SUSP_PS1_Indicators_Loader_Gen_Dec21_2

Rule Info

Description
Detects indicators found in PowerShell loaders
Reference
Internal Research
Tags
['SCRIPT', 'GEN', 'SUSP', 'T1086', 'T1059_001']
Date
2021-12-22
Required Modules
[]
Rule Hash
420dacfed65cb5de10f610127a8233af
Score
70
Av Ratio
34.73
Name
SUSP_PS1_Indicators_Loader_Gen_Dec21_2
Author
Florian Roth
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
49
Suspicious (< 10 engines)
47
Clean (0 engines)
0

Rule Matches

Total
Timestamp
Hash
Positives
VT
57
2022-05-21 18:33:43
923d50f89a5d64c1ae3122f7db4b0d4f0a2d33630613647b6441dd3abf71317d
5
57
2022-05-21 18:32:36
c017a170c379ba6f657096c84710f145b220585ae6cfe24278cbe334d2599d59
2
57
2022-05-21 17:51:57
1f4750c6eb021f3fec03c31c65bfcf0b9b5da954fb7266dd4a5cab65b446ce4b
5
57
2022-05-14 01:32:52
83fcfa6d1a93a2d03b39fc5aa60dfcba625beef6dfabfe48df8e240b33656737
4
58
2022-05-10 15:10:26
92f45182694444c621467db9f2dbb5ac5b393e6076f5fdd2dda23b0d793c25f4
4
60
2022-05-05 09:56:20
c1e22159e9a2405afeb3e05a91ef39f2940a0dff016970650a40c08330c5274a
37
60
2022-05-05 09:56:20
fe8b36e70062b6c54decc87c36b6f36bf484cb8d3c11ffd7d83a873ea70288fb
36
60
2022-05-05 09:55:18
50b425af4de0b0720e51957df82a68294559e9a9e95a6889908b61fdec4667c4
40
60
2022-05-05 09:55:12
a19215134869ba5e4c9846f4f50ff12b0c7dd8ff0c62aa97c84ca0d1dd14fea7
41
59
2022-05-05 09:54:04
5bdc55ab81683de1bd8c46b2dca9a0edb928a5c65e1dcf3cd928b7d1897f87d8
43
60
2022-05-05 09:51:50
95c27674a636e63b7cb364593f4fbcaf8b96bfdfb4725b298aac0724b5d435e7
39
59
2022-05-04 20:15:23
023cf7fafe13aeccfa1ac4a7ac68ad3e7544bc029f160ca815c7f45dcdadb1a0
15
59
2022-05-03 20:19:24
a4015217b0787db02757c824dd3125279c5570b1804fb909d3944a5cebe47989
14
61
2022-05-02 17:51:08
cb690cb278f95f8b28eee18ee13352c6adbc3dcbaa7bf5f4a4ce12878e6d5e34
40
59
2022-05-02 17:51:08
5eeebf676e7fe92c85761bf550018f67e24441d506600332b13750e544c4168e
35
61
2022-05-02 17:51:08
fcc3fe9eb6b59c1e190e4ef5bc9dae94958622ab0d9420b6b3de5bf89782d1ab
42
61
2022-05-02 17:50:02
ff848737bd88e92c5bb871dd4b8b3551a1ac8709bdd40031e4afa315c430b901
41
58
2022-05-02 17:48:53
e51d9d945bdf410153155a0e578d6bfd9195e9ec05d8337849cdfec315388c2f
39
61
2022-05-02 17:48:50
6c152a36cd149ef58bcf363cbdd1cba0dca480eac3fbd37684c6bf59120ce1a0
39
61
2022-05-02 17:48:50
efb6b3a11d1d7f55bb0696453e31a0d6602f03ae74324b502277c7a245f6e5ef
40
61
2022-05-02 17:46:44
9c7d150b31f2c7441895475110ce6ab37f70c7dee18011e52a5caa368fb37ecf
43
60
2022-05-02 17:46:44
6678f9dccd35e0bd8fb77116ae687a24c7e7e6011d0b772ec52a2c247cb65b9f
40
61
2022-05-02 17:45:41
1d2c996b0db525ced75fe8d6dc60ea3689dba87827805dec97ed03a18dc7ce07
38
61
2022-05-02 17:44:35
514fcf5377365a01b57534c4cbec57918fb8cb8224a3c6d3b45710340027cd11
41
60
2022-05-02 17:44:33
77cbac149d9094f90e62bede8fb2e88f8fc7c78959889dd655268efa816fe20d
38
61
2022-05-02 17:44:33
07dac7b298c9f5c30603d2bd80fbd8b6e68b591d678cfbe67a54f5f17c5e7784
43
61
2022-05-02 17:44:33
2e9326bb0ea24d30175366448227d1594b97aaeb9ab3fa4afd4837ef7b0ea610
39
61
2022-05-02 17:44:32
609d663beb910a5a1e39f6366fd8f73bd41d7bd5247b6f936ef817b2c7d5529b
29
61
2022-05-02 17:43:30
