SUSP_CertUtil_Encode_Feb22_1

Rule Info

Name
SUSP_CertUtil_Encode_Feb22_1
Description
Detects suspicious certutil encode command line often found in malicious samples
Date
2022-02-12
Score
60
Tags
['SUSP', 'T1140']
Minimum Yara
1.7
Author
Florian Roth
Av Ratio
12.35
Rule Hash
6cb9997aebffd66455254434a689a64b
Reference
Internal Research
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
33
Suspicious (< 10 engines)
50
Clean (0 engines)
35

Rule Matches

Hash
Total
Timestamp
Positives
VT
9eda9a921935dc678822b7b4c8b381ff9a2ea5059cab26a0598944e86fcbfe18
70
2022-08-19 07:08:25
4
63a6a8b78f7a6ff5af4f07a63f4cf1a2abc20076832ff72edf345a0b273f8587
59
2022-08-16 10:54:53
0
76413b82e35ec264a28320f477c994a509671c4339cb9ad7dd00f6c214c8badb
60
2022-08-14 07:58:11
3
1e933b9065ebd48e03f7440394db008b8fcbee3f9de68f092d30b16a109d3df9
60
2022-08-14 07:57:05
14
335a60f3c5e99e440ce0d6d461f0b7c5cf33040ed6fff8b5ccf63d9196b9f0cb
60
2022-08-13 17:33:48
14
0f58e87c8a8e78ebe5ddc6d92f713d6adf58d26bea9c06431ccd0e2053d38ec8
59
2022-08-10 07:30:38
0
74abff50220112a963663d6aa139f1853ce66d8b694863f8f67fc9a062e02111
58
2022-08-09 11:49:40
5
8798cd0b9872746beada7c59373df79815a53b839c25687bfae306928058e54c
59
2022-08-05 00:22:37
17
a0fb141f48b6a70c3de614beeb3c1b4c97bbc828f2292fb70a123ee111117fa5
69
2022-08-04 16:14:22
10
253c58e7405e46f495dea95da6b7fa92f9b3a8e876f5b776c38e2ba6595966c7
59
2022-08-01 15:50:02
0
5485ba18a9751805c234c9fefc3062f924a321135a975e648b98079b3392cb85
55
2022-08-01 07:04:24
0
57bf3c0b1a0b68b5a984fbdc8c283dc9c95b24d77c5769013dedb87075efc3bf
59
2022-07-28 23:51:43
0
4cacbd4256e77827dbecaa438675b32628ac59ec47e21d2362dc590f4021f170
59
2022-07-27 06:15:31
19
cd856349d7c14836346b1c11c465d8bd53447d1cb25e0205df3e55df0fb2f990
60
2022-07-26 20:39:20
4
a12a6689e605fd3d9ac2f3902fafb1118f373841cf546062a8a60869b6c04824
60
2022-07-26 19:45:39
3
54fea01ed24c439791238734792cb17d9c24c9e0cb1cee7207afcb49b7bc1b1c
60
2022-07-26 19:37:19
3
ce180f67845fd78117e8800295ae70d08a7ddbbd41c014644d1d14d457bc76e6
59
2022-07-25 16:25:45
1
c0c0b13387576f303f664e905c194391bc08221c37b9d3ecffcfa77b48b10f53
59
2022-07-23 15:13:06
0
b9dd0aa06a7843c53ba6ee461bf84500fb8c88bc3b56f0f3aa06cc1a99edf0a3
59
2022-07-23 12:31:37
1
e250379cbd9d7184f280336294df38dda6bce76d910c6944909220258d999927
71
2022-07-23 11:27:33
41
7f024971a2657d8b1b04704d66a886639fd31815d72f2728ec6653d5614541a1
69
2022-07-21 16:58:49
19
705be2f9ad8f8e59065dda7ea352cd44cf5023203486f3b58c6f255d55c32c48
68
2022-07-10 20:12:32
4
6f2af9f97e0aafe57f46ef73e52ec6d2592107d05aa797205a53373fc2952799
56
2022-07-10 19:57:48
0
ceb737b5732e915788a2b1c57887ba110287c7cc50fea5cf1a550f83480806c2
68
2022-07-10 05:52:47
5
41d7112e98063e867ab259587a9ed4dd982004036f3aa5260b131ce901ef2aea
68
2022-07-10 04:51:11
1
6d0729c1dcc2d717ee37ba132eddf488b00be5c4d68e108854e2aa4157e532e9
