SUSP_PS1_Loader_Jan22_4

Rule Info

Description
Detects unknown small PowerShell loaders
Reference
Internal Research
Tags
['SCRIPT', 'SUSP', 'T1059_001', 'T1086']
Date
2022-01-03
Required Modules
[]
Rule Hash
3422fb6c2d073d2c1325cefcde8e1f7d
Score
70
Av Ratio
8.1
Name
SUSP_PS1_Loader_Jan22_4
Author
Florian Roth
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
28
Suspicious (< 10 engines)
108
Clean (0 engines)
14

Rule Matches

Total
Timestamp
Hash
Positives
VT
57
2022-05-24 17:48:56
b9ffc6d3e1ec9780a3ce74ec49f99872dacd3240b72dd7d43d9b009855d39d34
2
57
2022-05-24 16:23:48
6426e09a95a9fb297a38a229ccbe984c4f45b66ffc5e00e9b3ac47cafb75d37b
1
57
2022-05-24 14:45:42
ec6b62f292c7ccee7b8b33ed7e2f64c8eb784a03cec529179b723f3202b145c7
0
58
2022-05-24 06:01:38
eefbb490765a9d4390ca87d3c0ed197897a3287fa20e09ad3041c1ba5374af00
1
57
2022-05-24 04:25:42
d1e504f9bb2eca6a9b1ec06503c8948d78bea1f6039a8236a077d5a50e987f21
1
57
2022-05-24 01:57:49
f21f5d479a8f70716d620d55ccf33486cce284809dcca5e4ac6493e0c81234da
1
57
2022-05-21 15:16:28
438a8e11d981105f89572f36a6981b33023a73c4f55d3e1551793405accd9b80
3
57
2022-05-20 05:23:39
bd5bf5e83bd091b2ea15b74efe703e627a25717c0293d00cea8e450145133f5f
3
56
2022-05-19 21:49:52
a3dcf491a0c80314c15b34fa4e48e1a1792521ae03fee479a5bc66c7f9a9f98a
2
57
2022-05-19 05:30:16
d283af10132a3d37063cc38800c9115c14a3ec852cc1450c9844a25e76bcda38
2
58
2022-05-18 21:28:32
99e2669efbee65fa31bd4019eaa55377e6da4d41d9fbbfa167ca76e8d71c52aa
2
56
2022-05-18 00:53:14
699d9e25edc9f5bee8b3d57f7576263f9b3bd40020a28d419d7af7cd21be6d67
3
58
2022-05-17 20:07:43
9900af831254476148a0256b80d9cb71263d77c499bfc2c21fc14eb33fdf449b
3
58
2022-05-17 07:19:00
817cc6d305a8c5dc07120191260e17814c360b1d237cebcac7a0d32ebd3b1fd7
2
48
2022-05-15 08:40:28
af8a8b11e82810e4415895b717e2c784864c46d2ab53dd95f46f8e429be4f6a8
1
57
2022-05-12 20:46:58
c1f4406ead468e9d8eecd58808fe2975646b0ee45188fb1fb01f6d9fb3cf0c68
1
58
2022-05-11 19:07:20
9031c4dc8d9b23f89bec394e7a5388c9871f7a91def28f0633fd51c906845355
1
58
2022-05-05 20:05:28
29a1053a83494fee4185df7456e76ada9aa4b24e0e37497db908c849d45398c2
1
58
2022-05-02 04:10:59
02f051205ca1ba579e8deaeb2fe555138802f018dc4400e5aacfbeed7bd127cf
0
57
2022-04-29 22:39:56
0bfb1aaad8b13dd94195ac990e2d8c0d3c1ad4239a6b1a6e9f00828c8a70d8b0
0
58
2022-04-29 04:24:30
9d16c8266e0747ea3bfedd06505d5aed59f5dda1522d9eea39f4b3447de4ec90
