SUSP_Encoded_ReflectiveLoader

Rule Info

Date
2020-03-27
Av Ratio
25.12
Rule Hash
d4eb1426fef06d8a7dbe52b21269976a
Score
80
Reference
Internal Research - Permutator
Description
Detects encoded strings found in reflective loaders
Name
SUSP_Encoded_ReflectiveLoader
Required Modules
[]
Tags
['SUSP', 'T1027', 'T1136']
Author
Florian Roth
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
69
Suspicious (< 10 engines)
36
Clean (0 engines)
16

Rule Matches

Hash
Total
Timestamp
Positives
VT
11a8bb47bbca89d4802a0c5fbdb6ddb7702995442f0ae52acec13d1aa4a32e10
71
2020-10-20 11:22:59
22
b8fc90a9e8ced2013166cc22e4e42cd8fa1a9d30562466407b5afe0ebfe3d12a
60
2020-10-19 21:33:02
0
032d1aa450227df5d23cc304009ad2db48b33e78191f464a1acc101807845aa7
68
2020-10-15 21:46:12
32
f2b4ac9e69be3e76e80e5645b7281ef6c09fcf567cfad659b2e18dfa50a45c87
58
2020-10-13 14:16:37
0
6530809af7209d7ace763e05129906447324700ea1e0197b98ea63752d70943a
59
2020-10-13 14:14:30
8
2a548f75e40c907afabc7ffc73a3e6ca40b7183d85d2d2b9cb49c809149e1c84
59
2020-10-13 14:14:17
0
dec00b6246246406c017827f0f68ea343d9542cabfe2022cd9ec82a3b00a9992
59
2020-10-13 14:13:57
0
caf76f61515b1cc3835d93867e47537508f67cafc419e0efcebde9a8d2d4b904
59
2020-10-13 14:10:00
0
e52748091e1a7182b502b4b0e2f9465a4afaa67b0e74386c3f664fd20bf4a62d
61
2020-10-08 14:25:41
1
2ddb3b6164cb2db5696868389a340cbb07567972881ff4b70d3aa34754353067
53
2020-10-06 21:18:41
2
2214e4bc458b79ee3ecbdbd719670162bd0dc86500aa1413dc4eb6dc867cf946
59
2020-10-06 21:18:14
16
4542593be8a6865dd2e5202736679530ada526f74ea2986741fdf78af9bae2e8
59
2020-10-05 16:21:23
2
8977cb9ee1feeb863b44698b94c70650cf64409abf34b6a9b81e801aec955b6d
59
2020-10-04 19:59:18
4
6c7d2a846e18a19f091a3ab72406512d98057cbdd4d521d405f838e2d0a04d21
58
2020-10-03 16:22:52
3
4351ed3fc65e57ae9035ae007b5832adf5a6806acb94045802a9126c475bd59e
60
2020-10-02 04:44:38
29
e318641c1c0ffc7744de277bb2c97c22d2f51f805417a18097985be7f957c8a9
60
2020-09-30 22:50:28
26
385328e00a65a8c01aee3e3041037c2c8e59eb0723c7b63ff6b8414823d70dca
61
2020-09-29 13:44:27
9
4f0e2468bcf40db815d381dd37e15653864f6da4850f52a1bca31476e0b9c514
58
2020-09-27 00:16:12
1
4ec1477ca2722d57f864aee9e2354bbf34b697e8d0edfbc72d7e0c32e4fb6618
60
2020-09-26 22:23:55
0
4073ab1016fb5f7198596cc1758fc6d76c0f956f25f39589222e62fb6b4454bc
69
2020-09-22 21:14:22
10
805e7359ed33260510e233f988bf71d1f7ab8079ab7ed089709d38d9fc7cdb88
71
2020-09-22 16:12:31
5
901f37d8bdd08af10801b2ec8b570bab724236873759d7dffc0575099facf958
67
2020-09-04 17:24:15
52
832a993b6308769449e292d296e5d4301f2bc41c90b47612b4216c3608b0dee0
70
2020-08-29 06:28:17
34
39f994a9fc375b5972357e07e107018a5fc498cceee037da1754ba6bad6af4b3
57
2020-08-25 22:16:27
0
29d2c2892057cd82e602442ed2eb8813022fe50f34fb39b9370d65dc8b91a6f6
59
2020-08-11 03:58:23
26
82790f7439691148bb3d56fb8e0960dcca365093f29161ab6485ee3ad61f9545
59
2020-08-11 03:57:56
26
