SUSP_PS1_Kernel32_User32_Imports_May21_1

Rule Info

Rule Hash
776a067cef82258f1f5ba5629bd0511b
Score
70
Required Modules
[]
Minimum Yara
1.7
Av Ratio
15.48
Description
Detects PowerShell scripts with import statements from Kernel32 and User32
Author
Florian Roth
Name
SUSP_PS1_Kernel32_User32_Imports_May21_1
Tags
['SUSP', 'T1059_001', 'T1086']
Date
2021-05-01

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
39
Suspicious (< 10 engines)
51
Clean (0 engines)
24

Rule Matches

Total
Hash
Timestamp
Positives
VT
68
48d5d62c9454c4c224ae77b74fe1769d7b8aebcc5cd382e05332b6384522147d
2021-08-01 03:07:43
3
69
efd7823197d9ef1caf072285a5580ec7c7e73cd906229bdaa259b6ad5b928a3a
2021-08-01 00:15:43
3
68
eb0c34e4860b696a6c8ee2040aece95083f04ddfd23de520ac3b23c93867adcf
2021-07-31 02:39:56
40
68
54a5783447594f309dd572733331d4aa37cecfe3e40f954ba30469ea4c1a3415
2021-07-30 21:35:31
0
58
1e9cc617909ca1efd53f7f6dace9a60551b4b0dce0661e9b9b760d634af9e5cb
2021-07-30 10:54:15
1
57
35ec95ef94a553b1f4d0074382cd478dafbdcce762bf459a1ebf370944f2417e
2021-07-30 08:42:43
0
69
96e8aae8a491f7fac5e52ed356beff077c9e53c346632850bdc5b2cd2401aa52
2021-07-30 05:23:33
6
70
7e58e0627e7359aaf2dcae8bcc821a83c97c7c560c539c1c8f186bdff67d6bfb
2021-07-30 03:55:40
48
58
8ae31e781602562fa1d580f8140b9c52696b804a3067e67bd2c430c8f9d048c1
2021-07-29 23:51:22
16
58
7b6cfb90c8d35d093d5f2597f9eb991912ab21be6498cf2e82a7f8734b79c413
2021-07-29 15:30:55
11
60
a03a25e055f13e64e6835ad959e2fbae565dedeff9451d58ac13d814f25189b4
2021-07-29 15:07:06
11
60
445351be08f31abb44a91dda2a7072c653faa096da95eb839538c2c7b02fbb05
2021-07-29 14:48:53
11
68
a8144ed79e6f98c4970aae14eadec6f45ac2cf0d5eed8c1e0cee68dd54eadc78
2021-07-28 14:40:42
0
65
e8e719c314ca83bf0f4c3c63aac0034804cc64d88b30224fa0b9ec92ca9e58e5
2021-07-28 02:21:57
5
69
05b3d733cab26afc77c432068bf560eb3c84063e628434e66c920b0b2495e5f9
2021-07-28 01:15:19
47
68
54799a5179bf371e27e24466afde03110b256c4fa412cced24c40ec29e5e96a2
2021-07-27 21:03:11
2
69
d754285f59798529abe846c825c4f14b226c79cc5a8e10d68fb497c796fd2800
2021-07-27 20:21:19
1
58
42676b945817f1b029cfea16c8426049d7be1f89eb73ed841185ad5c26c14362
2021-07-27 18:40:36
0
51
2d66ad50bdbe759adf78a4f7de6f39c4d98b49ad83083eae1ea95130affa9ac4
2021-07-27 09:59:32
0
68
912d39a684a165e12f313c6af9ca8cf467ac769d2105f5d317db7e357750ddeb
2021-07-26 19:19:51
1
58
0ca85260b39f183943585b990fd680e6c704b56352caa7178c794e2b6405d33c
2021-07-26 19:19:51
0
68
9d4e75a53fde162f99b1702ab442b4cd3a9790f6f535bb0c8d496244245da5ac
2021-07-26 17:50:54
0
69
ba126faa527376e7d53e805a17e25cfa4a8d63462a1a596cc36b133f47c65741
2021-07-26 07:12:28
1
69
ff24cc07f83d3126344e43723fe15dd19c24cff7f5cab5f3d09b6a54295c89d8
2021-07-25 02:37:31
1
57
