SUSP_OBFUSC_BAT_Jan23_2

Rule Info

Name
SUSP_OBFUSC_BAT_Jan23_2
Minimum Yara
1.7
Date
2023-01-27
Description
Detects indicators of obfuscation using base64 in Windows batch files
Author
Florian Roth
Rule Hash
03c244f2d08ed86d00ac74618687ebf9
Tags
['FILE', 'T1132', 'OBFUS', 'SUSP', 'SCRIPT', 'T1027']
Score
65
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
75
Suspicious (< 10 engines)
51
Clean (0 engines)
19

Rule Matches

Hash
Timestamp
Total
Positives
VT
f04136d1618fe6dcb79ad02ef90515091cf09c888367673d50236867743db4d0
2023-06-07 02:13:59
59
0
65d00e6ea3afb5ddc4c0a4e3939d08749c13ba1ccf7ebf00cd9426e3f2f0cf34
2023-06-03 01:01:25
60
0
f3d06e5a5be458f4def4e18fcb6b357d67a0e1da57436054649d927a4fa41513
2023-06-02 02:11:21
59
1
75f360bdcb8ba80aa1ba1f84213cc66d1ada21fd93c1c14da07f552a6b5511f1
2023-05-31 04:03:48
59
5
ab839cbe651d61b1fb6671cf350cf8aaf3bbeab220ea7bc5dead99e34d9bfa43
2023-05-29 06:11:31
59
11
0763632e4d0b4d4ec3af31f5aa9f00d625343882eda9dde3977dd78700140b8d
2023-05-27 03:02:47
59
13
e9d6ee8937237acf860846ac6ba1e92193b829350459cffa1570f8405561c4e8
2023-05-27 03:02:00
59
13
17acdf8cc11232c911cfb670f002c60148498f8196fb6b30b54f8b636b977c1d
2023-05-26 19:07:45
58
10
e946227d29551cd43d163021c2ff15297946b4f076629a4d397984e94896cfd8
2023-05-26 17:05:58
55
12
65c53a0024088990004ea98272b0c325b119c1a3ce97f20727ae689ad4336b46
2023-05-23 01:16:21
59
0
79baecc0495d68f7e0ce8013235e71c5ced298d2170e71a765378004b3fbece3
2023-05-21 03:12:32
58
6
6569a68a0e3c266135456114126efdfac93e3b697f09c66186519bd18f54bdf6
2023-05-20 10:16:55
60
3
7f5f8cf831714eefffe9dded7fa0140b64d27777d3fac6e76503e5f4d8f06c4c
2023-05-18 23:16:45
59
12
3eb99ff875dd397b5beed12e3662984cc4afdea2ff6998155b9c74869050d93c
2023-05-18 20:14:05
59
0
ab194952a061b4ebd2e42a97195b1142fb8c592faba355c59ec5f7b1e50775aa
2023-05-17 13:10:13
59
4
f0925004bc94315f06e5caecbc00e26f9233be5026085311a47c676c03608aa4
2023-05-15 03:18:09
59
6
1ec6b55d93a19847ee5aabdbf732f485491e2e52941240ebd52fec45a63863b7
2023-05-14 15:09:25
59
2
f5a136608dc69f3763007ca10ca56fbfa702647867e6acfb571d74f77b6411df
2023-05-14 14:09:34
59
4
ba5ad641b80ef550bea9ee17c3df2003ddea825060054969053ddff96cdd2ab1
2023-05-14 00:07:27
59
4
1b6f3c0a93eef09fba017445f182afdb5af74ecb6f299ea3fbe94948cc480741
2023-05-13 17:11:14
59
4
1fcfaf5db89abe621ccc00ff295339ad2d7aa328e91d5d3d5bf2096866432d03
2023-05-11 18:07:02
58
4
6acd38fa5ecc92d88c41ca9e46d9b4e946742dd471a628193eb1a03107eb457a
2023-05-10 17:17:39
58
4
232404cf8837816c504532f7d4d0349ca20e91fd25c3d6fb0d1ee5821ea50028
2023-05-10 16:19:18
58
4
133c40089916252f6335ca770a08c770ed16d757b492092acd13a6c416877305
2023-05-09 20:09:47
58
4
2c307bf50af71ee3c217c4dbc11ad7979ce65c5c2808cc73103e7354cbebf037
2023-05-07 23:13:45
58
4
