44fb3f8f1a2a794a99933b019
2021-06-15 13:17:00
7
57
1a5820845a5559a49829b86b05b64aeb965bc0e875b5b2ec7c4f46bad938ab90
2021-06-10 14:29:33
2
58
b8ad71cafef182a4e54fc7323a8824e48de3585cf651fa2cd2f38ecc2ed85a88
2021-06-10 01:52:32
1
68
c82fd5409e6b74afc8ad5c2c6eafb4048b17626eb8a6bc74bc7c434831357a3b
2021-06-09 16:58:51
32
69
860751ac3281d830f65a2e1baf44402ad2f0c8b8e4c499e744550845f331d5b4
2021-06-08 01:05:05
28
58
c131b08ace23dfd345b274838153a38c39d1a36e152b4b71bfcfee40940d3b0b
2021-05-29 18:40:15
1
69
267e400ba437f7bbc4ea187fa3a295773caa8250aea4d11e5631e5892d319525
2021-05-29 15:28:35
22
58
d6d76705dbd246bf2aa133f5c7daecedd3f158b44a3b60827f722ae2bd99b503
2021-05-29 00:12:37
2
57
9448cb89baa1985fccb022703c50d54b5443ad7aab2236d04e8634cc15e7cd6e
2021-05-25 06:21:30
2
59
7e9ee9d9ac5a6dfbc98a4938c89ebbb7e4534bc5f8885633fc885d9ccf2412a2
2021-05-24 11:18:49
8
58
fd0efa2e3a2d568ac46a9a109e6ab6659ceb4be01b985f1132b81cb6cd245282
2021-05-24 00:27:05
2
69
0fb578c207853a7928de009f6047a2bbc17535f018fa5a87898b0a928660386f
2021-05-19 17:17:39
34
68
9e2af0eab11824845c2879234e6a3e9ddd92c5d98cd61260b90ae96e38b069fb
2021-05-18 15:58:16
29
57
54b4b10e9fe85ef958ef5f3a1420a891a230d1df4636fecc42684d1db94b48fe
2021-05-17 23:18:58
3
58
be289eeb812339ce7404761436abb592d3d132fccb7a341f272d9d8ab85e856f
2021-05-13 18:57:32
2
58
8989f3c06ba342a681a9aeed136b0f2271d3fdba9cf7b21bf92edef33ce32e2f
2021-05-11 06:58:27
1
58
d8c1881fcc7a5c4d22143b6a4bb41b20905659a89151d9ab4ed072ec915b761d
2021-05-11 06:45:04
1
59
ef5703772259ed994e61ca4c2e083324f512e1cac5057126f6c5617dee0cc864
2021-05-11 04:37:44
17
58
64c6f6723cbcf4e239317c7ee22ad3aab41fdeeb4c04f3e7eca080448d09eb9e
2021-05-10 18:54:07
1
60
b533163a791c2fe6cdb01e0e8a7b1373b792e785367808a6aedde72485b33133
2021-05-09 13:35:21
25
70
9b02aef5096efcb6ce2d5de79636a4a49807d05143fe043b2760543c5f5e251b
2021-05-09 04:14:32
30
58
3c083c90f9baee56239d10cee51e3a0a500cfa8ef5be651a90ca07c95cf3f657
2021-05-08 23:14:59
1
58
d0938c4734656b017611bc3aa557244c6c769de7090e807b0a6db663ea0a3cf5
2021-05-08 03:48:59
2
70
31cef68dc894d595524fa681001e43d0063dc156465be70857821cbfcd0e013c
2021-05-07 05:19:13
37
58
ddd907243c6066a768640b8cba0c6738d762864beb9a238eaac2e6c8401588e8
2021-05-06 17:14:23
2
58
bb3e5440ae993d7b88dc0f8c6547fc14d7e5499b63d83e3ddadd997d9fca9402
2021-05-04 21:03:54
4
58
4946ec709ba6e1e3ef9208d7fde91914c74ff1386d9e2089e776f8865eed7dbb
2021-05-04 03:43:26
2
69
c56b79e0a283972386dcc0a91eda9e1d1828135119b248975d3e799096f214f6
2021-05-04 01:41:36
21
58
4944d009e2cc20c82aff431d3de215663a7ddaa025d2698b1d2e8f284d18244f
2021-05-04 01:07:01
2
68
47d284e37accfdd767fa8b2791d2aa378b5c24da3c054fcf4831d26cfd9acd0e
2021-05-03 16:55:51
21
57
1e1d241d2f53763a9bb9ed4a250ede3cc68148ba9fae39aa05f00b66546b57ce
2021-05-02 20:57:40
4
57
5f7dd56771f2cc334bc571801f9681e25f70bb9a69fb27930e9047ded86b0304
2021-05-02 01:29:09
26
57
cd71e913549cc3205a0ac35cfde8d5984e6a782c80cf3f8cd592f85a3737aec2
2021-04-30 22:19:11
2
70
5466bcb7ffc3ade1230b20c7d7f8a274eafdb2aeb94c471f0fc352c7ce819943
2021-04-30 09:51:09
37
58
838b95e9c2f5087254e8596d10cdaccc1b9f798c04e27eafdc4ee2c6a8d6a04b
2021-04-29 23:53:56
2
58
a627179cd64c0fbb210acfcf539eb9deed701b6b7825649a245157c8e7c1701d
2021-04-29 12:32:08
4
58
d5b69c210dd4cfedf7838216906787145c69fbe4eb5e0e3f7221479e5acd6ab1
2021-04-28 07:42:39
0
70
506a3597419ecaf0c6d67cbebfd90d6c5c5761b03a73fbcc3e30d7a7355e9297
2021-04-24 09:31:11
42
70
93912c95f8771c8f9f48b86651f8fc74fbafe707fb1a0f7c377ed133f75a7d66
2021-04-24 05:08:21
35
56
f8d302fe6202d2fceb5fd5177f4697c6cafb415f20511930162a8d3d6a02c8ed
2021-04-24 01:26:16
2
69
341c8070f79f30df8203bd43d558c79001c3c0bc7253590401beb5bca168d77b
2021-04-24 01:26:14
24
67
4e8b146fb9ddee5ce2bbff00de1dbe69e2ef06f36d8232a3945f64dfbf193286
2021-04-22 22:44:45
9
59
c717e3fba1ed45f082594521ff932562fba325aac25c8f948177119683063100
2021-04-22 22:13:22
5
68
5fb9bfade37cf707c3b24d5ec3103c6e144d3844a568872c94ac57c67a5200b6
2021-04-22 20:20:42
20
58
700e43ab1981a6514d2186ccc6167d261be82fd804e95dc1eeaa3b3da10c4e14
2021-04-22 14:08:54
1
58
9ddee5963385ce03c760964f37043ab914d7b2c804faea26743953a70fd352c9
2021-04-21 17:27:44
2
58
221d2d76bcb15a7c4ba2633fe78d7ce6965f647d796e83825ede7dfe3cc850c5
2021-04-20 02:31:36
1

Rule Matches per Month (last 24 months)