SUSP_FromBase64String_PAYLOAD_Combo

Rule Info

Rule Hash
4b4bb94e35283aaf5c20d400b7dfd849
Score
60
Tags
['FILE', 'SUSP', 'T1136', 'T1132', 'ANOMALY']
Name
SUSP_FromBase64String_PAYLOAD_Combo
Date
2019-11-13
Required Modules
[]
Author
Florian Roth
Description
Detects a suspicious combination of FromBase64String string with a PAYLOAD keyword
Minimum Yara
1.7
Av Ratio
18.54

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
52
Suspicious (< 10 engines)
52
Clean (0 engines)
18

Rule Matches

Hash
Total
Timestamp
Positives
VT
f9824ef1ce0ee14a6473b61e6125533249423a645e29bffc353b811f595f4462
58
2020-07-31 15:38:02
1
49f7d1045645ba7c299414d800c285db374291c4c17ecf9fb8d95397620477af
56
2020-07-29 07:28:06
0
eb2609ecb8067b08b0450619ea981a26c42dc1d937b45709fabebff9fe310a75
61
2020-07-26 11:44:26
41
70ab77b55cb5ba4372f6d2496e82858b7b76ce96f1044dcb8b031e9db7d0cd47
59
2020-07-25 05:07:37
10
5f52fc18dc4cfb3512c49dd5c673c29e004f16c08f54edcdbd8e10e255baf5db
59
2020-07-22 18:34:15
1
9840fcd8f4170edc2bf8e442dcf67d4cce6e7f0a1a4cd0e28d134474fe111c5d
58
2020-07-21 13:58:05
1
6d9fc7277cb2c22d9e7811dea89c04a65e760e91c1adc23aef5df0bc6dddf535
58
2020-07-20 14:16:18
2
952d864436a22edb65d13dca527cf050f1f9116ebbecb6c31f48c9788840cd61
58
2020-07-20 14:15:40
0
657ecf32aa6d6c48381f4f88cf0bba4112829447af67925489269ceb2661fe50
59
2020-07-20 14:05:30
0
b3482881cfb94d4cd13fedf4aa7a33af3104628eaeabb2fa6b96ca538c5c2244
59
2020-07-20 14:04:44
0
8bc987cf1a4839599a92efd47b2a6fab9c9fba1ff69bcc33fba75832c3b80c7f
72
2020-07-19 20:17:24
27
64ec89a84895b66ae5061661e0caae0d57d2a70e6ded42b46e483323ea3c6c83
56
2020-07-19 19:38:03
20
270b3cd55f323b93c2325c3f7c924df270429caf6e3fcabf04408038bfe6cae2
59
2020-07-15 23:04:19
1
1368a3ca3b43f755dbf132e75be8edc409face3d2ca6caceee160ab345e9d32e
55
2020-07-14 20:46:11
5
719237c1065577e2f0957f3a615048c856dcbdb7d83b8087972677e8c5318a0a
58
2020-07-14 15:34:56
1
0596b8e265dbcdf0931c7d9544e6d801512a37bcf36ee504ec289dba4ddc3a21
59
2020-07-14 10:43:50
6
3c0f12013f99749d2eb5113c5ffdea13b09a010989600268eda704ee0003baf9
58
2020-07-09 21:38:32
0
2fb5c3f4363e51ee2c4c263a77374d3771d3d7adc8983117394db200b6aca0e9
60
2020-07-05 20:16:05
1
bfa80d629684025cb5090292dccc097ec82e7728435de2fda7d15f8244065ce0
57
2020-07-04 09:39:45
5
8a91e8144d26b69c60bfc83c38c3725c872aa89108bfdf623307534fa983c81d
59
2020-07-01 12:53:08
1
c55c3cca913f26cf88752038d6a1cb228175c946e943989935449dcd7cd42ca5
59
2020-06-29 07:57:28
1
683e51aad743535f510a8da081da1c02b83beb5a3ae2ab1f55154505d9303473
59
2020-06-25 08:07:31
1
f0b4ef6d7791f18766fa79ee6b282bb66cb142856a33d1ba3e904854dae4d058
61
2020-06-24 06:38:45
1
4912a7576ad6e8d8d04bad5b3f8fff20c3cd364bef4fc0e30b86317a81850a1b
61
2020-06-22 15:39:32
14
c85b18847da316f748a64d8646f53ca90969e6c6922110f16b896be5e2ce3b6a
61
2020-06-17 14:16:44
0
64587e9da70a7cab25e7580f2da4592afe647e0f8045894cdba4d41ed4e315a3
59
2020-06-17 12:55:25
2
