SUSP_OBFUSC_Split_Backtick_Obfuscation_Jul22_1

Rule Info

Name
SUSP_OBFUSC_Split_Backtick_Obfuscation_Jul22_1
Author
Florian Roth
Description
Detects charcteristics found in samples that obfuscate command lines using split up values
Score
70
Date
2022-07-08
Minimum Yara
1.7
Rule Hash
c6dc95dc758ea1795f163431b31b24cc
Tags
['OBFUS', 'SUSP', 'T1027']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
36
Suspicious (< 10 engines)
113
Clean (0 engines)
16

Rule Matches

Timestamp
Positives
Total
Hash
VT
2024-02-24 12:13:42
35
61
d607b68af857708dcd1b531b9cc90fb764612cd1f092262aa036f80aab3f0a45
2024-02-23 23:04:08
7
60
d18bcd2da902dc0d5cd14ee96420f3cd0fe9caf4b56571f5738d4b94f5d97feb
2024-02-21 02:06:04
14
59
3853e2c1e1ee94e9aebe9d334e14d3e9ccb60dad2fdfc1e18ebc4701f8e372b8
2024-02-17 06:05:33
4
60
588fc51b1246a61af656ca7b063dfb9d6014c1f2b1088a964f653ff7fd42efc4
2024-02-16 06:14:06
3
59
7aa5bbeca8bf77cb386109c7efc843f121efeacdc033d0b589ad0787ed3b4ff4
2024-01-27 20:03:27
7
60
b7bd79d859c75d98e0507eb23280e0a939caa8c6b720c7bf03f876e371672670
2024-01-07 11:24:36
6
58
6ce2f4213d8be37b088798ab876e96e9388943766137842e1031b7d03dd8d6e2
2024-01-01 12:50:31
7
59
6345f8fb53fc83f3105dc03f2685f3a2068b6fec9b050e8d67ca622c00d05702
2023-12-29 21:03:37
3
60
4bbe0cad8da4560294329f4e1e2be342bc15afc71d3d56f7c2896b9f3c7931c8
2023-12-29 09:03:39
6
60
bd0eb7214d4c6243091e632fe8690e3934b5a6199e13c6f9bb67f542cc713fa9
2023-12-25 07:03:31
15
60
2a31a0d825245e9ad4656e337866ed8797fbeb6ecc6edfd961ced684ca198af9
2023-12-23 08:06:13
0
61
2cfbd0d9612d63926bc03a2ed2c73b5ab0d75cc71981ddfc31fdc0ed3bc77c21
2023-12-21 22:54:19
0
60
963a0ee298e863565e542c7b9007d6dedb328de1e0d938b8a1481122da001fbd
2023-12-09 14:04:55
6
60
bb45cc2d075b821971496d665206e2683d56469053c1a3293a3663aacf7dfb7d
2023-12-07 20:46:30
5
60
70aae88a5b7e7ff57c9319ceeb5d131c39b9a033601339f3a631ba74be698502
2023-11-29 11:04:43
0
65
56d40707e517010009492ce9f4ead8f9234a68774e9ceb7f5fadb2ce31a789b3
2023-11-23 03:00:39
7
58
e956fd70c988ac41a0d86569731fe9621dc1d58541f0f3c46d2a2c36cf191701
2023-11-18 18:42:12
2
59
c9730fc025ae90f81f47a4d8bf3c0bdc473f64d7b2a29e553cd730d141049d31
2023-11-17 22:00:20
9
60
e422b47016d95a67bcf2387737e62d736639d7d5dbe514c5f3106c154b4e79f8
2023-11-17 01:17:16
1
60
7a4e8e58a5df9cfc9f2b09b5cc35e54e891d41afc1b4cba952fe0cec7b2cec06
2023-11-11 11:16:35
35
71
f9603cadbb831a62e4abd53d30e69e2607d473433cdaaf42ebdec392337d557a
2023-11-03 13:58:41
4
60
bf2a23e08c5567997e6eb76cb316471debcd007c5bf3e4fa2ec8b8edf2e814bb
2023-10-31 07:02:33
2
60
0035d2327c687d6c269eac592608140062d2dc5fea832b3a131c5429f1b2a11c