0
58
2022-04-20 17:54:19
aaacac11f52e76042c3c4829ad04ff4a63acb2d39c29ad666981fa1c6d6632ab
1
58
2022-04-13 19:53:30
41424ea2c03a7d0ed7668e6cda8cc957812e7e4600b0e15ca6c928a2fa309fa0
16
68
2022-04-11 21:42:45
763425a5bead8803b4736ab2b36139e9a7ae05600a5410feb080a69ce59c5bc8
13
56
2022-03-21 13:31:02
0cf92a696113fc7ab7989d5f6e44373bfdd33f0d4dbc207a32f44bc11e168e95
0
56
2022-03-16 14:32:33
8d79f7569da076be29102652ef1e177d39404cfe8c7a442f2971d43e77e7a1da
0
54
2022-03-12 21:53:55
697d668038d5f657c3a92c95876df186f77059f38cb447e0d010dc71f1069c5d
2
54
2022-03-11 12:29:39
6e7e6ad62f33683e7a4ad2a4fac2fc28ddeeb0a7fa5ecca1c9454a30b5a152e4
14
55
2022-03-10 01:11:17
78650e1755c18f112b94c0561214a84be2b23982813b9b31e2bfd4e635a859a9
0
55
2022-03-10 00:07:17
c1164c716e5b534a55db1773709a11898bae076f4bd6e66ec064c48086818851
0
56
2022-03-05 01:10:33
52cf804b8fec196de9690321203df5d4c78e19c7a7900fb500ebb4fe508c2592
1
58
2022-03-01 20:35:18
c86b2721c49b1bad6f9ba01186acb034d42b6118dccf5f796271328506585b61
1
58
2022-03-01 16:24:22
a6f2b8aeb04bd97cafdbb51d2f3be72f09a1b3e48927f472a31657f0f9b601ba
2
57
2022-03-01 16:24:22
bf239df827c4ba0a0af0d3a74a053a585bb408d22b7605a59bcfb126b79d856f
2
58
2022-02-26 21:25:58
3e983540982226bf15728d7220c99f84ea7504978c3990c59edf4df98ec2b8a2
1
57
2022-02-23 17:19:43
7b452361567f9fddf109c3d743cc505d2f05b1a470e6fe53951ba3c2be76c069
0
59
2022-02-21 07:00:56
c6526e29ff6209ff5ed6e425158b67697cebf6927623ad934821dd3016e84963
5
58
2022-02-18 21:16:47
690f4dd49fa9b51a70730750dae8cd7b0c124fc2c5ac495d774a414adc6f6471
5
59
2022-02-17 11:31:37
9810d3a7a0f9e70c560d8e4c319a6c442f05474c2778711dce5ee872c560280e
22
57
2022-02-15 00:11:28
a22144bf464b1c63d47998a3f9c2294c0edd7c640b91a4cdba308cc866809712
0
58
2022-02-14 22:10:56
905e02bc0ce389d3bb1e2fdf589f9f6ee67cf217e903fb4312b083e8db372903
2
59
2022-02-14 22:08:36
3b9d6fc6449b7b42e816a19c2b649a5e5cf4e724b2fcd93e56445deca89fb850
5
59
2022-02-14 22:02:53
5dc6b8cc1e9d1ee535752e6c5320280f864ea660b5bf8657f96b8e2b1053c57a
6
59
2022-02-14 21:35:43
4e018b92c8b9d6475475f0da046a541f8a0e7c75041256aee6ef417f3e38e518
10
57
2022-02-14 19:20:09
cefc7ea0534e5ca3892ba2228f9993e1c561df14d44b1c4c49add5729e36e595
1
57
2022-02-14 19:16:34
34cffa6664c92f77ee60749e251a4ed18a15a3f0f61c78bcada9ea86478681e0
6
59
2022-02-14 18:25:21
b5cf3d2594e148c458467c833b0d95976480fb054a7763e1f6dcf4187a61e1be