9037fefd23bfb124bfc2a6c4653c6882c1fb97eae6f500be9317342dd2ffb4cc
40
61
2022-05-02 17:43:30
db9791a5cdbab782935e21577df3ff389aaa6e63f4122918083202bde08e0f27
42
61
2022-05-02 17:42:21
ab943fe7e770b1eb6422392e50f09f37e6fd8f22b42654ff151b26e7615b0219
41
60
2022-05-02 17:41:16
6deab1424af8fc17af4e90722797ace3bdc678027eac449c6ee060f508c8c877
37
61
2022-05-02 17:40:08
18e87fa0349a841292702fade67b2a2cf5b67f52f646ee12e09e4e34e38fc515
40
61
2022-05-02 17:38:54
f8cec2103456d4eed4bc6f144bef714e74b0183b706e19729e6b37aa2c84ee90
43
61
2022-05-02 17:38:54
1eb9f137d2138579829bb97f2d60f90ca63ee8550b9b08cbfd964a9c033aa09d
39
58
2022-05-02 17:37:51
a9d860f7068b0fae8383a8e293c2232c812542fddc2e6565ebab9cc2b809d257
36
60
2022-05-02 17:36:38
98bf425cd00495a9e2d1544f01c9f9d8830d6d412326418e2ec5b2700d6c24f7
31
61
2022-05-02 17:34:29
0d7debf611da9f38e11da724833efac0d769bfad3bba6d51a4ad17ab69fe7630
43
58
2022-05-02 17:33:25
fc63e9fbb30a6437e0c90e4bc13d566f9bf1bf0fddec66686cbb1a87f3495c79
39
61
2022-05-02 17:33:17
928689d09b091560700d6c72b13c43ea500e5a561f9ba05b0a104cd596a80fba
43
60
2022-05-02 17:33:17
a73efb9bf60bd3a65c5877b6adf0856c1a2594c55964b8072a6a0c91d605befb
43
61
2022-05-02 17:33:17
45d935ee6f0a6ad4d43f719711782e41de22380b65b2c146be29788cddfcb895
39
60
2022-05-02 17:33:16
1b2549d92a7f6b20dec870dd28ef88e4417291dce7106c7f16be18ef11103311
40
60
2022-05-02 17:32:09
5e4a72ee2dd3c6adc7a93a70cfc250296b4011a9797612acfb73a580e8c5c9c1
43
60
2022-05-02 14:55:51
ea4450b11ac74e9193918c811ae663aba78ea9af6d96ea2af84769a893d13cfd
31
61
2022-05-02 14:53:39
8cf43294595a0ed5a94dbbd1788cc0cce2bbd8a37fbe6e574982cf2950041b11
40
61
2022-05-02 14:53:39
ed0e3d22c15ca6286824a437e68fe877d212aa5a0b08cc7de4d91d4ff9f5d740
42
61
2022-05-02 14:53:35
4b58fdaf0946d5175559919b78c2b37eb0eb7caa235c1402a8b64bb35a5de655
41
58
2022-04-28 08:45:56
e017ca7ef367a991253a4b1da78c5fc4a52c98435e053fdc228be2c7a0348d12
27
65
2022-04-26 15:27:06
d12ff30893fe1f6d65eb448f86d677ebb8b113d0fbf21780208081ec0627f6d9
34
69
2022-04-20 01:43:13
965b6a9224ce181bd2b3795fcaabf25b2e710b809ff8b3916eb238f11fe390dc
28
58
2022-04-12 15:00:59
36e302853449ba33f89b54d6257070a9eef972d1cd2b53453bfb5c527d8686d3
4
56
2022-03-18 12:06:56
444c77745066f165c6b56c0e75ffcfe7f38dd962933021655bf1d7b693597092
6
54
2022-03-16 23:35:19
d6e32072e358afd3478c60194e3f61d8d48655413cd8d654c725f0fc1fdc4c2e
6
54
2022-03-16 12:36:38
01644d8903eae8243a15861a4c97d79903d673ec9e2fee128d258f3d4f4aa174
3
54
2022-03-15 22:15:43
718ffa4926990620b73d520c9b2972808c80d698c687b783020c89d6dd28e6c8
5
55
2022-03-11 16:31:51
33378234f993c197187622c9c06f980953d1da4abc195c4b70ca5f3373c64c22
2
60
2022-03-02 23:35:55
e9725d1ae08361b7393e7e78d635650c8e73c069e2df729b0b10a8f9e5583729
43
56
2022-02-22 16:19:25
3373f324774ab440adbfd38859288fe7efb347c781c5efa1665a582bb3d404a4
2
54
2022-02-22 11:06:31
b26fa7e3f85d5bd8ccca12d893dea59e60bca6bbdf035a2cc516c5da51d00d9a
35
56
2022-02-04 01:13:57
b90c9c12e2a2412e0de22361d5f9a4ef902f2c241da712c8a170ab952eb0bd65
3
56
2022-02-03 16:18:55
fc57bf51165176976278e8eaafa8f37d41730636b934d380c0555cf46868653b
4
58
2022-02-03 05:43:08
