SUSP_Kernel_Module_Jan26

Rule Info

Name
SUSP_Kernel_Module_Jan26
Author
Pezier Pierre-Henri
Description
Detects suspicious Linux kernel modules that may exhibit rootkit-like behavior.
Score
70
Reference
Internal Research
Date
2026-01-21
Minimum Yara
3.5.0
Rule Hash
db519f24b5ed98d80d1c771cdd464360
Tags
['FILE', 'T1014', 'SUSP', 'LINUX']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
20
Suspicious (< 10 engines)
31
Clean (0 engines)
4

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-10-18 00:59:56
2
65
926f49e6b6b8f3cc03907d1fc12f34b88a91e0bd01edb987053340b979f0946c
2026-10-18 00:59:56
0
65
85d4eca9773229db3e689b1d4d51cde6ff838dee31b48c02890cc7deb17411d5
2026-10-18 00:59:26
2
65
3b9dbeea51cefcfd30f0bd12e68c99cf5e1c94b5db1042d1a146bd63edd06d04
2026-10-18 00:59:26
2
65
0c3a2bf6ff3b779f2cf548bc8ec4361a67e9793aa932dcadc5e3a7f820105491
2026-10-18 00:58:46
4
65
8e0f50afd110ea302c26866f1b2e264db57628e9b872962beb522b6e115f7c2b
2026-10-18 00:55:55
5
56
a572bdc274428f6489f1b0639f2fd09fb01d07a61f6e55f5cfa36fe1961be672
2026-10-18 00:55:55
2
64
19ecc86bd5e66303a6194e277575fe568e8e2741ee14cab2a0ec4347f19568d9
2026-10-18 00:55:55
2
64
8cd00c0fa1061c53b25a4168524873cc277f3842a1e1e8c9f4d804f249e4e130
2026-10-18 00:55:46
3
64
a3d07d5d5e8c75a694183b544ec5a36904e9d6d48c3004adabe35b08c2371bb8
2026-10-18 00:55:16
4
65
f96c9c042606faadc79779d6c681f7d905911cb179fb2d431edde445e6242433
2026-10-18 00:55:15
2
64
285a424f8b7c17df6deee09380b7136b0841787c3b51087165e1ce031cabef88
2026-10-18 00:55:07
5
64
74b32333b0018b8302f330dd0cd4606efbb2b174598fb7e9bd8df64a5b8adbae
2026-10-18 00:55:07
4
64
5b7b3b913523c987435ffb1764d11aef9fbf2cf568daf065d6ca12c434cc6cc8
2026-10-18 00:55:07
3
64
da63ebc06cb1904d323361e8c2e18bf29b1fd32d29910bec6a4a8a74f8c3c1f8
2026-10-18 00:55:07
3
56
c6c30b73013a755bd17970eb71604c8031ed3eaac5bb53e00bc5a1f101f285b9
2026-10-18 00:55:07
2
56
a4d0389fc3c54ac56ea838f4a84e0cf9d999b702ff65bb26fd85a6f4ee0afea7
2026-10-16 21:10:20
2
65
08f8baa341d83e8f21e99b5ccffac8424296a0881166e7e5bde6208b64fff4cb
2026-10-16 21:08:44
2
65
317961c5a931f95d343d76898a161396baddb7ef1c5d8984d968c8e858d9ccfa
2026-09-29 06:39:47
9
64
c693f3d9de5911852f788d240a9def44144ac56ec1f96d01668da24c316bdd5b
2026-09-23 13:05:57
0
64
5c20299ffdb9f8107ea509fde065befd2c72fa2827ef6ca378cb24046fd274fd
2026-09-03 00:27:00
2
55
2e0c42d1f1064ac095141d1a246b59a59480f81472eb4a1951de4ad57eeeb285
2026-08-19 03:56:18
11
50
b096ff6563bee7ebb0c1bea4640f499bd682434901fd7de568625d578332aab9
2026-08-18 06:19:18
9
54
18603d7cdf0de7d9cd50bfd7a54bae3ddb355d4449e34ee72ed2bd7a891be2d3
2026-08-12 07:21:26
4
64
f2325b1aecf7885bef0f4686ab3d18f6672bc71eef4b2c347894b14c442f6dd6
2026-08-08 19:09:19
11
64
02eaa055e5ce9297a0229ecbdd65b0b712c0d7f07931669184694fa1318caa8e