5d0f5113c433761dcdfff97781878d4cc3796623175db1fe34a9ee64a7054c0c
2021-07-25 00:44:32
1
69
1da246dc03931002ba4bb514df30cd76e0331609a55eae8a6efb4ce7d4f1e82f
2021-07-24 20:53:56
3
58
f8b6a7872b0fc51dd5ebba2c3a86b620a3a0367708a6e7fbaacdd1c5cef4e771
2021-07-24 11:19:31
0
61
b29c1453bae7f5262a8410743d360b3549240197a6ae5d8c2d11a3da6bbfaf8e
2021-07-24 02:51:35
19
68
32549e67e7c1afd5539080f6ac5cf5930607cd27e7fb4d2cbf9c984be5980084
2021-07-23 21:09:47
3
65
fb3526c2ad00a20d14614d2563dbc9ab394114b5866c24b54668eb040491e445
2021-07-23 18:54:13
6
69
334d7c7ac1e63440b3ab9f57d94f0040ad9e507ea701f6c84159089eca050ba8
2021-07-21 00:15:48
9
59
779c66ca33d8c71261c7c90b8ef916bea5533756fbaa45a8c29927de2946271a
2021-07-19 14:34:00
21
68
daca09f29449acd672af22c8f46a03b97c0d1c463fb53c151d5219d47506bd5f
2021-07-18 19:14:47
14
58
230c23b5d2d1d543f29e8aae63818c22764423369d301d6910dd6a1a504efd0a
2021-07-18 14:50:24
0
67
2dd69e7ee543e4a37a0a57e235ce0bcddb22a32957259531f59adc9cefb96c65
2021-07-18 02:26:22
2
58
a1c477bb5e590b19172ea2c0a79f19bef3b12aa3c56876d09024eb34df7bc709
2021-07-18 01:50:43
0
68
e857057e245232e671365d6a53f90d299baf1d4341a7de12686bbb680844c05a
2021-07-17 22:43:02
60
68
8efcef441a7eafce93c4c07c79de1032d79120f19c0560cb886cdd07b7cd294d
2021-07-17 22:43:02
10
68
f0ef6572ddd36b59a486d1f5eb9eda44d42418a13702ba1616ebb29c8c9811e4
2021-07-15 18:40:57
4
67
0b92e38ab67163fd650690d9345635810e760da4c58db8a57a777a78cbd1db33
2021-07-13 23:58:26
12
68
7b79ff226ba2c08af90918c218acd5c00497fd46f8b6aaacb139d47ea98daffa
2021-07-12 18:30:06
2
58
f2e19b4d41078397221d4eb6d5f84cc3730f32f3a9a436a032dfb7e07cd70057
2021-07-10 12:08:25
1
69
a4e269dba2a0ac1b7f85ed50595656dc5173d99a992c558a7fa4f3452fc8fba3
2021-07-08 10:23:24
46
68
5be1d5cc91d8df01994beccdd5117ab67f26b6be2a08ee93817746a764282e0d
2021-07-07 21:09:39
2
54
00e51d09a6c66ecfcd04546dc46f1764da92c47fdd66f40fc90da196f7ef6960
2021-07-05 10:35:33
12
58
694baa994e5983ea423ed59ed7e3758892bfe0549f29fcb039795115d8037d03
2021-07-04 05:44:50
1
69
e95b9815472943f82df3ba63b99f97626ec263aeb2dc358a9e91593b6e3a0bb6
2021-07-04 02:29:10
2
69
e66056a2b68e72b7836417e59f2e6f196076ce4b6280f0144cb97d7f7a155b75
2021-07-02 05:06:53
21
69
e4eaeabb008b5b73a905cc633eecca6174cd05c3696ab91dc6366bce4aa4e364
2021-07-01 02:33:37
2
69
998caa7ac93822d05b6cc3a9988ab64ff12417e4d98dd30ac869f1545de0e3f8
2021-06-30 19:22:03
2
69
8a56627b0024cdc147b0ea8d2dfcc52d2b596eeac8fe64d3409ddb64cc7d032b
2021-06-23 13:28:18
29
68
92eafa12ea1b42d4e1e25461e38328f342bcf1d53579a526996055ab917d3398
2021-06-19 11:53:22
24
68
8240c930943b70481883cc80706c36459ad9c62e1a894bc4ea1cc304231f206a
2021-06-17 20:18:58
7
69
43277d6a8f3e6a9b4e2f221e700b49111964787f5f58d26234bb1656aa93d2fe
2021-06-14 11:28:06
2
58
