SUSP_CobaltStrike_Indicators_Jul21_2

Rule Info

Rule Hash
7dd06085012a0217125dfdba1d8c9923
Score
60
Required Modules
[]
Minimum Yara
1.7
Av Ratio
20.77
Reference
Internal Research
Description
Detects files similar to files modified with CobaltStrike ArtifactKit
Author
Florian Roth
Name
SUSP_CobaltStrike_Indicators_Jul21_2
Tags
['SUSP', 'EXE', 'S0154', 'FILE', 'T1075']
Date
2021-07-09

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
52
Suspicious (< 10 engines)
43
Clean (0 engines)
1

Rule Matches

Total
Hash
Timestamp
Positives
VT
69
5eab5376d337e397fbb20b26c55b35391a038ab86f11a5cc908f99f4e8d34cc9
2021-08-01 11:41:14
29
69
0f458c61d81097e0ee050272fc1014fe3cec3a14c71498e78e6114d5083e6111
2021-08-01 09:25:18
14
69
e657c4058a3490f1e2366fb772fab29f80f63c8219bcf9c7d08a11797ab5ccc9
2021-08-01 07:24:18
16
68
d64eb7abdc5eef7d236f6d9f73288a08086541bfde0499c685f7d80704e3f5bd
2021-07-31 20:30:45
33
68
e2183606cb63866b8d7666b0ff65baaaf1b5ca4069aa488511039cfdd4cf18ad
2021-07-30 09:27:41
12
68
3ea8b4591a4bb2e0c462e4efd30097f30366d99c58d20fe6e5aa1a2ff9ce0a73
2021-07-30 04:05:13
2
68
d09e833d31a07131199aa3fe7f3513c693086ea419c81ee68aa21e8121f10e10
2021-07-29 11:51:57
13
70
e01fd0bba044c4b3367c322c7631f5e034ff7c6ab23efe7173da503bfab5edfe
2021-07-29 07:27:15
22
69
1e2f85b51803329d5ea8b739be502f6b92d74a088b9d0a880707f59973c8ae09
2021-07-28 06:30:38
13
69
2c461afe135d6edc1b151569da27478bd652b02facd895c757dd42f4ac0573bb
2021-07-28 06:27:30
13
69
cba698be600ca260be885ffa78f4516b018df5e4515569ded687c79161cf7509
2021-07-28 06:26:27
13
69
a8c6cbdd3b889c646307ca515e39eb5c744d7576cd30710954ef9b49b31303ba
2021-07-28 06:18:03
11
69
af5881ae761f505d5481ade8d08ca84b0391cda6b4643c2315942cfb512a04a5
2021-07-28 06:16:59
12
70
a838f0ab4b4f38ed98c4ee67fb6102eb1001855b66443b660c56407eafa9facd
2021-07-28 03:35:42
27
70
6ea9f46783f3ec1a1c6808f4936f3228a3d02c10c31faae490548e9898930cfa
2021-07-27 23:22:25
21
70
b4e30c0ce7dd615db805838edda7f024aafb05afb926d0dfd679db639c45f47c
2021-07-27 23:20:03
32
66
dc65ff98344507283ff1f7039eaa9efa6d5a5f2c5046a7b6f0112ee0cfc597da
2021-07-27 10:44:06
1
69
3bf30457a20f157feef5e50004dccac6973801e1785d87818b7568700425f3e1
2021-07-27 07:18:09
34
70
32d02e3764c1133fa64dc1a00510c59adfde4e76657b20c00785dd8065a960c9
2021-07-27 00:19:19
29
68
5ebd9eba9fe6c84809d5917da7be37a70e3c6579b5c14bbad37be8b35f2d67f4
2021-07-26 17:26:47
14
69
6bbabed7b0f11e304b0cb97013c9095d51fa330aee3a966b5626088e92a0dfeb
2021-07-26 07:10:16
15
69
a8feff538ad589fd4a073cf619d0adf1568c0761911c5759aa734402a3beacbd
2021-07-25 13:14:25
11
69
b78f1bd36e1b7a7359d46b0f7ad7ffc7e399bfd87dfee4d0b1d2d4e97cacf782
2021-07-24 23:56:16
11
69
7680ff0457c2c92c1109ed6cce3b35541ed354a2d0e6df9524587215c2ecf699
2021-07-24 19:28:58
30
67
d2e1b733743b1bf76be53e6c3ab549ef137d19b2a72bda9c55d1ffee32db2a6a
2021-07-24 08:51:10
13
69
d84788740cfba1967467e0c955a6be6f98219d835781611dc6c0053a60d863e2
2021-07-24 08:26:44
38
65
955a213ea46d2c1192cef30b37c9e9e6a94d83848c6e2a275eb61138ed0e663d
2021-07-24 08:23:26
20
68
d19ca030487cf9bb0be9d7ae2124b26ddb889438c116b7e046f0465970d1295c
2021-07-24 05:35:16
28
67