2026-08-07 05:23:46
1
65
f7e86f7da3145d16b71ef24c768d230c8db8043eca54507b0ea6d198c5d8b95a
2026-08-06 07:37:36
2
60
1e1c59793fb6f309686e3035705e88e3b9b848967afb2b6b90d6fc0b44b2dde6
2026-08-05 22:33:09
8
65
8c42fff8aac3dcf884c2fd287fb7692286d7e150831cefb825b8c500549f9828
2026-07-24 16:16:47
11
63
be219c37d6d0e430ff6178f1d49e7a1760d9863feb5887ff398877b15b2322fa
2026-07-21 17:12:16
31
64
1368f3a8a8254feea14af7dc928af6847cab8fcceec4f21e0166843a75e81964
2026-06-18 09:52:17
0
64
7fb066154559aabd8729a5caa3918fca10f92415f95650f0e9291c7ee5a7bd60
2026-05-28 10:34:00
25
65
fe3a94f91ace1f62bab926de4562f87ca83dccb3a655e0c8dbb3f31939f49177
2026-05-28 10:22:20
23
65
b2d8019bc18ce3809ec73c5cb2ac62b3d65fe6d5f21bcb56997a63a1078c403a
2026-05-21 23:23:04
9
49
60fe9cb8f7846978bd333fdca217eb80c364de79364c312301b4573603b9c798
2026-05-07 13:15:54
27
64
abc9f0e697d96c895517bc3268845efb2d4c48e6c2e093d89e9e006f7ed53081
2026-05-07 13:14:24
29
64
a6ad7bd32042ea7b3e937f414d115c11d0d12135da981c2e1da8ba9365b33a37
2026-05-07 11:16:17
10
65
9cb55ac67f2283be81323f788f079171bd8700f1dbf0facd18691665b7f4d88a
2026-04-27 06:46:34
27
65
6f1f0e13d93581d5a5b8bbb9ecfea0dad7c93aa0f3f01aadf16a9736d17d63ea
2026-04-13 20:13:55
3
66
1f3172450ed317d4db9394bd62779469e1f746bacb31e8f143a5e1a1d2ea9e86
2026-04-05 21:21:26
22
66
b3a1ae4907ea77e43802bce098a7c7124e119e3e9ef5babfe2d40e044504db1e
2026-04-03 04:46:45
4
64
b88e1a11d8e1db76ac5c371955a720f83a722f3347b5f4279ef102c2152d5154
2026-03-23 23:33:54
35
66
d5b2202b7308b25bda8e106552dafb8b6e739ca62287ee33ec77abe4016e698b
2026-03-22 06:12:05
6
55
67979218f8b31550a81d2f2cb962c5c368bfadd475616d341df9b77f6563102d
2026-03-15 12:56:26
27
64
5e76eba112dc74d12865f1a07a4ec096281c6e3572e40660a92c5053e6e45d5b
2026-03-14 07:24:46
37
65
0a54fe932ebc3e4fd5aeaf094ac163c9e92d1efa7ab66af3d1cbd2cb9ee4c294
2026-03-10 16:05:06
5
65
30803dba32b4e276d7cf2896419060b18267f3789528b684de3e1a3cfb8f9739
2026-03-10 09:14:17
27
66
0b8ecdaccf492000f3143fa209481eb9db8c0a29da2b79ff5b7f6e84bb3ac7c8
2026-03-04 07:31:06
24
66
78687dae530bea2d2757af0932e3b81720c9f9f1ab7c5d664042beb875cac431
2026-02-23 13:41:18
24
64
65c8b4bc436625258f6c9ef4860f0fdd1f627b2782919a37c20b7ce795258f3d
2026-02-17 13:15:51
26
60
cd6ef163dd67482f8021ed21bc27ea99f6fd89e3d220c30e1c12e86d32d80df1
2026-02-12 23:18:05
17
66
4822eacc6f784b3373aa7f0d8a040469cd05413c1114cd62036e9590092e5f9d
2026-02-11 10:02:45
0
66
632972b2a81edc98ee37781050322630c60af0b57e8da5acc0936f0d200bcee8
2026-02-04 06:50:04
7
66
4c413da6cf775d9c4666d0ef0898985f5b0d693664183bced3bc6a8635983cc5
2026-01-29 22:01:59
31
66
fe5ee63fe86f8d09918b0147bb438f181cc39519dc2ccfeceae84a557b6c75ce
2026-01-28 01:04:35
9
59
4088960e6f96662733a7b5fb257b4ee84023dec612ed5808bd97da792ab80cde

Rule Matches per Month (last 24 months)