SUSP_PS1_Indicators_BitsTransfer_Dec21_1

Rule Info

Author
Florian Roth
Reference
Internal Research
Minimum Yara
1.7
Name
SUSP_PS1_Indicators_BitsTransfer_Dec21_1
Date
2021-12-21
Description
Detects suspicious PowerShell scripts that import a BitsTransfer module
Tags
['T1086', 'SCRIPT', 'T1059_001', 'SUSP']
Score
60
Modified
2022-05-19
Av Ratio
10.33
Required Modules
[]
Rule Hash
1f036cf888db791f33d88fe7d44ff719

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
42
Suspicious (< 10 engines)
17
Clean (0 engines)
83

Rule Matches

Hash
Positives
Total
Timestamp
VT
384dd571e7c04fdd1c39eb3c245e2f934aac8a3c02d8760fa8ede9178ad089ed
0
61
2022-11-25 03:12:58
9071244b35d2ea522b011ae90e0d5b16a5fcf4945fbd7ab44b13c3499c433016
0
61
2022-11-20 03:13:21
74ed4dddc2bf15c69b44f94ad9079b4d56b67b65c5cc12e28780c05a1981779a
0
61
2022-11-20 00:21:15
78a33e5635ce7011cab4be039adbb04487f63e223d4b583f64bea414fcdf77d3
0
61
2022-11-16 12:08:38
c0fe156fffbeb9bcb393beec6bedde3b1df94ce20cca66f83bc64f573197b138
0
61
2022-11-15 22:31:51
60cf7a1e754839748f96634b5addc50b81e10168126d57c389c3cdd8ec74756c
0
61
2022-11-15 01:47:47
408bea4f07c9485adc95c1f88c6f9d3d4a7dcbd423461f34a1d47028206ea9a9
0
56
2022-11-14 11:14:05
97ad96dbd077ebb820d6f97cc6d98a580e39c1ff298c9ebb240d5073b2241b24
0
61
2022-11-13 05:21:24
468b1cb6dd727a2b68b8b4267b8c468de0b5ae61eba5c004c428845b58fa1150
0
61
2022-11-13 01:46:55
3fa1692eef188479874b50fb0008eac021c5a2832bf9ae78331fb581fda8f270
0
61
2022-11-12 23:00:24
a7f70aed8fd5394a529102fe9c76fe2b3b871cb943b49f4624323fed3bc02063
0
61
2022-11-12 22:59:19
9234d8aaa18f64c13d9660e92262d4c124d48491cff80304610ebdf70af08ae0
0
61
2022-11-12 22:59:18
e484f6e9c80b3e6e96a48aa60aa26a0963178efde38d8031b28979d07ddc5d20
0
60
2022-11-11 08:46:04
0b651f1717175046a90889ba689d1e3282d1380b8aa9d98c33ced46c8722e5a3
0
61
2022-11-11 06:42:16
dec2d53d8b0040a46a0710c1ea43e68154d5bf8d1d01ec5857100d1ebe1f188a
3
61
2022-11-08 10:38:58
2821d5f2993bdbd313cdaad4f0780b2f7fa1777c0bd1070a3bfd70bb15e06763
4
61
2022-11-08 01:18:18
cad026dc091e15e0fe8ebe3f6e980ed3b7b0a34612cd58df09063c2ec9b20f33
0
61
2022-11-07 09:58:09
10fceed8cfaacad530955b89b7a3386a629f99d2f95905836186fed913220870
16
72
2022-11-03 10:48:32
7ec8126476dd54ea8b7df086867af23a7abf0c2c43b0f8369d54c09db6805f3f
0
61
2022-10-31 18:01:01
34927d33d5e57742c16d9fa1b7ef2fe275a1ee5369c9003329377b982abc18bf
1
61
2022-10-29 07:07:00
bf06d3b8348015652f723fb84b07333a717b79f2204ad5c7766f66be7e7e7e30
34
72
2022-10-26 12:37:40
91f3d379ac6481525c6aed430e71ae464e1eff380d2730dd44b04d73ef00c5ac
0
61
2022-10-25 20:17:37
b50a79cf7f3eaf0365286c4fc75cc5b84f898473f068ff209df32ba0d61db5f4
0
60
2022-10-24 06:35:50
61d2c5ba9eba943e623a6a58293e779a3b0cdf4e2363e0c287a91501925f6de3