68
2022-07-10 04:05:37
5
2ea76df70e91973f48cd8e7457b64846fd06a2c834385458bb7282ad2dcc491d
68
2022-07-10 04:02:16
4
55577050ef662cdfb3309feeb941a22b183f1bc1f896d13dfc9643d077505a91
68
2022-07-10 03:56:28
1
3afbdf8d2634f2c8f721187860a13adc02dca70e0f0a148d0632ef2d923bd738
68
2022-07-10 00:48:43
1
386d34c38b92279606898a700d6b3bf91a6816a2b6290c0b2b65783ba82272b2
68
2022-07-09 23:57:00
3
f36f4fd3c419c62118798a790530a6ba1bd3bd23b7f38836d643b104854dc04e
68
2022-07-09 23:50:41
5
dc829585fe059f5930d7d21f682f0bb33a6526e4421d683595c6e7b538e798db
67
2022-07-08 13:18:21
3
14527c60677cc96f9568f147611ae18b9d387415f6796622b5ee9429da8df5e5
57
2022-07-07 23:01:39
0
39c5430d7e34671fdaf4d685f09a1cc691d19a6edd39bb270705303dcd97c2b0
57
2022-07-07 13:03:41
0
519fe6e7d3143c8de622da721177b3fcca3b5dd6e9d82547d7b9d76d572d57bf
56
2022-07-05 11:00:42
0
28878055d20970169cf7b031ac28763a51a7578dbc476316ec5581dd54265a0b
68
2022-07-02 23:37:55
17
930302713f09e219592107912eca54fc8a22a36cb98ec02c156550a0b697856f
57
2022-07-01 20:37:05
0
b7869685bb71d1337d1106e6b79bbf2985f52dd2dc71e3fdfbbe3048863efe94
56
2022-06-30 12:58:38
0
8121c06d0b5d2e79427d589b4c0a1f69e1ff43ec0a1ad07281fa9bbed42b74e0
54
2022-06-26 11:30:55
6
2c8133dafb96adf51d281fb217af671c67d9083220e440a8ab3b8cbc5b4f18a5
55
2022-06-24 15:57:35
1
f8f7b20af61a19eb0fab8161187838d099157dcda8c60d23ffa032a77ad5cf8d
55
2022-06-24 15:53:21
1
0e173dc85175d2625423e0661a082eb8991376e82d064a42d9c9d8675c5b9a36
57
2022-06-24 10:35:20
3
7a0113a1b29f2047831d3989e1c76479782c6269473a3c6e212a8bfa32281b82
54
2022-06-23 05:00:31
1
c2a38551b19d5e2cb908db42db0ebd4a713ec9024c3ea737ca82f9eb4f726a1f
56
2022-06-14 04:08:41
3
69d9306d3418b50f59644f5ac25006349d84701c7f191b00eb91110149b1a9e9
55
2022-06-13 10:45:53
0
70ecf5ad0c18469947c00f1e82316a8c63859086cae7f4821f4ae0168694ce48
56
2022-06-13 10:44:09
0
a5c2956bb67534a5a462a01b6213420670b9e33b776b2d6fff60fcb6a9617f26
56
2022-06-12 17:24:35
0
1fcc8e6f4af87644347d32b207043c171e5ff0d39d307e7b5d1f1a9e10c4f112
57
2022-06-12 17:05:12
0
315c281ab65922dd3de6a7d035cedd2b18a0c14fd8504dcda3a6841ad92e877e
55
2022-06-12 17:05:11
0
dd3d10072397ab94a299e894011fab2bd8bc6022c350161772c7d39797a7ba43
68
2022-06-10 19:39:44
39
c8a039d3718a33896aacef484b0528ed214b69fcca4d3fe287d4232154984af7
57
2022-06-10 13:10:42
4
7a1f9619e5bec0d2b970c245ba8d92908d74c2978f07d8cc36e51141e1fcd13d
56
2022-06-10 06:31:31
3
ceab43909d491bbfdd7b2c2ca3e69bf7d66e581404d0f2268d2dfbcbad3fb34b
58
2022-05-31 22:06:44
9
46056c8f0f370ee1d42f725ad48a4cb5ff032a5767b860ddbccdbd8e5c68755a
57
2022-05-30 14:56:54
0
77091d1101956aac778d79cc569b55022d322fe5dd18a273daee75ed8bddac88
56
2022-05-27 11:09:39
0
a25091af1dcb36d2ee3834fb5567832fe0f2e1ee18cca7f0e40cec8b35e57a67
56
2022-05-27 04:06:33
14
7c6c0bcb96173a5ab1d7017a0b2e6a0457065d8024d7225bc0348b8a535f4b6e