6
58
2022-02-14 18:25:08
a967a8979d8b5aa1742110daf5275e28dd17d44412048ed2482ac41ef12dd317
2
54
2022-02-14 14:07:42
0c3f881258ef9f1db9a9923945ab07351da8ba1a337aaccbcb6b5bd56ae080b3
6
58
2022-02-14 14:06:50
dfd4ff2a828e1da07b205ff705028a237ac7f2a9b5a5cd71efce998316b3da7c
2
59
2022-02-14 05:18:49
3c1636cf2a4296840d55a8baf9abb56e1c847c5d6e3a7df0d7040050d017e54c
5
59
2022-02-14 05:18:45
efdfd9ccdfb052fd7693403d1e8e085594c1b3b7ed221fd6021f794b5ba752c5
5
59
2022-02-12 19:32:16
f86fdc385ba4467fd27093dfb6a642c705199ac3307d24096d7150fb6a80e8fd
6
55
2022-02-12 19:30:59
9971ee4c59f1838c111cfaa0bc26a6c08b80fd7364c193f6d8dca1a840d37b7f
4
59
2022-02-12 19:30:58
87b7f2c05f3e63821de8ad22ee7ed9ca034cd61332ebae3e1f76af085696d5f8
6
48
2022-02-12 19:01:52
7384900e7bb02b1028d92a145cbe2bdb5e3283336c0e5e6014afcd546b17b985
2
57
2022-02-12 19:00:44
ec9e8cb17c92c4d6175fb3e715f73c4bef833742168451398a99de22f06fb52e
6
50
2022-02-12 18:31:08
4fd01bf61c49579a40efdd86d736930585ab3e79d9085177303ddcff61480e26
2
56
2022-02-12 18:31:06
d147e24e603fb17ce3c6ec839cc8ad07bce06455037cc0e139cc68042153b7a7
4
59
2022-02-12 18:31:05
90313f269f0583fbc179beabae2a48b1b53594f1fb4a27556861d5d82ad722ec
6
52
2022-02-10 22:01:40
fa37bd017b82c1f7c545475f7a0cd786f81bc2cc024da46cbdb4071b22ed4ffb
1
58
2022-02-10 20:30:15
25d167b61eec4d6a356c0ec9f5e6e8ac7917795f6c5b26cecbdf087ec22b8be2
1
58
2022-02-10 11:43:59
a5dd6d95d94f6e2683ad4f5e1f360c56761559a04cd05cba6adf3845ce896a0e
2
58
2022-02-10 09:32:33
0115108056cabb47d332e2e92d5c6c933e4c0346e83bc0defcbc82ac5855911e
2
57
2022-02-10 09:31:30
cb758a93876acd5f7a314fda6ccb97d0fc115abfff7f22637b629b1e91cf1970
1
58
2022-02-10 09:31:30
e6336b793924862add5f264749b24a630c5b4e5057776497a12edc129ff83296
3
57
2022-02-10 09:31:30
d7e76887903ebd361112531017e140d2bfaaa816598c648f3b1238dcc6906bf1
2
56
2022-02-10 09:31:29
51122846a5d98e6a575bad0c0d5d2e8aa5e3bca98a9a28a9695305708ae7c570
2
57
2022-02-10 09:31:29
66006c25d76b4a5329d192572ff8f5757e63c4a2afca75745acfc23df145bf86
2
58
2022-02-10 09:31:28
84794425c6bb551771932dd6c648197eda07b5b76560b1ae26be083192b9bdd5
2
54
2022-02-10 09:31:28
97d7839cadff746a0011ece3f478f25dda8ae7b292870abda1319b13c4ac1b8c
1
58
2022-02-10 09:31:28
612d7741e62a02c0832ff65179427299ba822969755b7a8f296db08af570e076
2
58
2022-02-10 09:31:28
054270623be9f3bafec21a7f3848aad0133107b51a3bd485547e446f22b89d03