a89c1b55f94aac9e86899250967ed45df9575b4f36bfc2a819f354328ea34318
72
2020-08-09 18:41:08
47
ad15bef7a64d814fb7bd33e6924cca3261dd7d23b0f54d59a6264232df4cb9ca
59
2020-08-04 16:41:46
0
649b1661ddf332bbfdef438a35c44bf0226b8e73e642aecbeae61975d0ec1b20
58
2020-08-04 10:55:25
0
42d27317ac3dcfd4adafa9eac8f0d8c24bad7774870249f7bda349ae7240cd11
59
2020-07-30 08:23:01
16
bb4000f4c5d1f1501319e3325b441386239128ca20a3ee70abcc72717a4b97c3
59
2020-07-29 07:25:12
1
902cad9743a2805929aa12373b522fef8534b2b5edf3e480d2f17e2bdca25d86
58
2020-07-27 14:57:01
19
ce0e2cb00e85aa22a96ce384a0396b8effee5fdbfaa385abd41b8f461f44df9f
58
2020-07-26 13:56:22
33
8191bc7095c4cb0bd71a33ace4bdbdd0298e31cfce2a0f548f005e33a086437d
57
2020-07-25 16:10:07
7
e762b9c3a55d1a26531e8541d7ef8b06d7327d93860da152f00ae0373c69e44c
59
2020-07-19 04:47:25
5
cb9a0d56f7c4237936adbee231c70da4d6266bc4fe50a77ede2bc396b8911274
71
2020-07-10 04:16:44
38
0f732bc6e791d823c0659e1f34196074cba12b7749c988cb457c01b6ac3e0eef
73
2020-07-04 17:18:11
10
cd3fc5ec0e601e11d1da381da2a2521b125a6610cbfcd80c500111df23a7eadc
72
2020-07-04 17:14:24
9
6f254857a8a19f44f8f4ff063b843f9bd4b8779c3d1b2344402a76f2a89a9456
59
2020-07-03 14:20:12
5
294ba0f8bacd5dddc3ace78394cce01a256121296200dedea3971a156bc6db91
59
2020-07-03 14:12:17
0
84bd58b1034bf1556f2e2281c0bb082ec95369e029688fa01e5c7d60be5755a7
72
2020-07-02 18:31:11
33
0df854214698483819058ef1b311f6a842b1906f9698cdd16022882d55acd2d5
71
2020-07-02 18:30:29
31
beb8babd9455e5eca661a05dc67df14b52b3b8883adb7b5723c633ee58ea6254
72
2020-07-02 18:29:12
30
a6e8aa12be8f90e4eb5999de3a7cb82ab0aa8c3014f9f5399d2db410e2611ad2
72
2020-07-02 18:28:41
30
4deb9c1d1238baadcaadfe50acea1bf67d60ec5549b6df48601a7e4519048b62
72
2020-07-02 18:28:20
31
3f59ae0829453f331aea7216b3dae802c25b142c239eeef02a26cd239e9240e4
71
2020-07-02 17:25:27
28
991ed75e4c300871b76a1ed6469d40ae410709a426e5cb100f44afcb0c646190
73
2020-07-02 08:42:16
30
368c60b5ad3c9ca8b355457a1a572311d34ea052ffbda32ecaacba864377dd61
72
2020-07-02 08:41:55
31
6111149379db3eda389e8bb7d98c70bfa0f2a4ad3e0cb3cebbfbe3c8bf2dcb50
73
2020-07-02 08:41:16
28
c6f4f0469d9791c020d969e734be35af44834d718d360bac0e57432b3e3c9042
72
2020-07-02 08:41:04
29
f4408dc2e66791ad0cb535a9e096790de1708c9c7741918573d18c660353eb87
73
2020-07-02 08:41:04
30
377288fb54ecb7d291aa27dd33463db9d7afa9f0b19101d3391895dad727fb32
73
2020-07-02 08:40:17
30
cba92e4a744f7a2f4102b8b1eb8a0ddcb5fedc72ab46ec51ef01b259986cca06
70
2020-07-02 02:41:05
28
425f5e303c1d950530f962ff62e22c04c570b22db892deecf7b30f0c6cc03f3b
73
2020-07-02 02:40:48
30
f605b96a6ecf4af9897082b93c90015c74e4a8fc302718adbd1535d1b40596f8
72
2020-07-02 02:40:42
30
1d09a3b3cc072661359debd3697f7440435d3ba47ecacf0371799d555b2bdb6f
73
2020-07-02 02:39:56
30
9491a1a3eada7019297dbffd434bb7fde0c7ebd63bb0067a25bb61ea79ae7f30
59
2020-06-28 20:22:34
1
7ffe625619974f838c20f2c000d4d629b80c793b1f33ecc7956c875566400868
59
2020-06-28 09:45:28
0