0
61
2022-10-24 01:14:54
6b604f281d7fb60f921939ae09fc25c8c03ac79bdbd2dd95cc84396e060d3f92
0
61
2022-10-20 04:08:39
cd78c8669cfafe4579d86dad9b9ba896efd3ee590db72ad06baf29bbae84a202
0
61
2022-10-12 22:29:53
6b7396009a2e0470c208fda68b85ce57097398a4dcc8e774e2b311e5baa388fb
0
61
2022-10-12 03:54:33
22654e1a34a4bd0184897f4da97be940225217eedfd6d4850c045edc67af9e2a
15
72
2022-10-10 09:08:26
c840b3f792ff448da1a2930dc02b6f39037f1700c9fcffd6cfd79ec411f5e385
0
64
2022-09-30 01:28:45
c0a37ed8b078bd0e98ac2b3a12dd48404061c430c1a4ccae8637cc11d70b99fb
0
59
2022-09-29 08:41:46
be6c336334cfcc6f6a73d6182fc574bd823c51d8778d833d351de1cb004e1016
20
60
2022-09-29 05:38:49
33edcda91dd24d89aec2f138f57766ad712a037b5f8e2f0415e42b378113260a
23
71
2022-09-26 02:33:38
fafa1140c52810d948da526ae45a10a2728f8626dd03e46c6695c0149ea35862
18
71
2022-09-25 15:07:11
e5263a737b396ec8c4dc9dd415a695cf9f284eb4f56cdf5b5443f45e58b165fb
0
59
2022-09-22 08:31:42
0e10de3b60793d123da4f8b0020467482ea6d613be3ea491882a98d3502a0beb
0
59
2022-09-21 14:47:07
954f448ce9e37e3f2f1d3894af5d808bd3dc68a01e8eb13ce2055c1591c04c50
0
57
2022-09-21 14:47:05
1e75edec3acc7a1e4cc65591e7cdea455204e06366f49ec3c25b444bbd839d5c
2
70
2022-09-21 09:14:33
f7d3a4aefc102899a3816053e1793db6ebfcf808424947d6ef5a20e0fcca1403
0
59
2022-09-19 10:19:30
3d88170a9ea82653dfb15d0a772e07b9a5ea5ca5228f0d43be456e3ea75a8a4a
0
59
2022-09-09 19:21:38
7435ceb5ec7c3a9a27ff93c45006d6eec311bc839e1d8da91fbf73654b1b5416
0
59
2022-09-09 16:27:42
a26e933e19dc9df56d014bc4776d0c7c20708183bd9f187112cd9ab1ce1a99bd
0
58
2022-09-08 18:09:40
201eb77ce8a7023995da3838ee065f39f3256dcb6e62feebfb7c464a109e76c7
0
67
2022-09-05 09:09:15
580cf9ed43509ef72894e3e2b1159d0837d7d9e82baa71bd48924b1256bbe2c1
0
59
2022-09-03 10:44:00
573bb759dc071ce955f9a35286d56269527b2abea87cdc204b76007fcb214d5b
0
59
2022-09-03 07:09:05
a54851469ae07a5ad3cc4ae0e5b80ccd9cd95e44cd9160357a1e3f5cb031989c
1
58
2022-09-02 07:38:30
28cc89d078bd2dbb6df4c6cd93c5a8b1ecc1371251ffcce18530b57811094310
27
58
2022-09-01 04:10:15
9e1f98d70821eb78cb1219bc09aa83fdcf49549fcd4824d6552dce4cb04a63db
0
49
2022-08-27 16:10:33
5184b1a6d36b9446e23e5b796e411390fb9236d3594999611e1327521310d9ea
0
59
2022-08-26 06:20:11
6acd3ef9fded0012f72cb40d5684ae125d7ae1ca63e72df6adde7e0dc44163c6
48
71
2022-08-24 18:04:35
8abd7840fed30e8ba455110e1a7309d3b40208ee4ea29810ebb04853d79719b3
0
59
2022-08-23 15:14:40
d10c948fa1d22c0980ac7ff70ddb038c662d72323eb29713ca8533e93e3a14d1
14
59
2022-08-21 04:17:58
6fa3178e46612fb9a06e010a5a97e23120871f17b2f17bc396ea3fce0c7ba57b
37
71
2022-08-19 03:10:56
86527b479850fe86ef740102aae5c14ba273c7b3f9ba10dca5120a7bb785e903
0
56
2022-06-16 21:43:10
