SUSP_CreateMutex_Script

Rule Info

Rule Hash
acc6eabda1f66abd202e6ed7f191a72e
Score
70
Tags
['SUSP', 'T1136']
Reference
Internal Research
Name
SUSP_CreateMutex_Script
Date
2020-04-01
Required Modules
[]
Author
Florian Roth
Description
Detects a suspicious script that creates a local Mutex
Minimum Yara
1.7
Av Ratio
10.16

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
10
Suspicious (< 10 engines)
52
Clean (0 engines)
13

Rule Matches

Hash
Total
Timestamp
Positives
VT
467f987ded90d181ca9d816a0d53a1710276cfa625be0f366d5310709de8371b
57
2020-07-31 10:47:18
0
e87a234711e75a5fa9bcd9a55c04d67c2ebbd21ff1cbc651ed09859b23f69497
57
2020-07-31 10:47:15
0
4985e9887ecb8a5cc5535c09f4094dce77bcaf6fb651f88930879276b5805e6e
58
2020-07-31 10:46:44
0
43b0300f6d4ccafa60f5d80be220833bd7fce34c2106419fac54581de1b72595
61
2020-07-30 23:28:02
5
6ae86b5390bdd940bf9c441df5031ae8d726f5c64f742dcaeda55752b629f141
58
2020-07-29 10:53:00
0
3e714c2665f60a219e4129af3bdc73201c6d730af471024e033c05db613baec0
59
2020-07-28 22:37:29
6
3b270c9e54b588f36c24be6d8543b046f5b3be59ae4ad7fb88cc7f91ebe14d39
59
2020-07-28 19:43:20
0
93c03ddfdff4ea65fa6207d6dcc350df744b9956fdffd42ab44f82df51297a9e
58
2020-07-28 19:43:17
0
4b5aabdd086c2747acc74fe09193fc23bc00d6ff7e6244f7c16e39a928e046d4
61
2020-07-24 22:19:31
22
609feeb2255e626135ec12cc7051a23ed766a7bd9e02a7a58aea3c9a90aa2602
60
2020-07-24 22:18:22
0
7ef1dfc92f300690b6736503c1250721bc3727c337e7ede7836e1db54ef2d2a6
59
2020-07-24 16:11:26
0
abd737d62fb103f2b61e149288d4408823ab32c17e943931d9a2855394120aca
60
2020-07-24 16:11:10
0
07504f8b1884b02aca544d6cd5e34a4864d284f5782781ea494c823714474bba
61
2020-07-24 16:06:36
6
b21d4bd3555f59261beba774d50970997f576995022b6dc24554a17680bb54fd
61
2020-07-13 17:25:00
5
31afb53838f70dc7370cd3fc5611b4500f9028275db70bbd9bf22bb90c8e3a41
61
2020-07-11 09:53:28
5
3bc980ece171932d0674a49c92de4dbd5a9ff64e3ce460266cbf4d453f053cdd
61
2020-07-11 03:43:04
0
5e371d0c466ac6bfb992e9269c119b05626b8f6180e07514c03a576f928aaf59
62
2020-07-05 18:56:29
5
b42b481835953cc37f26beb8e83cca1b2c8859ba95ef1ae61c8099dc3a56ddd3
53
2020-07-05 18:49:33
5
fdf15f388a511a63fbad223e6edb259abdd4009ec81fcc87ce84f0f2024c8057
59
2020-07-04 03:16:05
24
f765752628da792027f27f408dd26334809639aa17566a96a9ed5529d5f5d39e
62
2020-07-01 06:44:11
4
a6a177c5a5e63ac143bf8e35518dd6472829a60129ec23e43b357c576d5bceea
61
2020-06-30 19:28:40
7
6593bb39dfe34206d4e38a9de03833da94cffad008dc07fbf31cf9170c31a8cd