2023-10-30 12:55:36
12
56
3f16bd34cd2d69e5f065237a7fc3be505d3ff72595b8e869788f054a9e8639f9
2023-10-30 07:05:26
4
60
7de3cefd96a98df4643e57ba717f6dd5506d15ca1ac742506fb9936a8010cbd7
2023-10-27 21:00:54
3
60
34921cafcdc9a5414219c969e47de44c2a85adc83b8794f9d56a376af0bb4fd8
2023-10-26 23:14:54
3
59
f3c59db5ae1e7d31c8fe01b76f85f61eeec43845e1e4ee01817f218fe555954d
2023-10-25 11:16:29
22
60
19374e1f2c522995a12042832283a7f6a79ae2d89c5bff572bfd3019ba1ac675
2023-10-19 06:12:55
6
60
b685f3e2a53e29c22759a6b079e29d202ed008a7eb703a60983e977c419249b8
2023-10-19 00:38:08
20
60
f20e4187bd43ce54ac63c3c0738710d9d0752179650072785d9b1d59ba0636c3
2023-10-16 18:00:29
6
60
c7c6aaa7e99cbcd3972951461965353cd21c7924f2f0e6618d2affbcccf638c2
2023-10-16 17:36:03
6
60
f988251491801127288e32666e3929261c47e2a1257e9e0684f284a55f501dcc
2023-10-16 17:34:52
6
60
2aec0fc40c8ad893cd9cd3f1b4e21d6d5978e08d5756c06cbe67b0a1009f681a
2023-10-16 17:33:32
5
60
cf5eef4d4fa1b2807e79cd1c1017c3f5e98f2843a07d8c0b4e2183f03ae44838
2023-10-11 12:12:50
3
60
0c4670228d7435187e1e05467d43d46b0daf43857a573a42e339f35e37705aab
2023-10-08 16:52:42
6
60
6264d7d0807e2ada54f36b568b7762bb62dbf95074799aae73d70ff43db89a18
2023-10-08 16:51:37
6
60
595c3c62a3f69dbb09787b68eeb6cd163d8624cc9b5aa3be104199dfa4bb1e14
2023-10-08 01:08:12
23
72
151a13456634aa1f6bc205bc915861698260966c8c806ecae940a35d3765fd70
2023-10-06 05:26:34
1
60
c641e3505d8f19b6993bc21a8dbb68e88c73aa0382c7d9da9baf617cb924f853
2023-10-06 05:19:43
10
60
e5bed99bc86847d94827902a8e4af45abc677f8d3f6e1a30c3428f90b05e1f61
2023-10-06 04:14:37
1
60
3db3d5196033932fef799ebf47c546b34492e139f9b3b0a04f2c622d293373d6
2023-09-22 19:07:02
14
57
939f1c0f6acf45a61810464ff4c6dd4d08188b2b06f58ac967cbbaf070d8a71a
2023-09-20 20:13:22
9
57
d179058093684c0232fe24892e9d986ac7f36f39e2848b0f6eb7b0dccd8dccb7
2023-09-19 19:37:18
17
57
ea2c43da0dd4aa4c967cf2dc94283fbf5d872226de51bc4668ac1f5619d0b03f
2023-09-19 19:17:42
14
56
bbe1fa36d370ee76e4ec0d2e6ed64ec817642eeb6da3749ca116e7d7e23a3b74
2023-08-16 18:01:41
61
70
e3584a537f69958a487cfcd518ff66c2f5fd6c01d9fc5fdff04cf30cac62d531
2023-08-15 21:02:46
0
59
bbdc2bf5c2ff56fa4621591efcf440eb4388d3b7acaa71d44a5cf4ebd7f4e511
2023-08-15 19:05:41
1
59
64ee869f0f59b57b1fd9995801547eb89e1aedb7c4d3dcf00ff7efcd6ce2b861
2023-08-09 09:44:18
2
58
4421de4172190d71e6a3a8c8fe111c5a5e51ce82c1548c43afabdb364466c47a
2023-08-09 09:06:44
12
59
b0ee7b8467527e8ba5c7ad22cbca203ab13675624af12cc1f61bb1e940f612ba
2023-07-24 10:29:41
1
59
d3eb5c389941cd87fc0aeaf781028e78319294ed95475803c775ed6b653b0d72
2023-07-16 14:01:04
5
59