9882c2f5a95d7680626470f6c0d3609c7590eb552065f81ab41ffe074ea74e82
2021-06-14 10:04:27
33
58
4f3d2d77f75034ddbecdd9cd62f17077ad3bf7173522baf7cae1d3fe68c6e494
2021-06-09 23:18:16
0
46
475d52d10010c34d6f66a64c9c44210207086cb39f32a3649d0e0fe40fe94e42
2021-06-07 22:06:42
0
69
7861e5a411a2ac717c812c2d440f23b37b2acb1c53f125a67826322992e48d09
2021-06-03 23:08:21
4
70
021db9f7692460bd8af8f591988cec6f568435d6b92f0f087dbb5b8b39effc5d
2021-06-02 18:13:38
6
69
1baf3121fc4d2a5a69fa75fa9d88f94e67c254779c9b6c6011841343a61524b6
2021-06-01 14:55:09
2
69
96b3df9bef81e4b98e1adb966c6b6a1ff2fb17b997278b573de391ad8863cf87
2021-05-25 09:59:41
1
69
573f90ea19520e1d99ee82005430c7a7270da4e8da6d6d31ff5f883569378de5
2021-05-25 06:11:17
51
69
34e83330f213421ddc57f567ff5883a879768d790c3aa190edeee92337e33f55
2021-05-24 06:14:15
23
58
0f6d1e751fac694532fe94e4b2467d3e886a5eddb2e498386f62c1fe2a6d1639
2021-05-22 20:38:10
3
58
c0911d21d20b7ec4c9d6a190444a7db9f39134c4e3ac6d69fc6e348698617811
2021-05-21 20:06:40
0
68
c137f444d038ce7c52c798e6327f4edd4a6a7c36d01d37f9be723ac09adc51c7
2021-05-21 19:07:55
2
66
51c3dd30ed05c886fe445b054240e2befded428fd1f2c3d4aa794abbc7f82e75
2021-05-21 17:14:32
3
58
26dd8b1277d1618d5c405d7c218c19ae8c125c80cb8a6b782b7470f634aff1a2
2021-05-21 15:56:07
0
58
c95eab2dcf8e5ff703fc2ebeaf9004a36b5d54af2f280ce932a7100fdea9ca64
2021-05-21 15:50:25
0
68
41648a56a6d322877161186203f9254bbb6bdc03b4c2da2562923e392c040b97
2021-05-21 07:25:59
2
69
3492bde1a2260e26564f4eae1cd28c1aed3b45e02343380dbe1411f6b01752fa
2021-05-21 01:18:25
20
65
e0b2b1e262456b2a4a30dece10f38d6c1a2ad0fade1c6f513d418dc6e3fccdc7
2021-05-19 10:42:42
23
69
20f7caf17b3a7d46e78b5d12a9c3972386af6ca450f92c38b1e9cbb8367bf0d5
2021-05-15 19:57:05
3
57
4b8552f5a29fc065eefce3a1b27319db5a395753ccf287feb3f0d04665d5f09c
2021-05-15 09:17:47
5
56
6b3123769eddccc90d9bc08640aea942fd414dd919ffc747a7380e496116f813
2021-05-15 03:38:01
4
58
361a286eb219f4c6805632922dd676cb36c71b1fc92d7975f3b5af1c7ff6aae8
2021-05-15 03:36:55
6
58
b8f4f19c516fe1a383c2d6518ef70766ff87d4ed7755fa93688b3bd3d7453fbb
2021-05-14 06:10:54
1
68
458c81ca90339f45d1ba91309d56fffc8f1f885d18fc568b37132d1f47941353
2021-05-14 06:02:01
0
56
759b227259adf08c2ebe250c823963b14a98dd1f17065da47d7ccb7c9c7d5b60
2021-05-13 22:53:29
0
57
4e075115d6bee8e355eece712835c186feb356edab26f5669d42e9c10e575026
2021-05-13 22:51:47
3
68
55193f74d8e0fe51b70558f9c19e235a9403f2a9b34c3f545b9aed6faa79520c
2021-05-11 12:02:59
2
68
58c542b1b6d1c040a5bd3c9e11b85882f70d2c8838b08c308dc858d60c1bd260
2021-05-11 10:30:51
17
58
a3320ee6685ad7ff4146fb878bf6c549fc0c9f697a1cb40980e797291ed0dd26
2021-05-09 15:35:57
0
57
1678d28b63778863b799b8a325ad9d29fbdfe55e9b206e43dcd4aba2b4ba9316
2021-05-09 11:56:28
1
70
a0feaee8bc09ac350e3cce150902494660820661cba3ab785e5261efe8979bfd
