SUSP_OBFUSC_Reversed_Encoded_PowerShell_Code_Mar22

Rule Info

Description
Detects suspicious reversed and encoded PowerShell keywords often found in obfuscated samples
Reference
Internal Research
Tags
['SCRIPT', 'T1027', 'SUSP', 'T1086', 'OBFUS', 'T1059_001']
Date
2022-03-08
Required Modules
[]
Rule Hash
c7d5e1a6e0bbca7c9973303e840cf772
Score
75
Av Ratio
6.15
Name
SUSP_OBFUSC_Reversed_Encoded_PowerShell_Code_Mar22
Author
Florian Roth
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
7
Suspicious (< 10 engines)
54
Clean (0 engines)
43

Rule Matches

Total
Timestamp
Hash
Positives
VT
57
2022-05-25 23:27:52
f424bcc4fac46f7d2708c23b3949a5cdb8b4949678fbb35e501a7bfa50d94c6f
4
58
2022-05-25 16:01:57
6eff1fdfc09cb365ebebaa6dec7bf8c615c5548962b9792b3a55681a656f5acc
6
58
2022-05-25 14:07:13
218390bdb9a8697a8505b6282ef5c8ee561fb8503b642829b2a23f091dc6932f
5
58
2022-05-23 03:19:27
e52769f5ea0311bf987969b9510c22609516fa8c458c2a832507837f15f15db7
5
57
2022-05-23 03:18:24
db4484a7d4c920f84f7ca1630b00aa23c0d5f3b65cada3e91168a0a459484bcf
6
57
2022-05-23 01:28:43
72814f8fd0c91d5d2f23f9bc61352ebe7db07da40b74df180fdbe7eea581f03c
16
57
2022-05-22 07:57:11
f5a2de67bfbbb8727fa81c4c69b33b2c561c96b4676da91716b028f736482fb5
4
58
2022-05-20 13:06:37
1b7bcc08e52b9247c5e5f6eee3adbe2930a5eaff648c32df683abf480358f7d1
5
58
2022-05-20 13:04:24
74311d350c7ddebf446135b7c353df677f29ba535ec79aeb494596c388cee698
5
59
2022-05-19 00:31:57
19a9fe18eb69879ec3ad78e4e71e71be6637ba1cd60ffc4f8e0a2ebeed2fb855
5
58
2022-05-17 09:30:00
4d528df8e264b8d3c8c6a14a3ef5d4199e27eced987ced7b3883506783bcea6a
0
58
2022-05-16 13:27:36
3b24290e25bf085dabb269a83c62b1a03ee56db48d559a201f3035fe8ed4ceb4
5
59
2022-05-13 23:34:16
dc6e14b0d9eb80db51e54c226f809a1765f4d79533b5fe6a28f00baf2ff2c815
5
59
2022-05-13 23:34:06
c8beb330b9bcf5c9f19c7ddad01709550eb094856514c7bf5369bbe8d232dd52
4
59
2022-05-13 23:04:14
f0cce9d4fc5d952503ce8218a173727be4949818020368794a0be7dabafdb9e8
5
59
2022-05-13 22:54:45
0faff89fb811683d5ed96428b05bb57fb52b94a38ce4bfe2ef738f95c9e39212
4
58
2022-05-13 20:17:50
bd4343d5af351d06e690a1aaec314ad9b0b16837bd5190cc88b1281a06c7ea82
3
59
2022-05-12 23:35:46
f81aeb96848254042090ff74a0c9e20c43e22e1fb3be2f12529e74556f0e186a
5
59
2022-05-12 23:34:33
c4c3aceaad2227610235cb6107340c7ab78de785d74fb651792fac43d53b5707
5
57
2022-05-12 23:31:53
bd1c483586f772dcf12e685fcbccf1ff68c5de5df94981439ea4230f1ccf1af5
0
59
2022-05-12 23:29:39
43f70908d143b76ae754993a9692767992bda1b7f9dc5eee6a76db5cbcaf8e51
5
59
2022-05-12 23:10:09