21b273585f5565f55e5032de736cb191a5a12ae76c16f5585af91c2ebe4fd68e
2023-07-11 20:44:16
0
59
63e969f4b07ccbd2f560752bcb5b0b8f31c8e295c5559b4e77d7afde0ecd0a34
2023-07-06 08:06:00
28
67
084a7aba96d9b2ef01ecc317a556d950c60d2725664d2ed93ff2741a4046cc50
2023-07-06 04:12:25
31
70
b8eee5b2cd55d863d59105efb19a19b4608a3b56e9ed2050ff6b97448ad5b825
2023-07-06 02:31:10
1
59
7801bc38d903566032fccd7a0cd3dd2c92e3a2ce25fa08d5cf64d4e1056de8e3
2023-07-05 23:48:51
0
64
425e6a9851984acec6f4cef651f8a25225097a34d7b873331d4224ac88d429af
2023-07-04 17:21:24
33
60
d38c0026fd38f78350ad259f5f0794379a98f8a6aa5a4c4241507851c5e8179d
2023-07-04 06:33:28
27
69
5fcb96f518a57c00631875728345d69aaac66bbd252f593332378ccee53e77e7
2023-07-04 06:18:18
1
59
c4149da7363ac3bb0218760e01d45c65bd9b7a1c76f14e9ca46425b11b5aa92c
2023-07-02 17:24:16
7
59
cb22fb98bae3e1772e27854b4f9d162814edc1b6abf9d32c5d07010b7b7d6fde
2023-06-27 18:12:26
6
58
ba4ba3b65fe6bdf62b95633dc6d3c51316b4912c852c40762093375bc13e13e0
2023-06-20 17:30:21
5
57
26fe6a31dd9f799128b8a4594af5781d842c3266980c9616305c717b3b24bcaf
2023-06-12 20:21:49
6
59
40ff672d56c40fc4f0d3d0b53d106e73f4a49e693756537990508389300b5f96
2023-06-11 06:35:19
1
59
23741b0bdd7b37088507fc46c6eac1dabf7e485f2e377d4c95525991252dd436
2023-06-11 02:36:30
0
59
144c1c708f3e20d18915bab49f4e1850418a8aff1f5a9c4858e6d13a2284bca0
2023-06-09 12:30:09
7
59
94d9d041c4a69aa67b942e88b6d8ad3e60553ca00e53126ca8ff145788bfefc2
2023-06-01 19:13:43
5
59
6f7ee6c3e05160b64888b44088b219615a2e7df1b35e01aa1a363db1a475044c
2023-05-30 12:09:16
5
59
52ab13780ad8f8cb7a2f0949fb1c6466fbb8485c222ea254374576883396758b
2023-05-12 11:14:39
9
58
fdc246c6d786b2f9f84adce4846f62cd166eee4647e361c6c79202d74152c736
2023-05-11 08:14:12
1
58
ebed3526b814ae4beb5e82be4d3d0e6a161d789af88a656f3ec1ce3e40e1d322
2023-05-11 08:08:16
5
58
29cdb443549edd195a1455a12fd1c41b2c73048e0e997abcdd998f9e1a4a3beb
2023-05-11 00:24:08
3
58
5310f45fd07a2bdc5f117786ea9238558e0905c267416f99bbaeb4bd570003ab
2023-05-09 21:17:42
0
58
27fe14721da387e852361266e4c7c1aad502dd5412e1ec1e48edc31e57171030
2023-05-09 21:06:34
0
58
2d17555a5582df46b8ae4ba3afa1037c06c76db1267f85e3553ab8e1f8e0f27a
2023-05-07 18:15:31
6
58
850b9d2844fcff13871ac3038d3f17d5e0c92eb151dff3ff2d76943c91075f2f
2023-05-07 18:14:48
6
58
7b5fff986af0f203645befe82ca64d986270d4073e565611cffa0755753eedb0
2023-04-30 21:07:11
6
59
59a2d29b24b173ad9e31c53ddb23424185fc06b643fe041e9d07d872b957195e
2023-04-20 21:08:05
2
59
8d4404647698d2d5abfecf8ab9bd644d63786e66b557b02171afa1d8386303f5
2023-04-19 19:09:25
0
59
362560cba403643ada97b4d041bac639029543a684354b213f044e4172fa165a