2c1c1548f76aeda4903e3dcc453a2aa1b5e1871f9fe89bb78c27e21fd921d54e
2021-07-24 05:14:11
30
69
d026e79e4c159679667034de565657bcc5e2e1f1d2b24bad3c240ec235797f69
2021-07-23 19:45:11
27
70
ba443eabe2637ab7d8fefa295f73b5e584f283a3a44207e29aacd4a3ed77993b
2021-07-23 17:12:02
28
70
19f04e0e2eef3ffa8d6a661a03fac4af9965685c3eb84ba536a0b41ab881c2ce
2021-07-23 10:21:22
31
69
5a9b61b6c6cc50a20af9b3c396b84f58a309e8eeb39a626a1cea0e56ba6f4346
2021-07-23 08:43:58
23
69
1a438d1e3c5b700802813fbb02c9e137bddbd0568aae55562bebf4f3f986598e
2021-07-23 07:36:20
7
69
5136ba602caaf25b3866762d0d44cebbbd9720f310f4d92f1db6e18cd7b2ea38
2021-07-22 15:36:03
3
68
426bff3d010e2e03cf430d643f8d39b41e8ba90923ac3953e56c48cb308ae3de
2021-07-22 15:30:52
10
69
7185f6f5f4c351f21aa67385b73c5360ae98176db5512bc9a418484b38b310fa
2021-07-22 11:43:54
29
68
b97effe37f1e69ccae7fe7552bfd62eaff971c924d0ce1bdca25ccc3d8e67752
2021-07-22 10:33:38
6
70
66298bc8615386514af8ffb7ba6096e516b130adf386327f0825f3b1854b80b5
2021-07-22 10:16:30
19
65
7c4b4bdf38fde867370eb8a7fb018171bc4afc0ff6967516b1e881da9a5886c4
2021-07-22 08:38:48
19
70
4615111d1eeec408e2f47f0d954f70c39d9b4f7c3794c5767f56c76e5299d85e
2021-07-22 08:32:19
27
69
5a98a770fce03648e9d7b91e5bce2f85d1b4fe461171824cec0b7fb481f16162
2021-07-21 15:48:57
6
69
666ccbb02b1fcdde1e05cb9e6ac505b2838515176878c446f879a5a1b7c90e2b
2021-07-21 12:09:59
6
69
993d280494694c7f7427769e0662750beb2d7080fe9292ff3cecce3af7b6f830
2021-07-21 09:32:13
6
69
a79cb5a4e88f4dbc59263b6748100e6fbe47ab39470b258da35c9dd5a1375c1b
2021-07-20 23:16:41
7
69
f84c98549bb45c936b0fa697c01c1de4e4479155e4820520c9e59310792a08f7
2021-07-20 21:59:03
3
69
b348e07cbc35b69da33dbe641eb36dccabb32971d8a69787de6990f114974ecf
2021-07-20 18:02:13
2
67
994146cf6756f3538e2ef3cd7b3434d283ae93e4c51bd83888a3e73466d8eb55
2021-07-20 16:56:08
4
69
70c0b8edb4cff1eac412a8058bc09dbce62b89e6926bfa17ef22cbb2c4193925
2021-07-20 16:45:38
5
69
0e56058c14067268dd56629c367e868e496f83336b4d8dc67742658dd4d6cdbd
2021-07-20 13:54:52
6
68
735da14d6f804331053a1afd5a68a0c258ee090a52f2a53c86011ce526e11922
2021-07-20 10:58:42
5
69
a0b97ec5003fce3614ce84370aea700efe3b2e836c67acb760f0af500ca855fa
2021-07-20 10:57:45
4
64
44e5ff9b285977bbfd5e90c27b00f593ed1c3183abf2848254843419d0c26306
2021-07-20 07:44:11
15
68
3d190dd147a8cba87b249aa04a7f103f273197a984e586666ef528d72514cc36
2021-07-20 06:52:07
4
69
7b33d11a94acec33d0a3666c92719ade5f41f66a016ea47118852c2ad097fa8b
2021-07-20 05:15:12
4
66
4880ef16cecd7d19f77084531cacbc5162768be3d907b8678e9462babe9870f0
2021-07-20 04:50:47
4
69
fcce8a608527fc92744f21edeca4083abd935e73b95bca63173a4a9913b36922
2021-07-19 17:17:47
34
67
edbe40fc5c10f6d128860f1bd760a48f5f8dfbebbc6e9ff11672a6d69c9a4e35
2021-07-19 16:53:40
0
64
a341acff930ebbe350876a8552618bc168adaf8d6f42c4784ad7ad44666a53de
2021-07-19 15:06:04
2
68
ebc3ea249e2aa65e11a47918317ff118dc848749b74de1fef14292a4b68d6320
2021-07-18 23:24:35
7
68
d7cae44eaa9b37475a1a1fc4faa9eff7557bb8a2595367a9e9b1fe71fe628a96
2021-07-18 15:24:11
3
68
a37744e0ec0e06ab23ac556d13130f6f51f7966f0eb535df253d8cf35b8fd1e2
2021-07-18 12:22:13
4
69
