SUSP_PS1_OBFUSC_Jan22_1

Rule Info

Description
Detects suspicious PowerShell obfuscation noticed in malicious scripts
Tags
['SCRIPT', 'T1027', 'SUSP', 'T1086', 'OBFUS', 'T1059_001']
Date
2022-01-19
Required Modules
[]
Rule Hash
f86ac1d2151d78afc0f98bfce443bb31
Score
65
Av Ratio
9.2
Name
SUSP_PS1_OBFUSC_Jan22_1
Author
Florian Roth
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
22
Suspicious (< 10 engines)
56
Clean (0 engines)
18

Rule Matches

Total
Timestamp
Hash
Positives
VT
59
2022-05-02 23:54:56
f17e806224cf64206ee28d0a1cbd10fa2c6d8e963062f55673dd5f98bfe06494
18
59
2022-04-06 00:22:03
edf04bbd6dc4d9f3dc84d829fb7623b0172235e50631610b1f742d7a348cc133
17
57
2022-03-30 22:26:43
81c9ee2eb3ad8fcbb954cc40080e29598e30fc0794d9a32b7e546870dddb2047
12
55
2022-03-20 14:41:45
3f000d0d1773e02314cf3e1817bdc59c5158d2d1faef3633e4f8bfdd5f3b176a
0
56
2022-03-20 14:41:44
05defc7876827cdd02d90600350f03b8f9fbf092a961624eaea71b0127dbcca9
0
58
2022-02-26 11:56:44
ba28fccdc40b91b669073ba51d0701769aafcab77065c3c2fd3f0cc41741a239
9
52
2022-02-23 13:33:50
a001239c01c244fdbc243c4113c86067138d6ff62b3f28e0b63b69aaba916179
1
60
2022-02-23 09:45:57
e4e95269b819e57939176796a2942c4eda1edb9f42331a41601359332f9977c5
15
59
2022-02-22 17:19:36
623370c62b36a14b166fae3d646b2278e4be5ad04146c07041561c2c9d1fbd5c
7
59
2022-02-21 23:20:03
76fa4c7887b84dff00b3c1890832f200017d0517a406619fa905aab9e77d319a
7
58
2022-02-21 20:37:06
7bdc94417c123afdf60f97d0aac69c24e50c5b0c218e81afb353ed4b14310e93
16
60
2022-02-21 14:05:56
d2537eac1ae5c46942d2202056d63c1094da4d0be35460e1d6ce0b6dc7aac5dc
14
59
2022-02-21 03:39:12
7588b35ca743821c64ffecb343f5b663b95a56c1a71200fc7777ee2e4edcaf1b
9
59
2022-02-17 17:12:17
98b68fd3207abca9b6195c98b4f4a515fa821c84c83edd3d38a828545684716e
7
59
2022-02-17 04:09:39
947f696a6a356810aa4843bbd616cb3efa88c74d1332fb60fd944ba607ebe280
4
59
2022-02-15 09:12:36
57a4fe17688c25876d347f6422fb0ab12f515f546f08551896d6c096c292d2c8
10
59
2022-02-15 04:49:42
a3e515436fab8ad0f408f2bf5c9eca9b2a0e999db343db9e77a33b2e832a828e
9
58
2022-02-15 04:49:36
7230ae58075c77fc291c49b770c40e74faef3c5b5cbd20f23c0fb9b203f25064
4
58
2022-02-15 04:30:59
a1ec9dbe2ecb8605adb1d74ecc4a361e2f375b7bc927ab11374fe12e198132a4
3
58
2022-02-12 02:36:57
ef0a46ada97bf8dae50a8ac0dbf4e935b92bb40c3f051912e0e9caa7198598a7
9
59
2022-02-11 18:11:53
46bb0baf703fd98408af22a2c0e1435fd815197542a80dda7b9fa5052dd80f9b
2
58
2022-02-11 16:35:40
155e0905edad19ce2003aca02317f90d0f1f2c5c8442e9173cd6c6e6c1128990
5
59
2022-02-11 13:39:06
dba78036e778d103a14d4565f019a99a3c95ef8d9c2c5ad87474414603a9c9da
7
57
2022-02-11 08:20:10
9ed33fca9e7760da72d1dde8dfef36c20c9c774fec1e88a6edfbe956f9ba9973
0
54
2022-02-11 05:38:51
b83a50666796620d74b5b50fbbd40704468fc8295c5d0747927a9859dd6a463a
3
57
2022-02-10 23:58:02
4d53dde5bc1a4b6adb0e92c18f4b2623acd864fd57572186fdd90b6e514b7bb5
9
59
2022-02-10 23:03:10
a9afdebf1cff70ba85167945fcef53eac7ff0b9acdc90fdcb89f77d5a4aea440
6
58
2022-02-10 21:20:03
374823f3aa8416b009523502b6a7ca40f95e786e659c6821705b9553761d65e2
0
58
2022-02-10 21:10:50