2023-04-18 19:06:29
10
59
7589e2ca6f3539737abfed17d2818afb3bfbdeb1fc604a1573c20abb18167614
2023-04-12 00:18:13
4
59
0cd1a472e97064b0e771038923233aac7578b5299f944604de508ae13aa61a50
2023-04-04 08:08:11
5
55
f6ff8afaf89e6ffe38ea56837bbf13a45be8ad9dc91a49d1ecc7d265c89cfedd
2023-04-02 12:22:07
5
59
8070b7e8ad0228736d5a32ff9a7f489b11093c0ce0ac799959db65d66a02f402
2023-04-01 20:06:44
0
58
1295962d7c05cf1c9f1ceab7d680157bfcd87de0b0dde48d4b4d9599092c744d
2023-03-30 00:11:46
4
59
f783311850e36e876320e063f0ce9fe4e07812320e5a69fac95eb6420d89f98a
2023-03-06 02:29:44
1
59
11380448a2b74532a42208f93fb7d3afd6e85e74b5529b95530c9b9466056dae
2023-03-06 01:16:33
1
59
8e302e774391f34ec05abfa7f55be6d6cd851d52b9fa7b51073facf099d4b2be
2023-03-05 18:15:44
1
56
32ad61af3db9e9aa5db6a89feab81cfd2cbf27df1ecfd816dfcf899766bcc4a4
2023-03-05 08:01:01
14
59
1cb03582b3654ece1c7a8d8c81f1a79a3df9e53593dcf2725803edfc4d541621
2023-03-05 08:00:58
6
55
bdf104af05ae876538d1162cad1438904b34228096d5e4747e83e43bd233ac80
2023-03-05 07:57:19
4
59
f1507bd76669ed6a88524ce406415f304e9e560ac45928e23c5cbf471f3c96e6
2023-03-05 07:57:17
14
59
1e0f11059e9eee37617424deeaff635f661f6342742146a77b82e3d8d98108f3
2023-03-05 07:55:59
14
59
ce8475765cd1f4c1084e51c7f094416bd7a59948b1226b9f8aeecf93196a6495
2023-03-05 04:07:13
2
58
175b8c1040f37337583565055c544a48e404950a443cfca63d9662d63cd28870
2023-02-22 20:45:15
4
44
c6ed51df0e1256ed54b63be763046ed52abeab00f3cc4a9a9b8af4eaa4c5159e
2023-02-09 01:02:54
3
59
62099a166660602e38d105a803bb76102aeab81a8d71b171552b46aa22ba6da3
2023-02-06 20:37:00
4
60
5943c480547c04b5eab0a9a1ef45a2e1afb10292a0f6de271f0618162627ff2a
2023-02-04 13:28:35
4
60
bd73b6a9d51a099d626f7ce1685b760803fe5ddb4f26c129dc978c143dd811b0
2023-02-03 03:01:04
4
60
817fc552ffe372a573f9613e8f067b9a1fe10fc8175648ac0792f57f4682d122
2023-02-03 02:56:13
4
60
6a535aef5e32f7b0fcd418e42459f150a758fda64ac3d681a25b422966b1c593
2023-01-25 19:05:47
5
60
7b27dde38ff01e5d2ca68e6702636d679f4a16a44af9c51307d2be8254313b78
2023-01-24 18:46:02
4
60
f88bf820bc75d4cbbc1a06cf6fa6bf551079d02dc7e8a5af7f2fe89d9ceb339a
2023-01-24 00:36:05
5
60
66351d16d3bbf1f0c0d893a23a8ed53b135cf09360f3f57bc9b41f9ed5f8b7fd
2023-01-20 06:12:42
3
60
0b619c3267ab9efd9b0c9add00a1f8a8d4e48b0661c15862d84af34d89d8daec
2023-01-19 07:47:02
3
60
7dfbb8a4c540ea3cec087d669063ebfa875d441573b9b5b637dfca41f9ffa857
2023-01-19 07:42:18
4
60
9d253d712c8a1833058cdd19fa722db9b8876b65b705c18b970cd8920446ecde
2023-01-19 07:38:25
3
60
42994d6dcccd179df9be339777adbf0fce5578b95396033e8d4cbe64b3401bb9
2023-01-19 07:32:12
3
60