61
2020-06-30 19:18:08
4
14dbc16cb9221bb7e660cb93a4ad18a1e81cba6c002c23fcd59c600b42f92a6f
62
2020-06-30 17:30:42
6
28f09de82b036b6646d69d42c14794a2fa404691b17491fe55e896a4aaf45d4c
61
2020-06-30 17:13:43
6
16ec739e33a61cf3eeb2f7f53f52a1dedb72f6902cafb237e7ceeace541afb00
61
2020-06-27 08:15:54
5
3b81b38c907d4821e7ced7c494f2ed09890b8aaf299749ab04c1f5955387da78
62
2020-06-23 10:21:09
6
8e988e13ef286b465516456945f9acf9a49b0ac2e25f6833db56425935410bce
62
2020-06-23 04:22:29
5
fdcb2bc1b57c14147d8487576c2f5443d9ae42314124298e2b9702a778dc54af
62
2020-06-17 11:52:35
6
c4f003bd38a730c95e044f162ef11390b0423caafccf41fe8aba470fd1e1b5d2
63
2020-06-14 12:14:05
5
3d7a9c419c7c501593e91fb7499adf46c2223f4312f24167c4b3068624e110c8
62
2020-06-14 12:14:03
6
a60065d0f3e2ce3a30a0959156d98e24563ee4fbe96947a812709c5138457d88
62
2020-06-13 02:27:49
6
a48356a39d514573bd45a895b8b716a1571627c32e32eab3d72fcc99ebcb109a
60
2020-06-12 22:15:54
6
9068d1c4080f2a7eab42d9d1719c281d61eb7f7007cb6e600ccdcf45bfc59a36
62
2020-06-12 19:23:30
5
f66d92e75a529943ca0b5b5e463c47747d2a3ef524bdc82d1dd50d7b304619e2
63
2020-06-12 19:20:07
2
92ab8685096d03ce6d0fb9bd5b98a6619175c3f7fcfd854347e4557ffabd75ed
60
2020-06-09 10:38:07
19
ed6c5543b413fd1981fe92fe096fe50f1830cecdf54c1001e6c07f19e3b95d4b
60
2020-06-08 15:06:05
18
a46b2bfc1fe4c23ec9375f9f11d640a429b3585126d41a0496e94fb0e8ae114b
60
2020-06-08 14:22:51
17
a8c78839776b836234caddf3f8298924da70fb02c0a34298a4c0ab0582b4eef1
58
2020-06-08 14:22:14
35
9d73d93407c7f2f582ad4232521971bf452b7c1e50e6932fcbc18cdeb8f782b1
60
2020-06-08 09:23:49
16
d846266c5859910ef21623ff390c594ccb03c927b1ff3d0ed80b843c95f2d722
62
2020-06-08 08:44:10
21
babc5abe76f443c41345004717cb9f98d49da1e0aefe8df894952ccdba13977f
61
2020-06-02 20:19:54
6
77ae4d9133c9b0379efc06f9ba3efaf445de8704b6591df0c3827a5b93234f9c
62
2020-05-31 13:45:45
1
c525eeefaf99932084fb87a5bebf824c36918162b8cc1ecb67c3f4a11289d827
62
2020-05-29 23:35:15
6
0906e1c280df76c3018e9f4a4384749cf40e99996c782816087168e26e7b2d38
61
2020-05-29 21:19:57
1
6c57c660a712ee72b74347563de5871c187f87de8cc839b13f7587818d2f233a
62
2020-05-28 22:23:47
5
f44d2f3ee41f2703cb4ab870fda716aa10a890a5026f676ecfcf5b4007d725c3
62
2020-05-28 20:50:57
1
663441bb46a642b829e80b23772b1b4eda27e73436208bacdacf25766c77c1a2
62
2020-05-28 19:57:31
7
c7f09e57a2f6bb3a3ff46a09275892a90ed2c2fb0f283f2fdc0f51762e3161c4
62
2020-05-27 01:38:53
3
425e8b0c507265e54af136f6d37142a3aa612c53c6b94c5e93f86e4a2c1ca54c