5bf68e237eb938e06486413afc58104c9820af82b377fc786728550fb8e7b125
58
2020-06-28 09:33:27
1
2cbf75ce72d3a145f7407f4d46024489571fe16679c8a139a79e7897c237802b
57
2020-06-28 09:31:33
1
47b1e0c312cd05b2df5b14c24edb9424b002df5ece377a727e0b10351af2d221
59
2020-06-28 09:26:12
1
3e3ae79c87c02e743444901cc79b88559062b994b00c8f7d53a23f0c23cf9751
59
2020-06-28 09:20:21
1
0921d6a255c96f760522b65f9d88318d0273c003e0bb60aead4f09aaa3ad718e
59
2020-06-28 09:11:31
1
7360b8051d462bdd5cb15e68610f68239f178c8b9d1283510c5e2ffdc779f8a3
58
2020-06-28 08:57:45
1
7425093784731ce3ca8bb984d09392480ee4b079e22ebd5ebd4e158af17b6086
59
2020-06-28 08:52:11
1
fabd2a9c72c29b7d49f33b20884479a224e5f05f4a582d2d9e541c1fdd2b3735
58
2020-06-28 08:41:51
1
becb8d977ba6e4dcf1c01a4cac50c1b3a52d37d451335973335e7a59406ad66a
59
2020-06-27 10:17:15
0
a4e6c30d7aa78dc99fbd32252e69d726c335207a6aec69b8ac3979eaf1002b22
60
2020-06-27 10:07:00
8
b885ddb90e30a9f353bc0a2eb0e702d7b0247126f9df7eab12fbfcb78ea858f3
59
2020-06-27 04:07:55
26
d4f965550c6de5772e6d25dfbaa7736a1001f4e7e2fe608e025ff6c32a91ac16
59
2020-06-25 17:26:03
0
ea6228a91670a3f354d7e2dbb45cc3457029922ce464b2affd484d73a71a2aee
59
2020-06-25 17:25:04
1
24e7443544820c40fe589209ef06455205283b9f1f7fbc1409a4e8d8de4fce49
59
2020-06-25 17:21:53
0
fe7fac1aa6879045a13f652578df576c3d2a82bb816f5a94ccfa2a4e76cfd7ef
59
2020-06-25 17:20:39
1
a4c34c9694574c089bd0de85014af4136456d16ec38a88b6a815d42e731e17c3
58
2020-06-25 16:53:09
1
f462791dab3ce63cb7c26e891dd0d438c5eddf842b54568d310d5ac49eabad07
72
2020-06-24 19:45:05
16
c8f65e42c5c7d0eaf80284f979d55df89feca149a2678ddeea03107768b48191
73
2020-06-21 17:44:37
39
31b69525da2ca7355644cd3f73f04e451ce00e1787b40a371b45aab695bbf2aa
74
2020-06-16 06:23:28
16
eef8abf7d49a5f656c09d32063b310786c1a0fc9a122415d230da2eb7e37fd30
60
2020-06-10 07:23:32
29
ee9431b8a84f30fbea1be76a98db5aa8f4551c074bb8ddb702458a81d9894de5
59
2020-06-10 00:08:38
0
d6e6739a857ea59d28b902c5f179171f982e196e36873209ef3edde82715eced
59
2020-06-10 00:06:48
5
cbe7964d8575cfdde217e4a7f1b301db6c1996bb76de15f3dd4682dfea71d5a7
60
2020-06-09 07:03:29
30
540d4d79bd13f072fcca9191a1b167e18c24da9437a0ee371cf69350b2427959
59
2020-06-06 20:43:37
2
fdf2c401829b26401fe1285e67ef614a4a86fbdbd557e06993f6d7c3b687cb2e
59
2020-06-06 07:12:55
23
c017fca5a84e2174557383e50cb015a790a5d5b48fd30cf685b4da6653e5d000
59
2020-06-05 11:43:54
21
7e1efe0190324b8a71a2e2dfbfca407c3a8c09f03cdf89124a935fb307d2c56e
60
2020-06-05 06:02:45
27
78a14c6663bd9235b014b6d7b7ce19487f163317fdd36bb111d8797d7a7f1724
59
2020-06-03 16:19:31
2
9dbab0724cddaf379d926fc883915ec1911004f19dc10d7d75815e4718653190
62
2020-05-30 13:26:08
18
83981bb20d8491fef4b6f277f309b12c8b53e2660b9d7e46e2860492b9cfa6a6
60
2020-05-30 08:56:36
7
0f0fd4e1f7abf9bbe3a2d0dbf1b15fcffc69120b4dbb2b52b869d5a7e8f72209
62
2020-05-30 06:29:49
18
8f0e379c3f608749ba094225fc5f0f2e3e9ef2dc99bb3e7ccbe160830423c2d4
62