6f13b200667f4c86041e72b746cfdd49ac6365746598dfcf22833d8fffa40539
2023-01-19 07:31:07
3
60
986f335605c5912b89d07ebb5e2d01ba8784838d9bec9202902bec2aa74e326d
2023-01-19 07:19:57
3
60
ea32cb37bb35ddde9a0eaa9bf179824f62b7d1527c948c40c00dcf4aa3f2f998
2023-01-15 18:59:38
4
59
8e4baab4b28c069d8e2844c41573390d785831d9a777c763bf9574c12509f395
2023-01-15 18:25:11
17
56
5d54d74a8e704a36914269ae89cf605fd56f3ae028ceb0169bd4649f7decc0cf
2023-01-14 13:04:08
4
60
8bd9a089e5feffa907a2a4d67206c2d4e72d866c78e2504ba99cb2f5c43c15d5
2023-01-11 23:01:51
2
60
456a90f0070df3f830647c13f89ca0d2ec42374d527be15bf4ae9c0446327919
2023-01-10 11:38:32
2
59
6489e4d9b1df15de594ab20582daf7a0911e5157a26ed4d14f3fdae05b8f0330
2023-01-10 11:36:28
9
60
2e6e6cde723ff82485d8faba54e93fc382b77ce466d0e66af5d444a6d6fa65ad
2023-01-10 11:36:11
13
60
6985c4624c76abcb9f709c2ec300412fd3d5e2f17a137d6817efb944c3ceae6e
2023-01-06 16:48:57
4
61
e7f0538b811f5cb42ff1147f3c64d8560719de14f94cc3b927e0c3930c118a4a
2023-01-02 16:46:17
6
61
819a0c82a2c44729868b29f535d895ed99b0d918db29d663e61fb3f59001b13d
2022-12-27 02:31:28
2
61
18bd09bbaf8e623da61a8d38f0dfc434690ab8689fae8840d773eecffb701541
2022-12-24 08:17:15
5
61
8232ace58eca9ad32b338e9f3eaa7677d1f648b0686ff306ed1281b5a581e147
2022-12-19 17:08:31
28
61
51606c72b176d39354fce6c649053e1412f28838cc3c922bc814ff46d1f497bd
2022-12-17 19:08:07
5
61
24cb90d2d356bd42093632e79f278bdef7d5b09f6df49079c8170d874f343c6b
2022-12-14 16:22:04
2
61
5327d606e346a99700b2aac88cb4d0139f9511f9ed9b6664a74371be34711eb5
2022-12-12 12:39:22
9
61
2f83a87dc310fd1c73e7223653881ec5ee873821e909a6972c432cf27fcf829f
2022-12-07 20:08:15
0
62
ea2a0e6561a6fd8eabd9e733bdf086b76db2e9780c09f284c066af59bdb4f497
2022-12-04 15:00:32
13
61
6f31ef5ea65f55ae38be771219d7cb78176c26708aa4ee2097e9d58c15d1f9c6
2022-11-30 17:17:48
4
61
701015a7cdb626bc72806df5341de547fd2b5d92eda0600892951ffe40d1e55c
2022-11-26 05:21:02
0
62
77e1c16a73160894ee3575634a90c3d4ef9b479131da7d82c3fd4fc2223dbf56
2022-11-25 04:10:45
4
61
eb514da9eb06775b1dd5a4865951647243b76735764aca8e8b085e4fcf9a131c
2022-11-21 22:08:21
4
61
ac241463785fbb8956a4d0c1b47de465fb995234c3975126b39561433608100c
2022-11-21 15:07:44
6
61
6ac435a67eb247caefc732990e5c309f3094a8b4efe4e3ea8e97774e0b072475
2022-11-20 23:58:14
5
61
c1619258c883ba632894dc9427250aac3d638d3fbe71fc4e2b38a350adaa5a46
2022-11-16 21:07:44
5
61
8e545b03236429055c2dc1d2813f57e4fbc52731bdbd3934ddf824c2ef760f57
2022-11-16 21:07:32
4
61
7b5fd9d8b86d2e42893f4372992699eabee96b61e939f68799add921ba58be92
2022-11-16 18:24:50
3
61
295f385ff62efc8e10b86b11b1b029efbe251f88b0864c166ef572ba052e210b