2021-05-08 12:41:01
19
69
4694d202768cb15d685eebefa20454b2725ec8c91717991e05512ca5eda34cb7
2021-05-08 06:19:07
3
63
79840e829755e9f6b981b4c6a5860a242741ba49a3bbc0c3cb9f36f6bd658564
2021-05-06 17:11:16
0
59
3b90d9fad35a45a738c6b2830896168c99014474de17984411be61b25acf6db5
2021-05-06 06:31:28
22
69
0ad5d6b7391b9bd554ea4cd3aae633aa8b744080926b5fe6022a4b1a65b59625
2021-05-06 02:14:32
3
70
dae04677e464f4e4cc317e369380d2ff1be7c2819b83ed0ad04b4c9489af381c
2021-05-05 20:44:11
56
58
b1bf5f57b55d5ced9792b4008585154da13680a41d0560f9eec6044f53c08f43
2021-05-05 18:46:47
0
59
3090bff3d16b0b150444c3bfb196229ba0ab0b6b826fa306803de0192beddb80
2021-05-05 17:35:08
32
47
366d312ccd2ab794befa803ab9fafc82e7ed836d02733675d55ccebcdd553f4d
2021-05-05 10:09:17
0
69
0578f9b33b181ce8dfd3e6ead55390cdd3174500b222cbe1f1076852ad075004
2021-05-05 08:42:54
21
58
1add6961b9d564ddeba706cda196780471850b8aa79fdabe25e08961b41d913c
2021-05-05 05:49:48
0
70
2df4130e9bf502f609c43883945e863dc78c679e2b237f7909570e370b21e8c6
2021-05-04 20:29:02
30
58
1201874c48f0efe30b745a747a4fe5140a2f8453bfb378800db9b8af6d72616f
2021-05-04 02:45:18
3
58
3f6ce5d8c43649a6698fed91ca52bc409218e6118d1843de9f40c83957bd6af9
2021-05-03 14:55:48
0
56
7cae410d16d9315655f8a2e64458f5bf9a5224d9c4e3743cf31c180d304c8473
2021-05-03 09:45:28
9
59
ae2d3a638b12e97d4a8e54fb5770fad51103d38d6faf645cf7c479d687bd5205
2021-05-03 09:36:00
22
58
13e493c48958a00f2eda0422c719b8f271cfbc8c14d66c642fa2f6f42928bed4
2021-05-03 09:36:00
21
59
6abed03c2454050e1095f6db954fb2a40ba5af0736e5bf31bf9db36df149fd2e
2021-05-03 09:33:49
10
59
63ba6db8c81c60dd9f1a0c7c4a4c51e2e56883f063509ed7b543ad7651fd8806
2021-05-03 09:33:39
28
59
4aa0985ccd4389eef5f3d6d9607ce27b0659aa0e839d1e7a0dc6f1a7ebe31878
2021-05-03 09:33:38
10
59
b41a303a4caa71fa260dd601a796033d8bfebcaa6bd9dfd7ad956fac5229a735
2021-05-03 09:33:30
27
59
3f77e49bba22d8df168f774239c523979a3d8e353f2838d97d7db2dc1166d00c
2021-05-03 09:32:00
21
67
aac91334192c8061bd78cc284e8f3c99630c02edcef602273eb2d2e188ace639
2021-05-03 02:40:14
16
67
6f5171b8a48fba28402572201c6446c37307b743fc9a99996f720e44aeb12179
2021-05-03 02:30:59
7
68
991ad413f989a06b4e325c576e5798f750f04fed699203f248c24b5c5f8e1949
2021-05-02 07:18:38
4
57
6a90dbbdbe704227522686682d3bdedc71cee27e8e93c4a4dfe985236ff59308
2021-05-02 04:57:16
0
54
abbe770ced0447a8677afc64040c77e103c8297ab7e34877d48e14a779e6082e
2021-05-01 18:22:52
9
57
cf416c1893098fcb4a3572c9575a43d53ef3657bf48a597174ac2283fbcb0f4c
2021-05-01 18:20:44
24
56
a0fee7fc0bdb2add07ca443b69b84d35d8701af65b95d0bc04da502bea1a88b6
2021-05-01 15:46:59
2
55
7e831b7dacd1ab6b30d852c548b61f7a639a90484071a615cdb6b0aa1dc5f5b3
2021-05-01 12:45:27
1

Rule Matches per Month (last 24 months)