507c6d13d940584429c2f55b2e5ba4a01c4a964abac41c704ed3b80821ff6f52
1
59
2022-02-10 20:06:41
d1a3d1aed3406a863a23b4f3449d4f4902dfcb32af3cc0d7474c43df1cce183b
5
58
2022-02-10 20:00:03
4e754baebee1544d1cb5173dc749c97bff56f82c5e6467d454080df1a28a3a44
5
59
2022-02-10 19:57:30
d074c74b09cb7d64c8647b8da0adeea4293db6abd5d0ae4202cef511252acf1b
5
58
2022-02-10 01:16:44
c1f70eea3a5666816e6c4010beef0851c65a9d7158ba396bcc06aeed2b56926c
10
59
2022-02-09 23:09:31
dfd2ff29596fa87ae4b2e1fb73b7bad9e2493b6a194e785cf5df695668a0e3f7
5
57
2022-02-09 20:21:28
9267666d38d5436a09508310df9a9c3433b7cc83e9180b2a8d972b5187030b31
8
55
2022-02-08 20:33:55
36516c3e1bbbfb93db92febec17754377857eb1993cecd984e5746620947c71b
3
59
2022-02-08 20:31:36
899d4167e666323134f9c41b688f6e75daacac3de5ea1bd3cdc555a33038c6e9
3
57
2022-02-08 04:09:37
63203d5fa490ac4467049929bfce158a940cf325c09231c0db88a836ddb3ffd5
9
59
2022-02-08 04:07:20
178292fc5dcaea738366c3d478ff5247b5f1e1797e5d125c6d082c6748a2dc77
3
54
2022-02-02 19:38:27
ef8b95aa2cb22b647748c650221dd0ec2feeb7bd14624b1b4e5c2f24463ca3fe
2
57
2022-02-02 19:35:58
b4e361bfb6567b29b468a1cfc3e778b5aa9b390cd2cb38a1995d1c9d1d82c526
2
57
2022-02-02 19:33:19
8655ed4b79c8896531fa9b019942bcae76f86e6abb1a97f74cdb44c5c3a71991
2
58
2022-02-02 05:38:15
7f9061c47c388819b1f4c650b02a5f6e70a22ee4f8b5b31b9bae7e200d083a76
0
55
2022-02-02 04:05:33
845f4287e10379bf26be297b131db8a712bb4e32aa7c8a1b450911c131572fb1
1
56
2022-02-01 20:29:54
3351212f7922d66eec579b27457100399ff63440ac7e1103f3640db7a3c6d9bd
1
55
2022-02-01 20:29:50
2e559c979bc024a58ae9c286285ec0192e8f31bb764cd217659d3e7555f06f82
1
57
2022-02-01 18:48:45
c244b75e31318410871fced0877e4472f2cd4d1ea5e12e72b8dc13d441e4a1ec
0
57
2022-02-01 18:48:18
6073be941427080d2856e4c5ec93fa5603889dfc7e0a59c71ba5dfac38414dfb
0
58
2022-02-01 10:12:24
38533ea492685b868e5519ddd60336e32efb62317db0b348fbf52013eb7864f0
1
57
2022-02-01 10:09:51
ffd57cebb3c4f17db05dfbf01222f56e40f640262a5495636b871f45ad4497a2
1
58
2022-01-29 09:44:54
daf363c053bd2a28c9b71dc9ea380b3d8f64f5d0688456e91fe7ffec2e02403f
1
57
2022-01-29 09:43:48
ed9bfd2ed430642585f273cd89a9b77a399fbc3888406a84262da3f4d09a5268
11
57
2022-01-27 17:32:23
9cbeee34a2f049066ef0e2a42a3bdad6c6f5f1c1cedc25d6f40441355379930e
3
58
2022-01-27 17:06:29
6191a1c03ed4088ac490ebe34574eb961b008d7565aefeb795c43acddbad64fa
3
55
2022-01-27 16:54:42
a523c46db79be3881d0f7040a14e03ceac28c691e18ca50d2c7601d0e406f316
3
57
2022-01-27 16:53:32
6df0b4975a8c4ef26f9269fea636933db9775bd282a92f71334855dd7b6625c6
3
58
2022-01-27 16:50:52
66b962b00b236eddbe7af1e380232c4d3b88cb126a6b8d41670e253433da5595
4
57
2022-01-27 16:50:52
72245cc7636146b034ec07adca2157d3200188282144c61813209e526acba566
2
58
2022-01-27 16:38:25
42d68d6fdc19bdc8f85f9a2a22ae454c139811e81bcb66add1ace7a0e09c88b4
3
57
2022-01-27 16:38:25
3ab47fc4a23219081ca4450c531248a3ee4d471d5dd91d69f305ff7dd1905322
4
56
2022-01-26 10:20:22
41e9c52160ca7421bdd1e34a2bf8086599250cb6623f3d8cf2d242405bddb242
2
59
2022-01-25 22:32:19
07fbe1e7d7af4cfed679bbd4ad1b1fab6b6be6ea82b5db5051a31040ccffaeb1
13
55
2022-01-25 22:31:11