2022-11-14 10:05:10
4
61
4b027027a90578a1c28a770ff8e8648169a213c8114c713097f7a2f82b05668c
2022-11-14 09:35:08
5
61
98f319f8a003dfeada43acfd4c7f8c235d5c89248aff04744ed12413459b1845
2022-11-07 15:35:28
5
61
71949416297e4182c7a0f22b2ff3a9dfd32bd163b885398a27591a39f691201c
2022-11-07 13:13:45
4
61
13cf69e3703aa0131358159e16b5d62734b471d4d4f24b4ce353c297a3195f12
2022-11-07 13:10:37
4
61
64ed5e78801312d1f8ae19d730d2cef8f9641439f64106adffb34d1c08870d63
2022-11-07 13:08:01
5
61
0e8839177907cd14ae00165fb8d5b8fbef90da5d1416b73325fc43079acb7953
2022-11-05 22:34:27
5
61
5bfb1965f6275b2c21eee520670259c7ba629e92c1e814bc8ca9188207b2cb59
2022-11-02 22:05:44
5
61
1f13a33ca7b8d8d30e4c4625d4a61d2edf57f4c972d9da3c7c929476ddc5dd93
2022-11-02 21:58:19
6
61
feec1079f52a9f0d3bf4a302adda2c3ef6804d50a06034ca455b30399e9baa6d
2022-10-28 03:11:25
6
61
b1ca06d34a3cb3ccb3b5760395de2072bb7420c47ccfd7e48cc1e0971b1f14ab
2022-10-26 14:19:16
41
72
c7e082830f1c6dc069263aab670523db975d0071df7d6ff67b453577cb5b36dc
2022-10-19 15:34:31
11
58
1f091d78f6dd93348b935760d4a1c260fdf889828cfcad707c53d038a2c54715
2022-10-19 15:25:31
11
61
61917eca9fff609430648342fb9525d7285d1199915a199d624d534770323910
2022-10-19 15:24:10
11
61
11de69d50b0e28cd13465a8d67a9e934f2422124e5ca5ab21483f7a8fccf0d60
2022-10-18 23:46:44
12
61
690c5bd69951dcba9c442265bc38531b7fb67c3b7a96c6635cba6a75676c1bdb
2022-10-17 13:17:27
5
61
eeb76d89b74cdcd8f91bc69831dc08a1b39782aef0ef220a8375edf89b0d304a
2022-10-13 12:08:49
0
66
af00dfb732e2272da610ae064199304c3499660507446989948a8a693ada3f1a
2022-10-10 12:00:44
16
61
e87af4dca2d040903bd158f6395fe1b41cbeca934ac5582ac3d0c6a0e9716a62
2022-09-20 23:42:35
0
55
d5ee3dc9b3ffff3765259d91d48c3561292fd1da288e9a472be8f8f8fd20a5d1
2022-09-10 13:50:17
3
59
0edc2f0392d7616f7a85501b0031c4ebe07bfe20f88ae22cdacda769ae3c2244
2022-09-08 11:15:17
29
61
f59d9aab120c92bb4f8f7ec2dbe9897ee6a49befa9f4c646c1b0e5c2d0f36a63
2022-09-08 11:15:09
26
61
b5467fd519696c4fad76935653a2fe1b9fdda647c93543be54701715b7039a67
2022-09-08 11:15:07
24
59
098c11ea4f1acba35c7c6c1fe8dc40db5386f0264d40040c21812197af2a3723
2022-09-08 11:15:07
27
59
b84c2321103515cbd77331796398d99ba1f28363534ea598bc6de47f01076590
2022-09-05 14:50:06
3
59
3a4b758e90dadf5d66bf74004cf690bcca200457eadb63425b47f16e3bf04f91
2022-09-05 14:47:56
0
59
77674bec24fae95d4563aaa285667ae1797c1249cb1fe67c98e9b42efdf36ef8
2022-08-30 04:30:58
4
58
3477a61c0c576ef73703688b89f2b6af76467a57f32f22e60e04fe28119ed000
2022-08-29 08:51:36
6
58
0b5880e34e81396221e6521dbd6c4c5b3529cf675a02bad7b3d95726549e493a

Rule Matches per Month (last 24 months)