a7112805f2db7b66e5a2d3fdd01687ae946f061b113f1e983dd8ce2bf78f8b57
60
2020-06-16 13:59:36
2
d981ef6fb99dc1fe6aabf2a2acc29b1ba21eb5a6be0d70ae6d3bc831d4a36531
61
2020-06-16 13:59:14
2
1b40aad4f377fa943876662d6d09ac35086381feb95c402d17732a26d6af7ea4
67
2020-06-15 11:18:51
27
3a8232f0e194f1a1a153e4450a36c3add61a36f2c99c79ba5344a11011041c09
59
2020-06-07 12:48:58
41
16d288174edd3442169ac716f6e110db2924a4543b70f74ce7fe69d5dcf20d7e
57
2020-06-01 11:12:27
17
77274f456eceef4446f4aaf6fb8bf5e1c5edb382921fd44ad3b13ae317b5dc16
60
2020-05-31 11:44:30
5
ffbd60f487c17e0409063ca9f236db7f904f0424deb8de6066d173feb278135c
60
2020-05-31 10:13:08
2
732f5866679f3fd378aa89a7f7ca581e2a66c26e12b08de44107df02a23fab42
60
2020-05-30 11:17:39
17
ae5f8a35b2e59e7b2554841108f82a78f8ff91e5557dd4e08d10ae97bcbd860c
60
2020-05-28 20:10:34
11
d2f5950de6e241078b77fa87069d0c70aaf07a4579dfd541be103b6b8292d707
72
2020-05-26 12:03:24
37
31fa19ca9b832dc349cd5f741632a783b3c032ec5358b0ead43c1aab01660d06
71
2020-05-26 11:52:55
36
a043b2623a18fc3e4ea52dcb38366a334f4767efbaf989ed8f64b45f808f4ce6
71
2020-05-26 01:07:18
35
d8e7aa06f3781c8ba5e1801311dd2dfd5186303725d06b56274d3075850bc44d
72
2020-05-26 00:56:03
37
d75a9dacb52ca2bd647c996bcbbcbeb1106f00f3e7b6ae97b39470967ffe6850
72
2020-05-26 00:54:20
36
82f91d4ab0f0e27bc6633deb128dc07d1f3205dc48a0777fb4f7faa0a8de3e35
72
2020-05-25 19:50:21
37
7f9fa75fae57d1df35a33db2729df5c2037c179f38ce0b09f27350c8108d9178
72
2020-05-25 19:46:07
37
25013db28dbd55a2bf243b5341ce9d0f683aee81d6ed2c7333a4867bc77ebb01
71
2020-05-25 19:32:25
35
84f93e1c2e1b71fa136a8e77f98227d668991073684d4f7bded90d052c96741a
72
2020-05-25 19:32:18
37
45755d86fe898400964043c6182e92fcc96863ab05ddba0f519972a3a2cec97b
70
2020-05-25 19:30:58
35
9e6a6671884ca3b23ba4639b64da8fca8ce83958f2f2985f35e6bd774c35bb4f
59
2020-05-25 07:41:23
2
eb3ef7b6652d0f53fdf2186d698c49ab655a1864c1852ace6cea30c3ac18c909
58
2020-05-24 01:13:30
12
fc7854cbd91acb8d97c0a4cb5d1c9e32ec38e9cdd0e30a12b7e963a69a08ecf8
70
2020-05-23 11:30:32
34
ef04c26f071eb7cb7294d782e4d5ad598258282a61c94be98a57466f0e0e0498
71
2020-05-23 11:30:11
35
8106e3fc8c9d5b6cb9646d80fe132d7c9d54b954480065a9d895a461becc23f4
71
2020-05-23 11:28:16
35
a260ec37c26730272714fdb7f8cd03e2235d3fa6713bf77cf9b545584e740d11
71
2020-05-22 23:32:57
35
ae6e6be622f1e731e9179efbb88bf227cd2c4c4e8b908d7b5363fb9604918be5
59
2020-05-21 19:15:07
10
520de9e26aa63756031385fe53304061a3fd6dbfc768afd552c67f55995c4208
60
2020-05-16 20:27:17
6
7a286ede49447e59093ef6b33a3d4abb29aaa1071534532926c411582d6cc2fc
59
2020-05-15 12:37:47
2
3cfbaa9721ad659b63a78c8a7eb464ccf699db5ea1997f6d6aedda57d05055cf
57
2020-05-14 09:56:26
2
a3c7e6f82cc2cffc327c601bc7959bb27c01a4a53ebf8b7452eed0754b23d0a6
60
2020-05-14 09:56:17
5
1f7e6b351f6ed60002c4e6e31e435ce11c639751a03a4f5cf3f9193db63de36b
60
2020-05-14 09:55:12
13
06e06f733b4bacb4951df9f593f7c69e6cc83fa40233547afe64f3a8f67770cc
59
2020-05-14 09:54:29
16