3ebcbdaa766b4ccd6c67e9c30d80ed0f5f65515abe4fb0a61ed9695e9c23029a
2023-05-07 02:06:36
58
5
dc9a1afa76cc6eaec8b357f9d591be886c09c2d582a35a91ef90884982b1f7fe
2023-05-06 01:07:12
58
5
216c555ea48c891d5176a383757cacca67700f8c52fb12c3fb516f60b44f75fe
2023-05-06 01:06:52
58
5
e04cfc5b9b1f19233ffcced235b4f3b9f23d53ecdcd174878c34b68501e8c37e
2023-05-02 17:12:38
58
12
50d63fb2ea799435781d161cf63bd89726e9574131155a157ab407778da37cf7
2023-05-01 23:19:10
58
4
54e28898b33fc5794243cd7b3c1812df30eb5b89037945cc0e6b7ae8570faea4
2023-05-01 16:18:11
58
2
893737a8566849dc0179f8f2ef9242143038f886bbb215fe123387d8adf20183
2023-04-11 21:07:52
64
21
e4ad5adb73c19873d554100a80282df665fe3b50b134f2ec5eff58d6a3f45fd4
2023-04-09 14:13:23
59
12
af77f23546731f55126fc98cb2e3fe4d829424a79e0fe65feb934b6b12a63fde
2023-04-07 13:11:12
59
12
b6c8d4806e4080ddee5a5b5ff6f3f12074fae9bd31464a147c7ac6851755ca4c
2023-04-04 18:58:44
61
9
e5f831e798b7eebb6b61813910b286e59aa30fe18464b0f1f08d4be2de9e2147
2023-04-04 14:41:24
59
11
bcaea8ac850864339cd5b31dcd8e37e1b5a52577924f244332786bdf3f7a43ce
2023-04-01 13:04:36
59
3
2810b0060fa7f2a125c713dcd8960db4b5626c962ad4f05dbd5e2d38206cb64e
2023-04-01 12:54:42
59
11
6766a676c8cb7f02a8b350517c94c0823c332be7034156167ceed474ce80cfa0
2023-04-01 10:59:40
59
11
b0da1288c592b5710ec6e33f0af7dd69f3264e98c7fcdc0089e9a26e1ebf607a
2023-03-31 14:13:52
59
25
036132bcdc00e75dd71b6cba78c976ec50a52fd1b891a4f873bde87269007e0d
2023-03-31 13:09:57
58
2
f5f714251a5fd7f58d14a8daf054382a4ebd1b4af2968f2648de664fac95c2f2
2023-03-27 05:11:07
59
12
02a245ddbc84382d78fa2e0db7bce345e65f94a186f0a8dd21267859ad9574ae
2023-03-27 03:30:58
58
3
f487f35f5e4e4fbc0386cf081aabd369a86e79ed04be349fddeae03b8af99c5d
2023-03-27 02:48:26
59
2
4e5a5105e11c4c17513f86e910d3f3f9f82d4ef483aa9b746452ad52d2b1f172
2023-03-26 17:28:51
58
12
24654e7e1fce50fd2c5181ca0ff9bff909427514a115bd9814a2cb0987733f6d
2023-03-26 17:12:00
59
11
f7346198475e6c0a3533a526acd389f3a85c3dea55ab187530b2546575a55c38
2023-03-26 17:03:23
58
11
84649d44b6634fee1a6129ecde322e8be7e38fcb070a6ca5846cf313b7e86510
2023-03-26 10:30:28
59
11
49b67f44c2bafff77c3216c47d1abdfc3e625588deb4fcf762f858c72949655f
2023-03-26 10:26:52
59
11
92d0a5e149244a70aea0bbcfc6324e932a058c6b64eb647efc787036a821f442
2023-03-26 06:49:45
59
1
5bf2b79c513d7478879e518471f902b93c442ebc4d4b2049fade29c1035b8ac5
2023-03-24 16:15:30
59
12
ade603eb0c7d2d79311d7319ed35ae2046c023d16b33bcab1bbad22bf1f6c6a3
2023-03-23 06:51:20
59
13
5455441cf085fe5e5c605e6870fadd4f47f215d4525e23f5b75eaabec8cf3705
2023-03-22 16:09:42
61
12
7b9d1052ea5ae0eefdd2772c345844fcef6616d8460c208474b6d654059a5211
2023-03-22 01:32:54
58
12
eeb6c1726c9ec20bc2c5e0b9038fed42d770572426389575d82a11530a0feac4
2023-03-21 02:29:22
59
0