58
2022-05-24 20:16:33
4
d92d6e8fc48ff948c60c0975641561b8bb1616a345ff782234cc8513cd3b563c
58
2022-05-24 19:43:38
3
078d9c7488a0377852c950642374d5c3ce75b1aedc61ab9ae18424c6d9d1a453
58
2022-05-24 19:24:47
3
0a64d72156d5d134821847f1b49c95b3c898909f0783eea5ebc3f47d050e45a5
58
2022-05-22 19:49:36
9
92bd7e67810d9be157bf4c12d8b2668bba9fe2155c90a4b904a93a05193424ad
57
2022-05-22 08:13:48
14
74aa3cef6b9f311dac31aa38cf9652d147dc5465d4196691ce86cf80b4452dcd
57
2022-05-21 00:25:46
0
08d01e7ff303f848260cb0597aa0efb9e483dfe5a3263b56b1970b272addfe5b
58
2022-05-19 01:57:21
0
532f26e9691faee3c73fcc34601dc01a89e257af20c5c079cd14a873a3a6426d
57
2022-05-19 00:33:21
0
8124737ae550571a00fc3923cc4cd2e2d1c7789932066d95ccc4316db3fb86c9
65
2022-05-19 00:20:43
5
2430a4e0b290fccc606ebc161f22a587efcd31b82bb89c9ee1a6ab106359dbf3
57
2022-05-18 23:44:37
0
66db50d7d548fbdc01dcdcfc09a706117040bb38e09c590bbcb385898ecc5390
64
2022-05-18 23:35:15
8
df684ccc68d1689bbded98ef7898e7202331da7175d11438c6e39b0c531582ac
69
2022-05-13 21:26:48
9
176bbf32e4394c747b45b0b927605d4051581413f980306c5aeb950ce39bbebf
68
2022-05-12 11:13:53
24
63a5ae0839ddd21bc2457fd004dfebd96b8f47ddb06022b2404d1f967943f235
67
2022-05-05 22:55:22
14
bc48a3fb330f00025088f1786c6c113d0296a36535e159a5fea5b1db8c4256a5
68
2022-05-04 15:09:08
16
267995b0f7ed53dd437b3bcf26ce5f51db687cfb1768a2003d241b110eb26a89
57
2022-05-02 11:33:38
0
749f568888064aea22aaedb423b90ec17c22d195988b8281dddb57834f4baeac
67
2022-05-01 13:46:57
17
7053b43784bbe4da71e0ad7c409252afa91f88aa3c24efcfce5ab2e33ebb688d
58
2022-04-29 03:10:28
0
2f5740936aaafebf718b692472481699acd66cf8d14e36fe17e7fc6dc4baddfe
58
2022-04-28 07:42:34
0
a8865f0ca1ac31ae883372ec3fe199a520ae10d815bf78a04add7ac5e6b6acae
59
2022-04-27 22:25:20
9
49d403a2ed1a86b43b7cba6b0b7f241674e53cca7623c394cda85ab3a801fb24
58
2022-04-20 21:15:43
11
1785da2e44b93bd8f04bb2b6a0fd8cf07e9201808b3552bb7d9c6072b0d036a5
58
2022-04-18 08:07:10
1
048ed7a721374ccdb4ccd99fcf19cac65157e38676ec979391f6c3b0deedf859
68
2022-04-15 20:49:26
39
5aec4ba78f564326f41102c3464575b3d3f4c39b3184d7e3af4ee7e4a2c981d6
57
2022-04-14 12:10:08
0
1765819841c254e16c38ba0f85686d0116c3996ebe437c5384218ad5c1b0fd63
68
2022-04-13 21:42:41
2
8ab81aa838f4bbe6b9464a88a6108d619f9d2fe888a6a8a257480497d4c67b10
69
2022-04-12 19:46:36
1
b66ec40c63ed71b383f25a846a88997d67fdaa691e6390e41bffc65d1d720ff2
57
2022-04-09 10:26:31
0
353f4b697c8090d704a86a6620c5021cabefda0b552f73edc8251b52d21dbe9f
57
2022-04-09 08:30:53
10
e6f2de380f60765d0b8a0a1a2cf3649b74d2c755dfeee176717af844e9b335e9
58
2022-04-08 14:30:31
19
ed26d8680ded2e804840a203ad56153128f1ca0f56381525cb6aac8a518ee50b
69
2022-04-07 09:37:50
38
ede55d924a00a0d21f2253f6b0ce2be5fefac6262fd9a736f347e2467500725b
70
2022-04-05 04:25:38
46
e0a4331d080fad486f9d213b2ef6f37b17cbf75b031dc8089e003c822c1c899c