22153d4ce606c89498b872e96031af2339d824dbb6f3cd31656b419c1bac0d85
0
56
2022-06-14 20:01:50
a09d8917077280e5dadcc654a5b7c3750c82fe80a57c97d14eff1bf60a758e02
0
56
2022-06-10 22:26:24
f14ba8536c31ad4692730c061fa57d868197431b6db45cd561df972afa511e55
0
56
2022-06-10 00:32:40
343e37adcaded7b1d4f527b03c1c870b19b5563a1331a6ac8ce2c1a2c22482d1
0
56
2022-06-10 00:32:40
2f73cdd3cead2e2ecd1ab9ee9b2c1180ae40dc6fc61ff12038589ca76f09cb4b
0
56
2022-06-10 00:32:40
6ee9b3687531efcd4bd6912560d07fda154bdb81945bb17ab95deb5501af2b70
0
56
2022-06-10 00:32:40
e221e6d5270335440b79973250a64a2dfacd661d4e83372d8a5f75ef5f40e443
23
67
2022-06-04 11:29:10
f0a49a0687c186c3285e222bde25c0c8bc87b9c066fab30f4e2481e97d0dcb1f
11
57
2022-06-01 18:10:41
bd4725bb15a018e05098bc93d0db6e797e3fcb39bec4d4f868471b6ceed980f4
0
57
2022-05-27 02:14:48
972b7c56fc0cba236582ae2939b5635bfb0541bfbb3ce6f3af1fa631877b4615
10
58
2022-05-24 01:25:59
988af6d4e67852d3cbcdd46dc87f8e678ae52510be2a0d682a5283c61de379b3
0
57
2022-05-19 15:10:23
28fe172c6ee112cd92d88dd7cfdf175bcbcb448cc2dde0734af0c523ba3d5d1e
0
58
2022-05-18 10:31:34
3f294c06de82a4dfe67dbceafbe634a3935be06b9df619f85d7746f38b7a85d9
6
59
2022-05-15 01:25:02
442917f3cb0dffb0319b3a53ee7cbd1abd15c0d539c460d08503d4567682cdd9
10
58
2022-05-11 15:31:47
0ca6b33a7522383f030415a55158084de580556b0af592338fc08f1139f5c897
26
68
2022-05-09 00:11:58
f297a6f31b7e5794edcff8dbbd221c59f4aa8bde6d20494f04d54f1dec5cf2c7
29
68
2022-05-08 14:54:03
80c646cc20114e7b3d28a6c3cc86d0b8ae029fffe7dfd21fad9c3e26d93816d5
19
67
2022-05-06 04:29:08
6b7732d17ab662537a56726cbc8b98593a84b7917f2ed4b46a5d03e9d55512cd
0
56
2022-05-04 16:31:27
1d746f56817ee4e609d25c9046db20f9d2a558b9065f8283055a6fd5d3483956
14
68
2022-05-03 18:22:02
a13c3817a06a5b044b247cf37ff3c6943816558331e2b5b6ceaabde4c6bba076
39
68
2022-05-03 16:24:18
46b8e89b413b44fbc3c660d3af5d6790fcc5937870d3b32407f0f48c69add31d
44
69
2022-05-03 15:44:35
d27497310b93a7e0d20fc57b446dabe51d5698d84849d78ffcd677ef2c2bf763
22
59
2022-04-29 14:07:27
b70a620ffcc8360dfaea9febbd26374cf8377936e62782b0e6f9da2d861acb53
0
57
2022-04-28 12:06:23
12e28ca985416fdc5673d7fbfbb4eecb66ef9b7e3058112d8f7c3024a3ccab2c
1
58
2022-04-28 12:05:11
a7b2ebc5619c80688a2d4f9d851aa708c1330477a5a92fdc47ac987e24fd9a20
12
58
2022-04-26 13:06:53
94402f26a822f3c235fa9c661aa66f7d5f50d4a651f39daa4a513b018d542b3c
0
57
2022-04-17 12:46:51
d7b9f5ae4be5c6b97bbcf1464ee0a487acb824f26e1ea025bd25ca7046741dda
0
58
2022-04-15 22:08:52
afdafae326451da011ad3c132fa2a3a98905d7c37060d57af617894cb6b0d96b
11
56
2022-04-12 22:48:54
eddc1655cc1cc60c4652d36a15b4f7411c35b9a2a556b3022f33fcbe9a6e329b
0
57
2022-04-09 21:53:50
dfbd2bbf904acfdab3c7e3547d40d1e16f20d8e0896530fa3640c51bce6fad02
10
58
2022-04-08 13:39:56