fe3c2b0708ff5db5487342bead9eb7c0bc5d0359b6e7154efb325a80972d6f2c
2023-03-19 14:13:29
59
11
12582b160e541b8c0210bb54dd0a40bea2452c9a67bed39bf12578938119ebd9
2023-03-19 11:50:14
61
13
418a2deb5108c6c0afe125dcd3c478483f23f1823b1c8a0e0c7d550603f04b12
2023-03-19 05:29:10
58
12
2b14c2c4a6cc721810e12966f3eeff85a0b5c513a85a0c34517ac830a967824e
2023-03-18 18:03:01
59
11
18aa446441bd01856e00f5eae387a8694c77f61a7bc1754cfdb5a340fdfc3137
2023-03-18 08:47:24
59
11
95ade1dc5789949b74fb9054eae9ce7b8f3a4033ef6215abc03493aa09ab90af
2023-03-18 00:22:28
59
11
46b4613bfd44d3ede4ea6c51b082f9fa280c70eaeb0c5cd42562e1e19f26966e
2023-03-18 00:18:43
58
11
369523684813afe728b27336e228ef13223ffdc4b336d36c0c4da951d390b733
2023-03-17 23:33:49
59
11
e6d29368c2ec8a409aa6243b854c7f195bb5aee00085eee6070fe398f00dabdc
2023-03-17 21:35:04
58
2
9feaa34335d9583eb59294672692913aed28d91cf173279e7ff332a664ffcedd
2023-03-17 21:09:19
59
11
ec9c94d5c7ebf09eb2d5deb15ce7937c8cc24ff79e2112a82e4ebd083a3b4c3d
2023-03-17 21:08:56
58
0
ab74489926bd7d123ad5b0a57801100c4cbc6973bd25aea0afd9b8b611c65d5b
2023-03-17 18:59:45
59
9
9bd46a9bab79b61aa3770c3694d4f062d8036930bf88e26786335b0f11212a30
2023-03-17 14:11:13
58
11
0f5236778a53b9d5dade246094a13599dd8b2e3c4bedd1dfddbea80fa219ae11
2023-03-15 21:29:06
59
12
72e8cb4e1819443e75270e65d048bf233894497e3f3945cc8dbbee4be09ad4a3
2023-03-15 19:51:05
59
10
50503fa54079011583f46dfd196b80550004880b314ec2f3297084865bb8d433
2023-03-15 08:20:35
68
23
db29e92e82f7f53803e54ff828b3485bf500941dcd6d418ef9f807151d0bd08f
2023-03-14 19:26:45
34
4
b33b627f62c97523bb53b2f369f9977a5480b611d2345b684d50fd719e420a05
2023-03-14 19:25:22
58
11
ff5db29299f59ecc68b8b0069ef30105808a660361dc44430fd2b8ed9a768e46
2023-03-14 14:27:23
59
2
e3e81ae91a17b5affd0d30265a1e5e5a68a5be9e59f173d821595829d07e0e8a
2023-03-14 08:10:41
59
2
1cbab58e69089b40b0eca4aafa33bfb734707885c9d482f58da7fd2f22fa3f07
2023-03-14 05:28:37
59
2
8cfdc3992c325b03ea97ae09d7118436cfbe7de119fed33505a653d01bbaf465
2023-03-14 04:11:13
58
11
7e09174d46ab5ce8298359c267983b709a0a3cc291c7d878196be7d514e46c80
2023-03-14 03:50:33
59
17
378eea991cec20b879983f25c03c72d9c6492759ff0306267bb0af1934cecb5b
2023-03-13 17:28:04
59
2
613bb088d6d7e0cfb3acf1037adab8eb36ddd2203c3646388a9cfaa7585e2b38
2023-03-13 16:41:12
59
0
56b44000a7d11a9c3b867497d115af2bd33ee02ea2ca0c23bb02dd786bbb3405
2023-03-13 13:52:26
69
40
750361b6a8dc33a0c841ec6936b170a33a9c9f022e67994faeab81fc558f41f2
2023-03-13 09:37:03
59
11
0b45f72e506d9622812a00ee3b37f5a134aed70dc0217cc8c6e341e506ad4fc8
2023-03-13 08:22:09
59
13
024121ce693560695ffbb31714145647039dd0a33c7a637614ee3d408dd88c9b
2023-03-12 18:04:36
59
2
1b5adb76eea2151c7e72872035ed2b5cfce71f8f3c3d71a6daf2d8854d5f8bcb
2023-03-12 17:15:38
59
0