25741d476deb04b341acb2553f393683f4093c3c2b748bbfbeec65bc6f86154c
2021-07-18 10:29:30
37
68
7544a136104269a867d65c85e3c45ec1931212c468cdeda6f9cea4055de7ad35
2021-07-18 09:02:14
7
69
4a4bad6d61ddb4d5cef6a15b53d95b21d60572649d2b45f19877e7b32fadc916
2021-07-18 04:24:37
29
68
131e1204926481ed529efb76c8c1554f8e9b9e7920e0fc152e47690858fa1407
2021-07-17 07:20:24
3
68
50729191ddc84e48658615bb6864d058f0c8faa1d80c0b3a3755385f01850999
2021-07-16 21:36:29
27
68
7bec541e3801a106bae53b7b89388f54202e9e399abd5e6cd66ed4f6adc33cc6
2021-07-16 20:24:52
27
70
29140aa2cae87e151f320e2c58f5fc3aa9c5e9b484b7eecb854ca91848c071ab
2021-07-16 17:27:02
11
68
3469d8a9deedfdc8152e402ef2fdca328d662711ee427f127c6b5a2ac9c7c35e
2021-07-16 16:28:22
26
69
157449e2cf0e943480ca4b770ed9b41aed4b706f4073719974a55b2d025a9fec
2021-07-16 12:29:42
42
70
1e5e84c6cc44a4e5f48d220b234d9bcee750a757449e83a541c6b943a47a437a
2021-07-16 10:27:10
16
70
378b78e5f4c95189d582e16aa4a4af1a1ebcb871839d93000ca1e373e9d04547
2021-07-16 10:19:07
14
68
f28375afa73378c1d5388e1db145645c9c3a11e2aa6c67aefeb5771377c8d685
2021-07-15 18:38:52
24
68
b89615c32ac1e59ea0153a39db2e5dd478315f3e6d2186b0399a15973886e7ce
2021-07-15 13:07:06
2
67
f184dded5fd2ecee0996408dbe933a7ee9da18794e580afb836834e05b606c56
2021-07-15 11:48:21
4
67
0b51c625d7de19ba9328c46ee6715c274c8caff2bf86c9fbd751881e2c3c9a66
2021-07-15 07:48:50
2
66
b12477e4ed2eb6586582a2b06ce278119ef80a24c50fbb9bcfa98a8e58ed6642
2021-07-15 07:32:52
2
69
eb56a424388889747f8e7aecbea16344a235bf4263fcc72d3f039d32d479c2b1
2021-07-15 05:30:48
35
68
21cdccefc30af53fb948cc655cc6a25ab7fb1de40807492a4453900838de812f
2021-07-15 04:33:53
4
69
f6616d019b44b02f3faa24b2261e3f1436f52690fb6c9167710507f2d1d8c45f
2021-07-15 03:52:22
3
68
4721ea24e099e108da1cd88ef8ddf6acce65fc4737ca9e62e13c2b5e0fa426fe
2021-07-15 02:36:04
4
68
f1a14ab2e59bf38ba331010ed6f5b41f2b6c54ccffea1ba8060566163eee1565
2021-07-14 21:42:51
6
68
858f4a623e24d8fdef426002c8a0e4f15778a67e4eb2413e4a41aff10535dbb5
2021-07-14 19:24:02
4
68
26cfafc374b93cd37bbd4b701cab1a84ca2829f29e6a6763b8e0fc33cbbaf817
2021-07-14 12:30:20
7
69
de14b867577ebd620892b47acd0f9604bf31f41fa2a954e97292ce3ab1eeadc4
2021-07-14 11:22:34
2
68
c3c5fd7c22c935ef9cbff98ceb333731353340539e017f99535a0e7355d237a7
2021-07-14 10:01:39
2
68
5e3430a72aa7ff7a013a8b64c25bb6cb6081426ec3c19f49f8d1baf089935b0d
2021-07-14 09:19:39
5
67
d76c9d644411031a8a1ad5cb3ff59e765b8cca54ada60fb3722cb74f7521a1eb
2021-07-14 09:16:30
2
69
c28d2f035fea3ec3948b47233c65ca5f46ee637f9cd3bbabe82a0b6d703382ee
2021-07-14 08:24:04
2
69
b99b9ac836961b856168e21ea8344391ccd2c472d764ae1b46367023263ecee7
2021-07-14 07:22:54
35
70
267d03b48a6bb79034e0c61075f38771281b58f9b1ab6a9342a6c0ed6e50d364
2021-07-14 03:25:57
37
68
c8ead495b568e9e8a9a96f5442892688d23919fe47be200e96cf11f44f4361e9
2021-07-13 18:46:03
1
68
a73b0a98011a486480282f0192718fadb8534bf0ef8667e9d2fbfb4826fa6f3d
2021-07-13 04:41:56
3
69
d6d300e220d03564cb78b82e339c4f8dc21cc12163ad813c42daa3f83f147f8e
2021-07-13 00:49:06
26
69
dfab74b590e2d8d82ed08edc2148d8f70f7fa9baa5c857ce5b3960e340d5a4c4
2021-07-12 22:58:21
2

Rule Matches per Month (last 24 months)