69
2022-04-04 09:34:32
1
141b9466f8ebafb6cedc2480ddacc3b82788605b2a7e9e0bded5c0b992f16391
69
2022-04-02 22:48:55
1
667c4fcb62da833cecb4d4b54dc61c14a2195f105e1aecf48317170b90d51fdc
58
2022-04-02 20:21:54
5
de4d01173c10de06e7d6ef0e23c54874e0425c89054807f039ec48f44f0c2c56
58
2022-04-02 19:39:09
4
7ff97def25d04afa56f11e7732b800b3adfc939eb508d15836e8441dd57a6291
58
2022-04-02 19:33:28
4
168189d891c1291a22f03599aaab648aae3a8275a51ac679b33c45921a108ad2
56
2022-04-01 04:23:28
1
a3b54ffbcefc2ebcf4986d0ce808fb31aacb603d4211b7894f3cb8799cbc2450
55
2022-03-31 04:10:39
0
3b0945c1e5059d021d1f283e7f5d6f3b3a1ca2ba4dc84a8259fcd8bc168889e5
57
2022-03-29 11:50:49
0
4e43b5eb2b5aa3c7378dfe1eb0ead44b4a94eed9c4754e388476218c2b73d3ca
70
2022-03-28 19:12:57
40
69cd8097a1596ab01b56044fa491ec88a0c8b93764e721a465f829b06455c2d1
53
2022-03-16 01:23:16
0
58de25f37eff8817ae9e168a73aeea4d855e770bb85a76d1c247134b9d35cf80
54
2022-03-14 23:48:38
0
29dbedc02445fdbcfb37011d67cc0ba8fe8170c47159a92ab369c062f4bad950
54
2022-03-14 23:41:32
0
e4bc301cb6805b7ace63fa124fdcfc4902baf7dce0776bec2210af848a86c6b9
56
2022-03-05 00:23:40
0
e58c163bb265b1aa42979556b0bf5bd3f48608b62df9c79055fcd2678341836d
58
2022-02-22 08:41:17
15
de99a71671f10f8cf62abe862432322b6edc7bba57e8dccd0071d6e372ae81b9
69
2022-02-22 08:39:10
16
5e8fbd9362663bd95039890e2a5f149ec34516986ec58eb34b29df8d61dc5a03
69
2022-02-22 08:18:19
14
b205dd716853f041490ddfa8b3be9593a8f294ccaa26e38c780751783904daad
68
2022-02-22 08:08:04
14
9284268f7a1e8bd4e998f2b7fb492e03afd26b06c9441efabe7c2d1f624a76f1
68
2022-02-21 09:10:44
21
8befa341b8023e76b6484aacdc70263262ef8137abc57a0da671dafcf12b027b
61
2022-02-18 14:33:02
4
dc613ee4a3e74f6e16a59cfc9a0a8e13b9cb20991d64da80bf10bbc0d7b01262
61
2022-02-18 13:29:03
6
9c46c93635990690db0d303fdef9c0aed5286341e2b1d503f100e4656c7f333a
69
2022-02-18 07:09:47
1
c248c7eecf637e9cfec4353b55336542a1ac13fbb5e58ebd622e4717cffc09c7
58
2022-02-18 04:30:11
0
dbf135e4e11a13e85b75614b7f4cd368cc314ecfc143f48301f47a01ab98058c
67
2022-02-18 00:25:22
3
3f7e4e129a961038cc16756c823176d1b6397be12160d4d3775b75289cbfe0b1
69
2022-02-18 00:24:15
4
64a856dd7a227b5dfc8f58960bafaccff4c4c8187854d907b8147bc07b008e9d
61
2022-02-17 22:08:08
32
8b9f9a224ea4b76c2516177258bc3856a0f29073bbac01d6dc3910c636645f99
61
2022-02-17 01:46:05
27
6675d8734c98a9e545f81d1ff8ee28f6f8a281a416778a2cdad50213056f4c83
61
2022-02-16 16:48:59
28
d9cb9796b8e41f397c5aa075fd44aeeca2e4d1f5ff6c95da6aeb54a85c7b7f73
61
2022-02-14 19:52:07
21
3cbe5c19640c4a7b65a35f559bfabb7874bf75814bbe036f7d88b130b3f2fe77
70
2022-02-14 06:54:14
44
6969c3544e1cc909e5c928ca418b19cdf2193a6716c6d1cd4f42f5505c7dfde8
47
2022-02-13 11:42:56
28
851132b7b78bac917ef54f326102187d14a1e8481a683b52a378855dd8b91744
69
2022-02-12 19:19:19
3

Rule Matches per Month (last 24 months)