2020-05-29 05:19:49
30
6fb0247838f7375fd2f6a6dc1687f0978db193e577cd1847c521f3448e2c5b92
60
2020-05-28 22:59:29
27
2fb346b3c050337dd59f48d155e6c4b2625bd2d9eee1c68bdb88728377d2c1fa
60
2020-05-28 09:49:57
31
33529af5cc7a1cdbd447d26eeefacc6022e7d6f76b3e45b5f4a93e94eea383cf
60
2020-05-27 14:48:05
27
019b178137fec1707aba5fe42a2c3b5a110f64682dded9f335bcc3a3b36f33c3
60
2020-05-25 14:05:36
21
9afbe956acece734ef7e18dea6b485a017fba849da38656f8a943d5363da85c0
58
2020-05-24 09:19:27
23
a14b9318461881d483c35301724ec30fdc5ea80042bb1a9feb6f31224d2297b9
61
2020-05-22 07:22:37
30
6434242f25635116d568e01fd9727bae63e22c231c3f802d21e1c12442bbf580
60
2020-05-21 07:37:36
25
50d437ae311991627309dbc407a2d210b014cfee2fc63953acd14f404e88a32c
62
2020-05-21 07:32:46
33
345b2f46eb458410f96839120dc73330ac4ec31d03b510a66c9934a23270ed3e
59
2020-05-21 07:20:48
27
90147b13829df2fc357ccb425fd9a7fa5ae01dce8553ebef0010b1641f5e04e7
60
2020-05-20 07:40:05
27
01eaf89207f71c77c71289348c217fa74f7a9fcdff6d73106dcb0aef7bc325fc
59
2020-05-19 07:38:44
23
ebc2728384d98e188e8dd1d470e3dae742a6c3ddbec4bd6ce5be37622ee35035
59
2020-05-17 20:58:39
29
92f4ae162032afbc5d759954929fa740a3d881097a617d192b7ef9d5e79d6b0e
58
2020-05-15 18:17:00
26
1ec4dff4a97c3fe1360d92751c0d37a0bfa2188042c716210bb1b145719d1611
72
2020-05-13 18:17:48
16
07d0e079f9b02f63f43f10da1be1de561314c143d044cc3649474540a0df2012
60
2020-05-13 12:38:44
22
fe5e0ed2fc5d3ad97c773b6ded664c7066c69e212a60ce4d230c28bc5a404b6e
61
2020-05-13 03:35:25
26
04fc36150cb93a7df64447d5587f7064de904df81a16d5e54eca61dfada224c3
60
2020-05-12 12:42:40
28
df42897f0064e82a82aa81122395c13ee3372772511d21f503e6ef4911dc4334
57
2020-05-09 13:27:04
13
174a451ba2e0e0d59bb68c01ae6d9d305183192537676c0673d316ce503b7e0b
59
2020-05-09 12:41:08
15
dd38e5378f0de8489c9d015758d8ad390ecdf9599b8a4b90b218f6de6d1c1e16
61
2020-05-04 23:00:07
42
829d261a247018267231ed737f6fef7b1a22ff86639e99a7e982ab82f26a6cc2
59
2020-05-02 15:41:34
0
900ef83cc7b80085fa0fd58a078c91327e660a6afd00f82c52f7b77f64c2b6ca
72
2020-04-24 13:21:49
35
86272862075214f50d5455e3048f8be26896bea114392b6586c5693bb9df5aa8
57
2020-04-23 18:45:22
1
9515d9d0cd5d155e7ee99a35657476d76f0244dec6bf65a601b7e33951e4e848
70
2020-04-15 21:59:36
4
cbc36b8d3557befcf7fd409762add7ca541e4021d091d00d987389d94719598d
60
2020-04-15 15:35:49
18
db75692689e232985ec35bfc91bfa40474e33e259a680662104eb8efcc950dd0
59
2020-04-07 05:34:57
22
e605cd1289dd90a3dc7e5a867aca1a1d686f75268e82cf1b29b8ed1e8cee42e4
72
2020-04-05 20:30:40
42
96c6c69df775f66478ba6fe67cce47e9e68ee4c506d7eb3b1d57743a973ef9c4
59
2020-04-03 09:29:42
5
08b245ab0d93a509807afc1e01c400ed94d7e6ed30d4956e8b82b933611ae39c
60
2020-04-02 13:03:06
17
a172d4c9d60b8fcf5d71361a4d04b49708c2d72e8c22a65688270eb29dc424ea
58
2020-03-31 02:17:44
1
e4befac1ba26b565684a6cfecd2b3745d15c192510948905f61bc24076d223c5
71
2020-03-27 20:11:42
2

Rule Matches per Month (last 24 months)