9e33d5d06b9113215d22e77a84f8b4e13a11e975fc203ad2aaf4d001c2a8cf92
58
2020-05-13 03:32:00
15
2cdba7fab6f6fcec2e4f10fc1a45c13a6a9d26cca2ea8b8b4e15989a198618ef
59
2020-05-11 18:49:21
24
c0d0ae398ed563e3f5278ae4bd4bc818e00ca3bce9ed07e6ec2161c26d0e7785
71
2020-05-11 13:33:45
24
eb1258ddeb2096099b820aa81d98f421b0d12ac22d5f8a5940755d21ca202c2f
71
2020-05-10 16:27:15
27
92e813995b8313f223549a944d648e9af71281e9b4f69fb0b3fb646e903adb9e
59
2020-05-09 12:32:35
0
a00c87d85c09ed224aff84aec68184042597c10ffe5cd75af8c12158dda08a47
61
2020-05-06 09:43:09
35
3f55563e65197fe8c49b6c1639cb48f678fc40408a0fb49db09e7f0153a5fe2a
68
2020-05-06 08:48:33
12
45a622b56f67267b5c553a1cb2c8d87d0fdb2bf8a712a0f26a7c4eb991277bff
72
2020-05-04 06:59:32
10
4009996802cdf55263f8add2a0b8616617876cd500d2be194bf6936cade0ec89
70
2020-05-04 06:59:04
4
d6b7f9ec933b015fa57d3812bb499180efd7180c1d116f40dc6d3ad94e6f84dd
71
2020-05-04 06:58:25
8
3655a8cf0a2e091d97945097847851b9f1a065f44d845d8735758323dce80d03
70
2020-05-04 06:57:05
7
446f96d2a78bb0fd7b3cce792f7ed062536d4029db7be89f97b8e8fb95ef5f81
59
2020-05-01 00:58:27
4
684aea5e26a11c99a3a9e6a05bf53d3700f9d30384b93bc5ef1f12d9e5ab608b
59
2020-04-27 20:27:08
5
1e17f1d4263bfed6668ed19c5f63b36220937fccf8fdd714e24aa186f61f02f8
59
2020-04-25 21:14:31
0
7ca6117896b4c84d49c7ee7c98e7a26171b312dd7ca8aa04b8c101e902dc921b
59
2020-04-12 19:34:51
1
3c7a3eb9334cbe501699fe2aa895c143d63dcc5cad6a2005b6102fa4506ed522
59
2020-04-06 14:15:02
4
49c30025adcb9228353349e4f12f3a0085e9fda619d57bd00f61ec09a09d8224
60
2020-04-02 17:52:20
2
89a3653c6c224cb1795a58b40804065c03ddc6645195a0b0ffb4c7b751c1c5a3
58
2020-04-02 16:30:23
5
550d25b8ce2bb0f4dd6e5ee35eaaca766b77c7ebe57ac5b7141e7b54f2838817
59
2020-04-02 16:01:38
6
4b4b317fa45fcbc5c37e7ae99888f0a7a7b0efa5bfe2774da5389c75ad42277a
59
2020-04-02 12:30:32
19
a36f91c5c36862957833812efd9bfd7ae9141128151361367f9800689b87516c
59
2020-03-29 16:16:34
3
10e780b36a1b87dff0082a6e9e311b90640d2bd838882388be3f552b60b6f044
57
2020-03-23 01:31:38
0
d0df583102433a3b4fbe4e4f4479f8899129b8df1e4b856d28ff472d72ed1360
60
2020-03-21 22:21:19
0
70ddfa0b51a2511155bf52ab5315950ec9f18cf702b53c767ec8c360476221ce
71
2020-03-20 21:42:05
58
9dd46913c2bae046af997c90c1b39775f66b14d35426429a514e596d11a5fcca
71
2020-03-18 09:00:53
8
b97cba43719d78a7ee90d9c0f67a7f4f87c39e7e10635891ca7d83d74b203871
60
2020-03-14 21:20:05
0
6364369abe6d34686d41062c1bd6fc04f84d705baf3299459b4de7d2b057c3f8
57
2020-03-07 12:17:19
0
f64e5ea7911074d894566d090a1f167d7c17408a2d084d723b6eba8d731b1479
59
2020-03-06 18:15:37
6
be300aad6a8c5926dbf678a31cd3fc115690057243af21b657c6e826424bc537
59
2020-03-06 18:14:38
6
28076e2fd682f8c18360a05a68441959f47190f0e2ec8e449b6224c8a3e1fc02
60
2020-03-06 13:27:50
21
e22641163098fc77d631676b1a55f8fdf56954587f459fb2a1e51cf0d282712b
60
2020-03-03 10:44:05
11
87d118b98995479d4d95ee7ed929e6ec61409b4a450b75c4788d0b1fc0ab8c37
60
2020-02-12 11:13:08
37