425d89ea6e49ac97d3d29ff3c6f4f49c0f48219085016809a6499c1199ad2b9a
2023-03-12 05:07:18
58
11
0dd08dafce13a8c54c350d4d664087f3d3e888db504863a4f7f9a7089436325a
2023-03-11 22:12:06
59
11
e48ca04a85d6f93e3a5442f27477f3bc2dd2346ce24c0a698a1a8d251ffeb574
2023-03-11 21:14:37
59
11
4dce781faa521c7f98f5fd7d56aef5dbcf1f3f6798872fbf709fb57ea247191a
2023-03-11 17:14:23
59
11
a7fad8dfa270249bf653ddb320bf073ab2fd22f3fafa5dec825fa02c33c4bf51
2023-03-11 09:07:47
59
11
9a02c65573795746d9b074ac8e372bfa75ea56392d8569e4f9f4307c56013067
2023-03-11 03:15:57
59
12
79e27fae21bb0fefe58ed0d4223a82ecd6e0ea7994b0cb55861d7a7c5df3f60b
2023-03-10 23:37:07
59
11
dab5860a8ab69cd0b04d8368a9589ddc72b55bfb81ec26c8a40051af25dda144
2023-03-10 22:14:13
58
0
88d3af8a644e767e3635357e9ac87e64ab0e8e07bde797f42c594108972606a7
2023-03-10 17:22:36
58
11
231208df8cef5f55ff6e4c7488586b690da8451f5c3df21eaac6723297ebf6d7
2023-03-10 16:04:01
58
11
c548911d22ae03e3ece47d756ad96fc518c93e4eb420391f4a8ebbdf7f3677d4
2023-03-10 14:45:28
56
11
4056758578ac2b67273e99b6617a24a8a2129481b5189f314e12f75d58bfc474
2023-03-10 08:09:14
59
11
4551e69e6f5cbcf2d9431507b6023079068b0dfb778ecbc7f289bc3bb8326bef
2023-03-09 23:20:35
59
11
90db825e6cc8fbf5d3e0952bd5954ee943795a43ebb098cdc3b40ff09f99237c
2023-03-09 22:17:13
59
2
9fa26f0402be05fa9bff44f6bf8b00f9bc2f6483f5e16b30f39d6d01a598ef63
2023-03-09 22:16:52
59
3
5e45cbde37511cd66b1bf64c9df347444e05474fc28234fa2a5ebe096371839c
2023-03-09 20:06:02
59
2
f6284386090efa0600b5e8ed7be8bfa53607d46dce2ff6372d53edd5ef1050ac
2023-03-09 19:38:09
45
8
9e2dbe33e3fdff7d2e0dc9809c78400b49d7ff3cfa781b075f6bd3576c033e33
2023-03-09 11:03:47
57
11
94dcc50b144c1b8b71d23ccdc62512e948fcf01b22f3d7851fef175fc491ba20
2023-03-08 21:15:06
59
18
51a95764cc508f171f68725f335d044ba52a2bb5ef5bc43dda989231b3030cdf
2023-03-06 11:48:24
59
10
18d16e41290c1643dcf632e62e9e1e5d57976fbd686161df0e2025bfed14e1c1
2023-03-06 09:30:13
58
0
633441f6babc316b8108cbdde9e09a2ca7649665e648b27015439c43339231b7
2023-03-03 21:38:40
61
2
964d8889e66203cad7781dad21287b6b836673b32d44ec55313fe118437c4fbf
2023-03-03 15:34:17
55
0
f6a31c5a33d8b8dd38f39e31f27a32616cef12340c5a1b5914f8105abd22a710
2023-03-03 00:43:22
58
2
d6295766e493216e0e6cdc3daf8213b7e72f0df9a4b17a43ec86d508f2a496eb
2023-03-01 19:35:14
59
11
2a5746911e8ca62a26f1bc1bdcee0efcc121bd875ac437165f8edb7792c1d5ab
2023-02-28 18:52:58
59
19
ef52c490239ed81405f8e4cd5246129bb32b7877d8a319fb282280f416fe0716
2023-02-27 17:51:24
57
0
c1ecc2f1b486273e309604619d08e4a9903c662419b45f489a6ea8e7e228496d
2023-02-26 04:02:34
70
37
e6e95b1a0bc48f148fd8a5961d133bf7808d03e124f89145384b8f528f73af8b
2023-02-22 20:03:12
59
11
68c74f07bb9656edbec93abe733e495e7c65432b21364e5366526a205745469c
2023-02-22 18:48:45
59
11