1389b60035d88a62c4e3e76e025458965402eb9ea1d9d855993e58923bebef13
5
59
2022-05-12 23:07:49
d5e6f5d475c0651e7f7b93f9e61216f8d148157f804f3cd36c73c210e9f301eb
5
58
2022-05-12 22:48:44
4251534b134756419a4bcbda29a14372cc18cdb1daec68b7979c40f2182065b9
5
59
2022-05-12 22:47:37
ea6b0e80400c81a1a2888e42ac48844020a56672ed60dc4fb1661d463887e0db
4
59
2022-05-12 21:15:27
c2cfbece6c8e291e8febc082c64807e741dbfbbfb67bceae0c1893ad2470d3bd
4
59
2022-05-12 21:05:13
9fe21b32172c52e9755e97ca2086b467eabd1268807a65c262c957e68a3852e2
5
57
2022-05-12 15:33:54
d2fe81764cbaf5bc9695d5c2865296743ae6fb7e8c8fc2b2dd69d7d4a71f5ab5
6
58
2022-05-12 15:08:49
c57307b496a9a1f57287dc4c876dfc520e24f169bab20f9eef0c9b57ff5ec8fc
6
58
2022-05-12 14:46:11
60aa31febfef17a06d01ca939b348141be7e4f93eaae6b847f5a4d58772bee76
6
58
2022-05-12 09:55:20
c1138e24145d1741bd6b45df6a258e895c8857f7d9e587bce54ba3b243c75f71
0
58
2022-05-12 09:52:01
9fbebfe03255f92d91d8c237496dcd4531a01611be8aae9ba3e9166abea4c7ee
5
57
2022-05-10 23:04:11
d00edf5b9a9a23d3f891afd51260b3356214655a73e1a361701cda161798ea0b
3
57
2022-05-08 21:30:45
c7935f7325f3a955bf2268b9f2ce8800eae5fc7a39eab1f5db448ff3be41a895
4
57
2022-05-05 22:56:25
7c6bc76d904289a905908acdf88e81363d33482fdf91c4a02c3312acd7f8f166
3
58
2022-05-05 21:17:56
b8610ea68ef791721c8a3988f24f597c51c2e62beff1f230dcbeaebac3ce7e65
5
59
2022-05-05 16:20:21
d262ae1804f3306e50fc341b2757c262c4f6e8a783db5bf4f43095fb3ea85558
6
58
2022-05-05 16:14:47
f1e2ffac00724ec1c17e36023a210355bb9faec2e7c956062d8a190afe7a2120
5
58
2022-05-05 15:52:11
063b7ed30165bf79f9d90370b8ada11c145c7c780626c688d7dc1adbd68ce351
5
58
2022-05-05 15:49:58
831d9eb1bc3d9b1b7f53c23de1afc6f18cc7b16996e6d22947c4632cdf15e904
6
59
2022-05-05 15:48:50
9883a3639d7f1b654eca6e1ed574bcfa629a106d951fec0d7d1c54bc97f76065
5
59
2022-05-01 17:09:06
fa536851cd57b7a97c280d2e6850c9dee8dcc0b3bf5a71797bea1f58b52bbab0
6
59
2022-04-28 17:31:34
3b4732544efff510eda796639b144abbf1f052217206ded700a1b109bc724eb0
6
58
2022-04-28 12:58:01
e4d0c56cae8d20f03492d3155075aeca2fa2cd5709f8b9aa2e1b7139542c7f2f
0
68
2022-04-26 08:02:23
5bf3d8ee6bda750b33cc6903ba20fd73a05253089926d41068aa96797363341a
17
59
2022-04-20 17:17:43
8c1f7a25de244ead5ec27c59af78b74e350f2dcbbcd9c4b1e2e8bbc22f4725a3
3
57
2022-04-18 16:40:24
e4a8e842379c5c172ce6fc2bc15ab2616852a5a61cad634343b874d05a42980c
1
58
2022-04-17 19:40:59
3375ff461bf38c1712b9bbbe3dbd178455bc578e9a821177a32c9016e98a9b56
2
58
2022-04-16 16:12:46
a424940a30efe93ce017d939706218e5b0d8a765e759ae1d0b3b9864e5e80cef