2
58
2022-02-10 09:31:28
e23ce72816e54e8a3c9eac06d07d43ec36bb8f487b57a6aacc777b8f7ca06641
1
58
2022-02-10 09:31:27
16b442109de38f7bbbea397ac3f98879cb7538b7de4950e16c274982f67e4878
3
58
2022-02-10 09:31:27
f3d9873ee798bf649a22c50e3daeebadfc127a405c0d8f54266b66c4377901e0
1
58
2022-02-10 09:01:57
6f02cf7b4b2cd24983946833a28c159df4fa92aa6fa516bc6934730029f83759
2
58
2022-02-10 09:01:56
b451936a7f950512bc4f80d931c4f0eecab977ab2f54ac4fdbd4957e4c3b46ad
3
56
2022-02-08 05:08:26
d73d53870da714c48c97a177bb70b5a545b31b0fc031294ccb3c6b2f1c4baf73
2
55
2022-02-06 06:30:56
a5b422d452b22f12046b607c767ec0748a0ee5ada1b27d8f48715a682217784d
1
56
2022-02-03 17:41:06
ef2c5f64ce7d14d9f1d0fb63cd12be0535bd023cf11d3a60f4d104cc71324ba1
3
55
2022-02-03 17:04:57
9c89d7bcb870b9f291fb67f37d83862c6bad0204b0aa6abaa2ab1206ceb2377a
2
57
2022-02-03 10:08:47
72fba8159078e243e7d39eefd3693442b82f5f169a536aa35f921194f1798c80
4
57
2022-02-03 01:02:49
ead0d9dcc7117fcdd75fe0e7fac4dc1c909139ecaec93aad831acea435acfe57
1
57
2022-02-02 12:59:11
a440bd661d5e7969fc3043cf78ab3012c619daf79cd842aa4b66f70d72df69b4
3
58
2022-01-31 14:10:12
bf6a0381e61aeb017231e1c1caf74885b38a851f1ad8a2cacfa5fa6d189937e4
3
56
2022-01-31 10:13:45
192b2e452a607c11cc03795e5cbc701040467502e2b5ad788db2391e124570fb
3
55
2022-01-30 20:02:12
2c55bd045720aae5f2009c7cf4eb9d7b67d3aaa6d0311e5b15bb741bb9c55829
4
58
2022-01-30 16:03:53
2c9b71867ecf7597a5cd218a8c4d49524988f360266a6960d9284ae62e457c99
2
59
2022-01-28 23:54:50
5ade72f9284a16f1ecf30bcc7f5f4b8d4b5a4e7bb85a982125e3b296dd2dbebb
0
53
2022-01-28 06:31:47
c9e661847cab45700215a4ecaa5bdef2592609adfdca238e5ed58d45ccc30d4c
2
59
2022-01-28 06:12:14
abbc5e9a268bc60fd3b44a35fadf665fb5e6c62e10931a8ef396bc9d44e75032
2
57
2022-01-28 05:54:12
80c6bcc34c5ce88a23ce5256405ea9009885b9ee9a2d3b1d09ab83b713aae065
1
60
2022-01-28 05:47:39
ad720e53c8cf4c498396a351c1c77a48d6db43247d181556f7ea857a817532ce
2
60
2022-01-27 17:31:09
07c1c86aaba1043b139f63f76ef2dcbe65b2aa6b7dde7949f63e31b43fdaefbe
16
59
2022-01-27 17:06:42
886095c7861a068d1ee603c71cb161f256941e802e743fe2161f30013947a2f1
15
56
2022-01-27 16:54:44
77316280d31fa2630146b6e7c8f34b432cb36676d861765c0d26e1685ed1c251
13
60
2022-01-27 16:50:49
f98b8200fbe0a4ca31cdb17cd2a3ad5f1bad8732dadb898c33371a08560f4f46
16
57
2022-01-27 16:49:38
b38bd8558166ea05425842dd96125c8bd83ad3619555d12514624457f3afc63c