1c5e45d34bae7671335fa9aaac0434b9d7a08fca5f517d646367e4de392dcbb1
2023-02-22 16:53:52
59
2
d4fd690406e3c76ce8311540c31356f5db1d800f07d00d820939e7fb86ea86c0
2023-02-22 16:43:13
59
1
980ddba86f8ce3bb5444cd0e3a1d31ab5ae32af939c443277887bdf0c9678a73
2023-02-22 16:26:41
59
1
573625e042c86c4d53b3804727ac815008df4542daec62c359443ed7f4cbf80a
2023-02-22 15:38:59
61
0
b427efb5d25badef875202044690356c20fd36cfad6d1a4aee03caa7c4f6422d
2023-02-21 22:29:55
59
0
8f80953ee1db02844ac97806deb6b3775a4091d3595572d74a408d463df26e71
2023-02-21 10:45:08
59
13
0931a5251e968a1784d646960069618a23e120e55f1830f331187eb518171666
2023-02-20 20:31:06
60
1
9846d50fe58f6b641498319e2abfd00be4ea62a63c73e2f42c80ed1b6a2cc529
2023-02-20 18:43:56
60
11
34631f313b0a64f531a398394e4a823afefa817ed2cd85e5ee582a0264d8291d
2023-02-20 12:07:27
60
0
5fe1f49c7c72bc70e2e3cc363f7dd40258da3cbf29b1c326bcff829f1aae8c87
2023-02-20 11:59:42
60
1
6cbbbaff0ec8f52c72914f9789bc2e86eb3b36eed1d58bdd23f3ee11eb72b82a
2023-02-20 10:51:04
60
1
bda3c8dc1c3bcacac33575ad768508ba538c35652dce4d76d43baec4ca0a0a17
2023-02-18 12:50:50
60
11
04a34c8ec4a6bd9db6f5de4a9a4ac31175b2922023352befd0eb6b486be4860c
2023-02-16 18:25:58
55
0
04ce543c01a4bace549f6be2d77eb62567c7b65edbbaebc0d00d760425dcd578
2023-02-16 18:24:25
60
25
b12ce995e5f3bd33f290be5ccd80ba847fcbde0d41ea53b8cb9f7f7cb25ab98d
2023-02-14 19:51:41
60
25
e32ac025cde27db20a3b67f18287fc8f9360cfbf6cd4bde8ccaf46ef44bb7560
2023-02-14 19:50:38
60
0
28ebfe86217ed36ead5b429cadcd005338a0ae6207119729b53698b5e4a3ef3f
2023-02-13 17:44:27
71
48
4d0a3f5811349ea0ae8655b52f9763ca343cb45931445e7fcbcda281d88a27d0
2023-02-12 14:18:02
54
17
30fde5ac8a0d9ae8892726c44cec9ae1b5461b5693674c51e0639b73c9840b25
2023-02-10 13:16:48
60
6
3b76cb3ab031658b762892f0d4145498eee84da51d451c67c1ca642afd79add1
2023-02-05 10:12:40
59
14
734d2037eb0e4d5cf4cc83f4edc040f75b7fed76220e599c698a60ff3810c212
2023-02-04 21:35:50
60
4
22e393e798c263387cf45e09c8ba0345b892d16bdd35e386ca1bd83c945e501e
2023-02-04 11:58:20
60
2
14b51a51022dcd676a79477d12a28628749e0043da2bb79afb77bb734c01135a
2023-02-04 03:57:48
60
19
f81c0911f79a391514fef9443e36405f01e9615ff9d983a321dab806a0faa525
2023-02-02 23:04:48
68
38
b8ea5812679c883c229cbfe9f3ec53b2b9179576ab979a9f2916ca30b6e06835
2023-02-02 06:36:40
60
0
929de4bcb1676227ec16be7f1b68043c69f3c15b4464593967bece79471cd47f
2023-01-31 17:12:22
60
5
48fcfca866acd6c65cc8479f1879bbd6b1f92f8ae5ff8d36fad5b77d22ba4b62
2023-01-31 15:55:20
60
1
a6d55cfd24e9881cab45bfc728d4ce6170ded62236fcf35448f42ce77a6e334f
2023-01-31 11:56:14
60
18
db371d7f8c4a094062fbf4a9b34dab690af4f21dc8a2405e53c7abc5e401badf
2023-01-29 05:59:24
60
12
b728c3ea0f27d29b739864ec87fe74c4a619fc504fc18d180c4c1f35855c30d5
2023-01-29 00:06:50
60
0

Rule Matches per Month (last 24 months)