e64741d11d214627b210b81a010e344eee363254d018bcb412512e4240ffb645
57
2020-02-05 10:22:34
17
2c90193a9346559c18004f06d1e7fdbf0b40f59b6c365131566107a3a669c8e9
57
2020-02-05 09:15:07
14
d93a06bdcfd3c1006fe564422cf39e18a53e15f35db9e3003e673bcd7df10270
58
2020-01-18 17:17:06
2
cc880e3829bcaf1dbe3d99ab6ff3501cb3004fbccfc075a19dc4710ccfefb86d
57
2019-12-28 13:20:29
13
76a33e6348afc5019ae901d742740f458879fb16cdad77a0e5017ef007d47434
58
2019-12-28 13:19:02
13
33093dd5166956967c5d95f3200c35737e2386234200a54cf21d2249529af035
58
2019-12-28 13:17:48
5
b88b1ad7a3828cc8775b2dba12ef4ff927950edbe5878938ae71dabf9fe655d9
58
2019-12-28 12:45:19
2
19d937955bd0b8fb3fdd481ab72ea9a1e16f2944754dee77f4b262d93ff5395c
57
2019-12-28 12:45:11
2
5b5bdf8926a869f2e9621d933bee04aca0acbe7cad7294e0b2fb5df57fdbb618
58
2019-12-27 08:47:41
0
672ce16a13a02b57a85e19fa2eca3a441df0faa5636b4e028924367219cd77fe
56
2019-12-23 20:25:38
13
18756d442e3d8668fd83bbff40026ae3ae7cbb614991d77b95241b35d6c2681b
58
2019-12-23 20:24:41
16
a0106ebe97c14be56c98fa8b6f1b16495ebb50a99fa917c385f9a0ff401983f1
57
2019-12-23 20:22:07
16
3eeb576ec54c016386060637f1b6227858ed6934305b182d26d1027cac0d4803
58
2019-12-16 12:29:44
5
813595103c74b6936bf93e63e0225a2f6e85c22d932087eefdaa55feb36c04bb
59
2019-12-12 09:30:09
4
54e24a2b9f5f8021d78cfb0c479558ba317eb5ff2e9ded25316af87ad6ddc80a
58
2019-12-03 01:12:38
21
4290f0435cb0cfbdb556c4e9aa70fbc429ab5472c0f28a2ca090f9d374c36444
56
2019-11-25 08:50:40
0
52db3d523379b2f86bd365a5de9349f344f5c1934a8389378fca57446f82fad1
57
2019-11-22 08:25:39
4
4c07fe0b9fe66a264d233d6aaa1d38b1e8fa271660bf39c6807aa757f4e17799
56
2019-11-22 08:25:37
4
fd4a90e1e8f245b3e4805737936af464c4f6d966c65fbede77c2570711fd775e
55
2019-11-22 03:22:09
14
2af834524829888c5cfe57abb311aa406ff1e716733187ab8f443623e176dc09
59
2019-11-18 01:24:40
5
9080d18d45c6ac0f9eeffb549a77a9fbda6efc461030be2191bcf377defdf633
59
2019-11-17 05:25:04
22
d85e29a181e593f55dd949354f024ad1e5204643e0a8aa924fa52d5b9b6cf008
56
2019-11-17 04:59:09
7
61437cac1781de332c6f10ba7803c22ecfa02926ee580acad014022bc44bcf8f
57
2019-11-17 04:49:04
8
72d0eb7b9d353f92c486953222561e4808fd5511ffa963fae6c2aab661052471
59
2019-11-16 01:13:36
9
3c6755c1a72d9d9b0eb3163e3f4b001407a6f2da796f3284967071db5926751a
58
2019-11-16 01:12:35
0
c78347a4718aacf720f90d777b3ff1bcf955c5e05f14987f4aab7cebac1d1559
58
2019-11-15 03:59:36
1
022a7e25332faa7dd6382703bac7eb0cb976671fac7c2d1b6485c0f87ef253b0
57
2019-11-15 02:58:34
0
6227632e1c9790650a90f727004999a33724315efc303356c72a38fcd7fd352e
59
2019-11-15 01:21:07
18
32e21fdfc23b05ba3c5b44673cecb4f2acbf6728f1a4d0f21048d1f2f036c52c
56
2019-11-14 06:33:37
15
a62ee74e0a346ad701699f78398a57c03ce5cde6ac0760ef2ef5de2f5066a056
58
2019-11-14 05:27:36
0
6b0c2720f08e992f1b0a879132e4769d9568121cfad971f56265eaff508534c8
59
2019-11-13 18:26:19
0
948ce03f64da194bad9fafddbce1b45b4e25ba84906b7d250932d748a8bc3d39
59
2019-11-13 18:18:38
4

Rule Matches per Month (last 24 months)