0
59
2022-04-13 17:21:35
fad72fe57b966d36ac00d8dac9c277eeddc568ae57938ebf0e1e7d2bbf95317f
2
58
2022-04-12 12:06:48
a2b15ca0ede81ba5570d6b287669e8062531f22e05cab0f39b2a896bc2e45de2
0
59
2022-04-11 14:48:46
f56d132116f52b4fe429036c3dd35b31a2265b8f47bd22c891173cca6dd03d6f
2
59
2022-04-11 14:22:58
850e64a4effe0412da729767b6efafa6193545adad127bdae0cd42398c0bfe70
2
57
2022-04-11 10:21:54
87a7f277ce3f09a6b68ff75a1aca42450b80e8e6a967d961e9b3d4f0dc2a8e18
0
57
2022-04-11 10:16:39
d2efddbc44335d2654a21805cf413c54d5ab37adc0e048c25d6feaef6fc5d5af
0
57
2022-04-11 10:15:24
dfe6eb83c83788ebe87677f2848b41caf2fa2200460222e5ef4c8bc683ebf1db
0
58
2022-04-07 12:11:16
2f5e794cb49fa02156423009cd2334771608d988a06dae57d3d0a910159aafab
2
57
2022-04-07 02:33:15
c95074fcddb11180762a240c491981e28a5830ae97ac6ff6cc5ab2d4c768842b
2
57
2022-04-06 16:20:39
f420e8744c24f6d9c7e8bb7ee278ef7d5a1d9f00677cf8678735dec481ed48f7
2
55
2022-04-04 20:29:18
eddbf00c6e3c87deec0bfa83b994cc61bab07d3b54ebcc2d64991d19846f1a67
0
58
2022-04-04 13:17:05
6ff8cdbefada360a874205d2d59219b1ba9806de620cdab6f43e540de08a54b0
2
58
2022-04-04 13:15:55
3774291d6330de7baf3e69f5168c77c881ae6e94e972c865b9bdfb0e32bade65
2
58
2022-04-04 13:13:23
3ff2d2afba8c42ccc1c476708510513882d18950519b60b3e26120ee534f43dc
2
57
2022-04-03 16:32:00
49277a8e806ae640b2f971da0d080be363f9f65b3311601fe47d1912659ab123
2
58
2022-04-03 14:35:35
05af23c1487a2d85a4dadcf17fba953cf077333409f74b12d945b57532ca99c0
2
56
2022-04-03 09:54:41
4666a3bb46b68e7fd8b0a3dfcffed48ebf11fe960fda43dd355dd90cc7c3da68
0
57
2022-04-02 10:08:09
303187146625a4059d4f4ee0e63fe84f24591fd295914fcfce15582471bd7c0e
0
68
2022-04-02 00:08:25
d564312baf4cd81abca477f3315f7ec46873972110f4661ad3cd94538d7b4477
24
38
2022-04-01 09:54:22
7c852a6dcadb9550d394aa699aeaa4fbce9fbd29ce71378e6781df39ce03f2b0
0
57
2022-03-31 06:08:32
797b04c876c590fb5fdefb3cd92f586150e37650a50742e5c2a6105b3623c69f
0
57
2022-03-30 07:36:29
bbf3497f28e53da5dc7d7f9a44c32c32f951b19e4c1d4741ef8997cef2089993
0
57
2022-03-30 05:29:43
bdd3df1265a6999c9d8ad39939291f1a2c4916e9c2797ae7836c61784bf3c292
0
56
2022-03-29 23:54:40
00245bb714da0719194ab642ecb143469bbb808bd8cb7315973f7a5a2dbc805f
0
57
2022-03-29 19:55:08
ed5d6cc72569901193478a43dacc589b51546f2b15b186652b9c1760aed9e0b9
0
56
2022-03-29 19:50:12
9bee7ac1da34d60e3a0ebaf533dd3c19e97d37577a61e70ae609fb3b90274b55
0
57
2022-03-29 12:19:12
ab538ac7a8d3a077633f6f0c5e4bf3d91bf11014ff1cc034b2c944cc27a20e39
0
57
2022-03-29 12:12:37
f40238a772a4053db64a7c5c83a218f2f9b621fde428d2738f40906f9ebaab48