61
2020-05-26 23:46:52
3
9a1b164f082a79d705e2858e3c8e02b1ff4ae49d44cb76d8757fde02352ff61d
62
2020-05-20 10:36:15
7
efbcdf11718497dbe4db215a0481d4a92c7ed153683239dca5917c7fdd6f3e3f
61
2020-05-20 10:35:59
8
28fcd44fac9bead0df99f58d6b56694812aac7ce30d4fe99b080d21b0a82f02f
61
2020-05-19 06:10:17
5
113ba1c96dfb49e4d1691a6601df6d1e22cacf887274d9cc016e9803d0844c39
61
2020-05-15 16:51:28
5
4f16cf0ebf0f18bf7969b807076d3777b7c8fbbed529fa5769400f3ab65a4bbc
61
2020-05-15 16:19:40
5
2885e191a0871da4a380524d9306f10e7b4eda78c0e6912e74eee3b073d1de68
59
2020-05-12 16:38:16
3
106be141f43a12e5c580868c2dd8ca3807e193e5e56e897c0bfeac97fdfbc1a1
60
2020-05-12 10:17:22
6
f13b34598bf024574a194aad148f98ca57867cf078ad69401840317f14e355a1
61
2020-05-07 06:12:07
3
4034068ec37075484622f7e4c2a5271bef7cda2b71c1e165822fccc2d7114481
61
2020-04-30 19:49:24
9
afaad6808fe3d7b7bca5c348149aebf1553e237009a49712f4383dbe776c5a06
60
2020-04-26 05:25:10
15
9a23b5c0e97bd121bd030ad201d5f489d79fda63c835f68ed0dd69663f0a4ae4
55
2020-04-18 08:21:52
5
773ab592032a6d5eabcd04423cf98237567d7c7e78d39122e1604883b83092f4
61
2020-04-18 08:21:06
7
b862cee255bbfc7a218d996094fde50962daaefed38085c0bef4107880a11198
62
2020-04-18 08:20:06
6
b78faec95411e0afa6cdf4c990364a2a87434ac6c71a5c4f7ec46f38412d6bfe
62
2020-04-18 08:19:36
1
29bf93a0a50fac34e44651581ce13a08ba180d3cb6dcc2cd7c0f4cbf3b32470b
62
2020-04-18 08:19:13
7
db5cb8caaedc1689a80dde58c79efdb12f3c016d7b25853cd2e2e4a3ec386609
61
2020-04-18 04:59:40
7
ef32ced21b1674bbddb5554b27a2b484c754c8b4d0d934ef41b604b758b1b2ea
61
2020-04-18 04:58:27
7
b667b16fb39b1f60c348f747f7d2e13fa8518b599c783df648ba51e765a020d9
62
2020-04-18 04:58:10
6
ead439e96bd01c8c28bb1c335e8be2e1f85296de5a019a6ccdf2d91989a98fe5
60
2020-04-15 10:24:17
5
984033dc5741490c148c165bba43ca469d8a538187f7e9bc8474b12c50073140
54
2020-04-06 19:15:22
6
56b8f085775e091ee030393d04aa442daaf75459fee0d2dc43bdbd8c41c55e2b
62
2020-04-04 22:49:45
0
b40d6d0d082296cfd06e689e87a9695192078c05859134b5e9ce4eb3534fe7d6
61
2020-04-04 22:48:00
3
5d46e730ffebd0107a43482284b97f50bed1fbc60547dccfce656d2ae0fe57cd
62
2020-04-04 22:47:15
0
f3ef56533b1606c80ac5cd54f0b1a62830dfbcea57b4b51b0841b2062fbd89ba
59
2020-04-04 22:45:49
11
ac9b851900b7310ac111e36a7275635c4cda523033f86e4db32e9ecfe69d6838
62
2020-04-04 21:15:37
0
70e7b6184a74fbb2e1b97e9730b6188e1506e4f7f498a6f41dd404ff9ab8c897
59
2020-04-03 21:07:18
2

Rule Matches per Month (last 24 months)