03b3ff381e35cdc576cd5248c714150a77a7578091959703753a73a7efcd7823
12
58
2022-04-08 13:33:06
ed75a5ae7251af6d05b34fb00dd6fcd47f27ad1f20ccf4a724da5f2d60648e23
1
57
2022-04-08 13:31:33
12a6ee51db8573da51254dc42435e8599961a73f58cabad9015892a0310fe364
0
56
2022-04-08 03:31:04
4b2c6aeaa06fc5d85af60299cae689013adbe0d63e5b0ffae554d547d90e93af
0
56
2022-04-01 18:43:20
c824a2faa40a2e07b5005d06c44b0df52612e7ebb1e5af6f5f3f78819ade133e
1
57
2022-03-30 18:14:02
4fb592eb85075169616c611287b6685d3e54e39c25eba722b5497ca0ed18cde8
0
57
2022-03-27 18:44:56
2161998b745fe7d6ceec920ade4cb519ed043a8e304781fadf6633a2f5d4308f
0
56
2022-03-26 22:27:11
ee54795e3f20ff7f0e4dc62edb44eb98acb7b3391c6ff5817bf37a0e8ef15753
0
56
2022-03-26 21:51:19
35e7e927e26545072904c38e4d10e7719196150f8a47fb94d7c62f9376f6088d
15
66
2022-03-24 04:59:03
1d89a3490c373150e78a3a4db09e1c7f369a819de7058193622a20af43e20ecc
0
56
2022-03-21 15:40:03
142c9498de663f65ad2cadcb2eccdca56c8111f3df6b46509435d51aa12e22b8
0
55
2022-03-20 15:52:38
5514aeae0eaebbdd02d62a89d839e8fb08cd741fb797ce3db6619e978fb3ecf4
29
66
2022-03-14 23:00:02
05e9d4795f74c53f852ee050ad0fcaf9a5c1fbed8beda03ae305c0beceda0586
0
55
2022-03-11 05:06:17
9f687b21d516e2190945740c782dd9e74a5632bfff85478f64e742f628f441bf
8
57
2022-03-07 06:43:28
1b00ad7462b1699a364b142d26e0f25e263b3962700edc463d079d4d0692e69e
0
57
2022-03-02 11:15:58
c6e9d8363ebf73d3c333ff690719b71e43cf521e611bb3fd7f3620f9ac97ff50
13
70
2022-02-26 23:32:47
963f1017be168f6c2ea70283cc0b08b82985046cd2f25c3ac259990c6013187a
43
71
2022-02-22 20:29:38
37d891499e08a687df0bbfb5e267cb1f5445a1379091fb7f788a1859008df063
12
69
2022-02-21 20:15:19
095269f78e0ed9abf120d359a03978ca8cd78cd4f73b8af708ce1583e8fe39a3
15
68
2022-02-15 19:38:12
b0622af132c95a66ba14371c6cfb815504dddb25ac8433c62e9de8d0a64660d5
1
56
2022-02-14 18:37:32
34c80973d282e1fb6ad224116f767036ee6bf81b0da040bf20cc18f9e76b2434
1
57
2022-02-14 06:40:52
738d04fc5de30d8920399c2b59c16c3561afa1900ae4c67b1208164a5ed8f028
0
57
2022-02-13 21:58:16
39b6643b142e483d446c8dfed28324b693089bad13e943c8c0d0624dbb42f067
0
58
2022-02-12 20:04:50
d090ce4641a170f74c47ca938b3f80e47bd2c0723ac6fd994074721373a84b5e
0
58
2022-02-11 22:16:42
c7dd7e8409c24c5c065a794e869338898f5ba0267d331339124a77676b3e2a69
41
68
2022-02-11 11:56:09
59e21b6014c41fafde19d4a3447abf575c22cae1343cfd40e999d828b630eeea
0
57
2022-02-11 00:34:06
950bb71217ecd19ad127ebb2d8494a8d59a1a527085ae0728abfb29bfc851b2a
11
59
2022-02-09 13:13:20
94c2607f41e3dc46763e1feb6077fb3c5b0a27dfa79aede96c1949522d4a46eb
0
57
2022-02-08 06:58:28
fc1222c0fb88283d1ae7fb7b9dc156cb47e4cf38a100a5041e995de21ce4f049
11
56
2022-02-04 06:38:20
4dc4c9e50ed18f15d49325107096b682337cd2a051f0396da406f8d6ee33fbf9