16
59
2022-01-27 16:38:23
5d1d5622323a0dd010ad6d6640dfff31f6db9b14fc72f031e866eb02c4d67a7d
16
58
2022-01-26 10:20:22
c847bfb153e5d96a8655c4353d65a55590e3dd7cfe750ea671a061bcdeccff9d
16
57
2022-01-26 08:05:40
275e3f8d9e4fc0565706f10900dcddacd4d45bd9d4283a0bc47a5d2ac474ec40
1
57
2022-01-26 01:58:41
37bfabe32cc4b15404ebb182831cb6ed21f80126c0b00e97a196aa8e35535649
2
59
2022-01-25 22:32:19
07fbe1e7d7af4cfed679bbd4ad1b1fab6b6be6ea82b5db5051a31040ccffaeb1
13
59
2022-01-25 22:31:11
173417b3bbb820fdc97cbceadb6c9d6ca3104e9b4cbd9c67b6f60b46c69f8279
15
58
2022-01-25 22:31:11
901a5336104dd1b5abf518e743c4fb0d5119d6c6d6aab15383398ba567546da0
13
59
2022-01-25 22:31:11
d9fd3507c0e6f75f739602a4f1933f7a137533d3975a647a83cab600281a0285
14
55
2022-01-25 22:31:11
7ce91e603f707c8594482eb7d8e0bf72fadba7d6197c38392a8822ceb82b8d5a
13
58
2022-01-25 22:31:11
8a290d6b06bac10a527cbdcb1d59933e3a2514321b99758da58b3dec09debd8b
13
58
2022-01-25 22:31:09
53a551ab03eeece9e370b2fa56f2fda943605f339dfc1c0329a84b8337fd49ef
13
56
2022-01-25 22:31:09
ea213f5e8baf0e0dd837f4f97295f3ae95349c8381fd56e73bc93a98c7f97cdd
12
59
2022-01-25 22:31:08
757bb7e60895313dbb8f4b5b317f0ef1686844630787c6cd115ad36f19ab7611
14
57
2022-01-25 17:00:46
f20489a8761d0ac5fa584e1b98740298768612e24288aa571ebb7a8aef19bf12
13
52
2022-01-24 18:31:44
56f2164451aeab2bcbc9cad4d51842180b02f5ea1e47e92171e92c14500cc15f
9
58
2022-01-24 04:28:54
d2165c3e9ed3b336ed581c122b29446da7353b5f9030de584b9e1d09d0d418b1
0
57
2022-01-23 19:01:56
4edc370810e6ea2b520b4edf6646188e4cbcfe17ee44e32f02bb64ba89532c2c
6
56
2022-01-23 12:47:15
6ec89a60a63b6baa67f8e69125a29856542db8fb30d432d110cde9ccf4618bc1
12
56
2022-01-22 05:15:39
4e35cc98dfe4b0dbe54952d3a204c56fd28bcbb9e407275bcc0e9d769b7e1f87
1
57
2022-01-22 02:32:45
319a4fd244cee42ac2ab12b777565895737dd080fb299f0fcd991b10a8a4d840
12
58
2022-01-22 02:32:45
9ab45791580b646e7e5504c6c82f5dbf2cd9781bfdadddbc23bad5a7c72d9123
12
59
2022-01-21 21:19:51
bed82258e92eab0e79aaed54e4d61eec5fe0b198538d74b269a660b5ef037ba7
11
56
2022-01-21 12:06:58
f336327e4dbb0c1f764d3a92e479be82b327560766bf8283f5b7121cc4cd1bce
3
57
2022-01-21 04:43:59
a65ad7407a28b50fb7d1348f980b3d65c2cca3f6722995ab57a7de8655b16941
1
56
2022-01-20 19:42:40
a3046785a2f0f8440e254e3ed99a9b5afbeaa7c4472a36e30e30c9a15ee3f44a
19
58
2022-01-20 16:29:18