0
57
2022-03-29 06:45:00
361b2ed04ac6162730633b70f734258b60d4952d1ed72dbdcaff59dba1534bcc
0
57
2022-03-29 05:55:18
811c45c9c641c7db4b043a7e4032e534ac07133c9ff342898fe509de111b6734
0
57
2022-03-29 05:36:15
e397be04dab46422f01c11f05367eeaa98f7d7679dd6ff464e30efa8dae6b11f
0
56
2022-03-29 04:44:10
701a86cf2cbcf6a250ca1f950077ebc99d94a0be314b717182390899cbf3d561
0
57
2022-03-29 04:43:01
c34ca7aeed755a259a618341b9755296a28d75c041a8be21e9506d4418fa2060
15
54
2022-03-28 22:49:45
3b9d8ed6bfe2f61321a367b4f9ecbffcfcf4ecf455ceb2856ac69ad30cc4a2b8
0
57
2022-03-28 20:52:19
910e59418916ed6535530628e500b1eaa17e3cd8eefcc857ec6e233ea95b0d18
0
55
2022-03-28 13:34:39
cf5dbf164a98d47a9a034364634fbe5e96a57b8fd0daa64bb344ccf2633fac9a
0
57
2022-03-28 11:51:08
2c7a0500814a98ab106bfa7cf04c59c2697a8759089c99bd1465b5601bafc50f
0
56
2022-03-27 20:16:56
03976e17ff5ca63cb37df4e66adbb00d1e0c03347b6d503038712b55bc5b5263
0
55
2022-03-27 16:00:03
cd72b49809d5866f9e45fe5d0993f20265a6daaa3d98a8fdee7fe72bca442ca1
0
57
2022-03-27 15:42:10
cda5896df946db0f0cba3315fa435c634593733abc7ddaddb201b61b1ab816c3
0
57
2022-03-27 09:47:55
4b10e542f22a249111790b5be758fcdbff8786bfe7bcf968d8aeb0ae07974ecc
0
56
2022-03-27 09:13:20
803906291294f635ea8ba76a3a77893e9c36f19cc5d5abf1bb2479c269beacf8
0
56
2022-03-27 08:59:24
78415dbfe3ddd576bb71faa0f46f0415aeb736b8afd292002602f264a4a2995d
0
56
2022-03-27 08:47:32
f5f4bdc56235e662ee142e27625e676392a78664b528eebfd4677676dacef72a
0
56
2022-03-27 07:32:23
0b564ff0e31e1a3504c2b36324c7aeddbc4f1f79695fef90d38f6dd7c80ac070
0
57
2022-03-26 17:55:23
be7e26819f3bc66c2ccc541aa41344892564d9807e3e44d4839e2397da01ebc7
0
68
2022-03-25 01:42:05
5a0f71b037877b4b6412ed819752d9bc532fdb3a00dcd9ead5a85df12976b0b4
40
67
2022-03-25 01:40:53
da21d159dcb5a2474527efa93b25ce60e6b3c0a7f10e3da113e3a2fc6534d25d
37
56
2022-03-24 00:10:18
8f53ea9382c3e55ca96dbe50b4f3b1e974f03669f5449b11a61229713458e1c8
0
56
2022-03-18 07:18:52
b4daa54f5398d6cc83c5b7d93bc143a6b081c2755b0b3781a37d792ed9d292fa
2
50
2022-03-17 03:09:33
c40a12397487392ee1547e2d97839d8ff95f3863d1650a6830fe67fdb6ab2202
0
56
2022-03-16 15:36:35
37adfe776c5c6b1fd377d5f91918c71b269765d23ac3a838381f616223351d7c
0
54
2022-03-16 10:43:35
d83941bb8b601de98168153f552b2bf167d1089692d4f1121d79c341ae208598
0
54
2022-03-15 16:02:00
3bb1265179a268ff66f34a8d96d50acc33e33ea1484fb4464faaa51862b6ecee
0
66
2022-03-15 13:26:41
0214ce48e0f3dd7f2c2d18ec8fc41ace5a936b88f6e92a1ccdf513eba6c3f2ba
21

Rule Matches per Month (last 24 months)