10
50
2022-02-03 06:41:24
af3f285c7903fd5f99d58d227980cf4c5694d41074dd9f6c416ab6de422f74a0
0
50
2022-02-01 18:31:43
a34f458f5906d9355c43b6af8086b73e35d662a3d05b61315e5b63b51ddc7663
0
67
2022-01-31 07:57:37
49839dd3d9a763737d520f62fbd4f2297143665733641e707d03844e8a80b5e8
27
67
2022-01-30 20:56:08
0de7575eaec0908e4cc77c62a7a59f24bfb6b387f687e02d91065f96731f060d
0
57
2022-01-30 08:53:00
9ac9353b69cc94f3fbcbbf0d280692e2ecb96f42714e68894783c47fefca99cd
0
58
2022-01-29 02:13:26
c366b2cdfd71dd8ae31efdb7894a33423ab3f06bb66de5411856495572d2aa35
0
58
2022-01-28 07:39:50
f21728f333da9e9c4a26ca10351c874531b7db6a3a317601d55aff98de360dd3
0
57
2022-01-25 20:16:12
c60589569465a095acce23ea8109a65f8074a73d1644fa1e2bff3bd59a87236e
0
56
2022-01-25 01:15:21
a4193672e6f028125396278e1b59c8640254312a035f9cf0cf2bf3ec3d714675
0
56
2022-01-24 20:09:01
66c75a74e30c0b8f11733166f7b7509d98b5071a5dd709fe1dff52bf59745c20
0
55
2022-01-20 09:32:13
10dffa9656a0d3380579bbdbe9c50e689059b16248e0679e1467a71096146ebc
29
66
2022-01-17 07:51:47
005f9e8ff8dd0542550f960e83216f717ed9d893bc39457c21fb1142895d69c6
1
56
2022-01-16 22:50:23
9ff68520e3478d33ab150b7f4db42cbd9d2b9268aad3447a2ba20dd60771547e
0
52
2022-01-14 06:08:22
da8adc218f63bd26e61ea39cc3151c9688997031d8b0d87c04e6d855c7249c12
1
56
2022-01-09 08:22:44
ae518a546ec6353dfe61f3be6df6371ecdd0abe44819dcf93b5ae9cf87bc416c
11
56
2022-01-09 07:01:53
2f5424d7fbb3652340ed2d40f48f2e3ce2273155904a834127699513c1d8c2ab
1
56
2022-01-09 02:10:33
f79e98016e126e1e50c2d6836b41da8c8ec09612796eff8a0a3433f51fb75e3d
1
56
2022-01-06 18:32:58
e07abd6c794e36d30c918c5110901ce65c5f4148a6800ae40f97b4f570b9fab8
1
57
2022-01-04 21:41:11
070e582a40d9c6bd6641466313c0c8ad80cf5f49bf85be935159de01b7fd1a5c
0
57
2022-01-01 23:07:33
e9305b8a7e903606d1309d639c79940209963826599052b8bdd0ff9485e6ce88
0
56
2021-12-30 23:22:20
afb13f0e52571443dd1d7d92198d64c6e8f56019edf2b0e4ef885c57f61808f5
0
56
2021-12-30 23:22:19
8c4b72544f1791dd27e87f13a1c9d3070bb70f979e5e2ec98160f9f31945f33b
12
56
2021-12-28 08:46:54
14b9487a02cef6c2c38374ebfe018f1560db44b332a493812528fe7e311c3684
0
57
2021-12-27 09:27:55
7eb3309fcd00fb8ae2c043adb4add1b522d6d50c5c915d7ffdc881f8ab298e1e
0
56
2021-12-27 06:19:41
9360b43e99cb4856bddc2a842b46822aa1602640b75592f4743b11e5d2c28844
0
57
2021-12-27 00:37:00
1ea5c10e191ad306d0a8377c1e88592ef11e228280dd7e410d8528c09ca32a51
44
69
2021-12-26 00:48:30
3946531669413d5e8871e7a305abeaf8c02050e3bdff1042b54e646a63b9c4f1
0
54
2021-12-25 00:49:31
2a3838bee659ff44276c629f4ab26fc85a58a06728954dc94918cb19f19799a2
31
69
2021-12-24 07:45:51
2dd72be89742325dd2289ca01da33d0ac4c0a02ae210d308e6b64b62c7703f05
30
69
2021-12-23 15:45:30

Rule Matches per Month (last 24 months)