5e0e3f3b70f875424e4e07e43dea56697174e5e8063d49152682d36d9dc35ca2
8
55
2022-01-20 16:25:07
a1ea8b50509d620eb3334915f282d9415dfcdd06b050101ba7ba7637624c858c
7
56
2022-01-20 13:42:15
80e37211f88f53b6438b9368f1d03b8c972b5f98f6fa2803d25bd29bfa32feac
2
57
2022-01-20 08:14:52
2913e2811a4e6c1d643e1351cf3ec8f221231895393a15fe95907576ccc9b0ad
1
57
2022-01-19 20:06:29
88f5a98690c02dc6ccf9c187dffd1a8750e04250d8c7be638d897337cebdfdf7
3
58
2022-01-19 05:58:08
5922967633befa89fbd10e877c55860909eb9e85b4f484a34ef9c049c5e42090
1
58
2022-01-19 05:10:53
706e387a873517d96c7017ffdf2edeccd79920ddb3440b1ff11993ab0e57825d
1
58
2022-01-18 19:12:06
fcc9e0a7f9f3f7f6f83061bc9b94cff34f35e91b1cbfa361ad017f5ac77b766a
2
58
2022-01-18 19:12:05
582c452d31a7daa818850042a23cbceeec515f2bb4e939eece7d32e650be235a
2
57
2022-01-18 19:12:04
d52052c9c6e9a8d50f81ce327e9ccb60be3c089dd8c3701ef453f53c85238749
1
59
2022-01-18 06:13:47
049a208caba9401b95cc96b5a458242f7a691da28fc5cfe9a14e5bc7a1de4b4b
7
50
2022-01-18 04:08:58
0cc727a84937a44326efe4f95bfa246ed59e31f0732be01b798d198cf7a0533a
1
54
2022-01-17 22:00:48
1848cf674976a5a5faacfe026c6a28e1e67daf7599ee7bd1a3cfb180586a2788
6
43
2022-01-17 13:23:30
25d248cdc2d7713148a26249fb4d3376b343175dabbe7b36768fadc7fb4de6b1
0
55
2022-01-17 11:34:33
5cd1bc35948599132c861d4d0fbce6ded637d44a700c12bd75330a801b185add
1
56
2022-01-17 03:04:33
6f0cac35c136c2314edab288919c4b4fb37b0d3e9dd4e118925864eb0d2927aa
1
56
2022-01-16 01:17:02
326ae15b250317bea12994e65a18e2da83ec0004e5a1cc66711bf6cb87c4d501
5
58
2022-01-15 15:24:15
c5fab19d0610b70ed759c46d05ae92f4628b569a888c2171d7781fc9ef694afa
5
58
2022-01-15 15:20:42
2bf3c0f7eac3aa5fd15f219ab03da6c83b3ab248b70c96d8e7860769c21cade4
4
58
2022-01-15 15:20:31
8d74053873907184a0e642c1072536d1248b101781331b232c5fc28ee5799166
4
57
2022-01-15 15:18:00
81b57ca838514ac8c40773b6daf329033a2e5cdac608d67077486b54cce2f1cd
4
56
2022-01-08 01:12:54
8971a905a584aa91630827dbee5d67583d32f5e2d66dad473e798bbce7cd8601
21
58
2022-01-07 14:20:01
bb7f38dffb68e4c24fc807f4c483133921b1d7200cea4071097c7eaf4d9aabe4
3
54
2022-01-07 06:54:49
36b30484659c0db06cf2fc8261fcdc021d61a29b29105fce9413c1c0b28bcc3b
1
58
2022-01-07 02:11:34
ca9bf38d7f5c2a9390b29b7f5063c4962424126e18edb420da0b38ade25542ef
3
57
2022-01-04 17:56:38
fc3e27808321267151f3717afb9dd0356fef77cbbfe00db270d641c80c24018d
0

Rule Matches per Month (last 24 months)