541be2af880e87ab0b0805073213425d31a178e033e8d5c1b1e25e50850ed14c
2
57
2022-01-30 07:45:03
84c27afdbe7fde42ea4eff8b490a6097703d6750fe3469ce20661527255bc7b5
3
57
2022-01-27 19:28:00
9df0cdb32ffa1a070ea0d7cb289cc32243f7698e512c829cbaffc118fd45e0b2
2
56
2022-01-27 19:13:19
a548c543e0f92be5675165a1560eaff206f21fea61f5eea53d34ec8abebc02e5
4
59
2022-01-27 19:12:10
d4d29131f600dcd3bb68d164289b30f87f243a1e084e43b41af009b9c20782f2
6
55
2022-01-19 01:44:51
19c3d448d4722d571aefc7e5b28186895dd841160abdc095fbbe3e7f6540e0e2
3
56
2022-01-19 01:33:54
b805a92162a0b546aa69be41505e03a52d38a9f897eeacbff05758c88ac1db3c
3
56
2022-01-18 01:53:57
47373f6d212609526cc3dfc925e6eb9017627c6f6cbcc66c7f1dcd1f51859a7a
1
55
2022-01-18 01:51:39
6672f7cf95811cd77e0111133d636487cc362056896ed2fc228895a46e9c5172
1
56
2022-01-18 01:46:52
f8cb3317591afbf18c2e8deba204db733b45129b871883928e0c47accd827ac0
1
56
2022-01-18 01:45:42
f7df67f3c22e2646909b204320169582c3433bacacb17ff015f61522245fe6a5
2
56
2022-01-18 01:43:02
2cba8c3dfb3f7810111518a0209176f515f82d706996c74eb9e4f004cf1c97e1
2
58
2022-01-18 01:16:29
bc904efc99a96ed68d7a79bdb5c37d94b02f3468c6b67090384652a5c5853479
5
55
2022-01-18 00:01:05
7f09ac44fffa15f80f8e8efa5bac8b8534c2edacfa02c4f5226a5036d262921e
1
57
2022-01-17 23:57:48
5a94840068ab1797204931d88ed91ab284f98e58724c880ec35c7387667637af
2
57
2022-01-17 23:06:59
ddf05fdb589ff2efd0c6cceeb2c1fb51352fa027d2d19193c2295a98cd8ca381
3
56
2022-01-17 23:03:31
51103db2b03346470cfed0bd903aa68ce45684a1d9bd8cc6ac918f2f2a7f866c
2
56
2022-01-17 23:01:12
d3160b78b18098c6cc0b149388e3e26c6ef1a0d80d1a4193a3b278eea4dc0d49
3
55
2022-01-17 22:57:35
29e5a7a16c2bace9f64e340e74199d38921f11c0499dd3f5657626f2c2f9703b
3
57
2022-01-12 20:17:06
3c586ef5619735ca6b34ee1354652caa1af3e7d0a755c6e6c5b3e197c2afe65c
4
55
2022-01-12 11:19:14
a052ab790d203dae6685510cf79d71ca6d3e812da95c26f7ad32135fca02d3c2
2
56
2022-01-10 03:13:33
265468475770299c514a5142d5f4e00c7b3e33fa05c86aa3477fb76fc1076d06
2
57
2022-01-10 02:14:33
0b8eab5e0c047efc250c9f6605d6012f83f284a71a91e01c99b33bfcbfeb5bb7
3
57
2022-01-09 02:04:59
e3e4552d50c6ce42db56d8cb46b126e14fc4e7045cca9b2bc5f88076f753de32
2
56
2022-01-09 01:59:24
591a38c43788778a273ee20e386ed03e5001026bc658ce546aeba1a95f645a92
3
57
2022-01-09 01:46:36
8e8590f08c23724ee2331a1e30b29f7b393d0354feef2b13ba831e85c9a1c696
4
57
2022-01-09 01:29:47
af7f569d9f95bb1cd3d501be814b4057873a083a9a7009888b8b66201a837812
1
54
2022-01-04 20:33:22
d4649452d887fd82708844b2b7f185bc5cbc45e8efdd3609cc71f283717e8ea0
2
60
2022-01-04 16:36:41
4c70c09fcd873033c745ec22958a659b10db5a2bb1898a2345eeed0841e7e4c7
44
57
2021-12-28 20:38:06
1e5b575a3d98ab0c5f2c6eb2801a3547261712056bffd8307341f67f1557f329
3
57
2021-12-23 15:53:49
4ead553b7801606f87684438b6bf1cfe3f55d81049d6b85f35bbbfabfda17252
3
56
2021-12-23 14:01:53
136cdc5cf330252f25bcf43bef177c9ab73a761f74b59db47e959af8b8355c42
3
58
2021-12-23 11:26:07
5759d52173f0bcaf84485f331b33f63bc54c8ca3186c543cc5c5e6e546a2eca0
6
57
2021-12-23 10:44:42
ab131edfe643586ea721c43d6753611712ea8e40e0f5a604468dfa658b5dba30
4

Rule Matches per Month (last 24 months)