7ce91e603f707c8594482eb7d8e0bf72fadba7d6197c38392a8822ceb82b8d5a
13
59
2022-01-25 22:31:11
d9fd3507c0e6f75f739602a4f1933f7a137533d3975a647a83cab600281a0285
14
58
2022-01-25 22:31:11
8a290d6b06bac10a527cbdcb1d59933e3a2514321b99758da58b3dec09debd8b
13
59
2022-01-25 22:31:10
173417b3bbb820fdc97cbceadb6c9d6ca3104e9b4cbd9c67b6f60b46c69f8279
15
58
2022-01-25 22:31:10
901a5336104dd1b5abf518e743c4fb0d5119d6c6d6aab15383398ba567546da0
13
58
2022-01-25 22:31:09
53a551ab03eeece9e370b2fa56f2fda943605f339dfc1c0329a84b8337fd49ef
13
56
2022-01-25 22:31:09
ea213f5e8baf0e0dd837f4f97295f3ae95349c8381fd56e73bc93a98c7f97cdd
12
56
2022-01-25 22:31:09
f47675fec722222a8b8641a7828387f773d1e8034bfa9a95e0b338a0489a5734
1
56
2022-01-25 22:31:09
bbe62e5998b2561d14468cfe1ef242dcfb69d4c22f8c8c9361e0966f6f70cf4a
1
54
2022-01-25 22:31:09
afdab5ddd84a71c44010721ce58354bf9f45808189fa5f4dfebfc701960e752e
0
59
2022-01-25 22:31:08
757bb7e60895313dbb8f4b5b317f0ef1686844630787c6cd115ad36f19ab7611
14
57
2022-01-25 22:31:07
9efbba996baf44ad3cb2136aa54e6d7ec8a718c50f329192507ee129f607b7fb
0
57
2022-01-25 22:31:07
cbeb3ed413d57183038ac35b8cb83eaf98d0beae4f94c418267dcfde2b111930
1
57
2022-01-25 22:31:07
b3a98545fb97fb6cacb3baf0bc5bf4308690b9c95962c50536771a0fe9ec4efe
1
57
2022-01-25 22:31:06
a3b88221235d1ebfbf4ddb55446628421064b7361c57f8f579e955580d00bffc
0
57
2022-01-25 17:00:46
f20489a8761d0ac5fa584e1b98740298768612e24288aa571ebb7a8aef19bf12
13
57
2022-01-25 14:45:21
1d44072acced8f1f9dc28b5cdf7befab3dc925440666ad0641db7c7ab0f8538c
0
56
2022-01-24 18:31:50
a5eb0c0dc648cfad3ff9f13c44bdc07a8e1e88646e69d95f6b6b8795a610d85d
3
56
2022-01-23 12:46:09
67a0adf89a91863029f74f7d844055368b647cccc4a9aa5a408b567581b20fee
1
56
2022-01-21 23:57:57
4390a86d723733d79d0f01f209bca8731de5d4e0b6f5bde2bc2d8e8074da98b2
0
57
2022-01-21 21:01:42
cfe70e55fb6e07a0e0dbaafd873794024d5347d3453da41194d5262dd43fe544
0
55
2022-01-21 04:57:01
530eaf9da9f167bc6d81527e23466ba6f06356f43f26957fddda719003044913
0
56
2022-01-20 19:41:31
f482409698c0ffbc926399ae7381bf170218fdaf192d7c0184452e8ad20a7b89
13
56
2022-01-20 19:41:30
c5d347d920f5cf4f7bbd980c48cd1bb7ee3c24bd7506a32dcd83835f0b983f10
1
55
2022-01-20 19:41:30
ba71a0feee372fab197f182e31865c599f9fbce0a846af95fca6e1d4ab6d5151
10
57
2022-01-20 19:41:23
9073c1859e4b3867ce03848c686b5980e8c8eb892da7d4034061286cfdd10648
10
55
2022-01-20 19:41:19
e41a13460c941e9ebd52f0f5bf4f91bec027ffe77777c9b382ac3d61654b891b
0
55
2022-01-20 19:40:13
e1275df30f9be48cd7e73b4eca02ab1546c81cb6a8f6d3b2034f3e72f7b237f9
9
53
2022-01-20 19:40:12
d05cdf6923dc2d63c000d814a24375e3d474f565738ca2764c39a9b74ef6c8d1
1
56
2022-01-20 19:26:34
9121e05636c36ab5053dae257b00d4dc046f2a852d33dd69412624ae68cee15c
8
55
2022-01-20 16:31:51
9984ce5ec7e04b6dae1c39cb09c6a135fed6697bd2bc4d08b93ef77770eaa377
0
56
2022-01-20 16:28:05
a57c72a2d92614a6fb3d72d8400a9771643a60f8cb3f2cee4a5a27731b00dff0
0
56
2022-01-20 11:42:22
12138c2aca3eaebf6c6b3f1b7b24c68ea5b9d29d4e88ed8412b46b5ce8feb2bb
0
56
2022-01-20 10:07:01
d96de808e92e4d42e93180be95ec52fbe490c506cd839365e71cb7168df6bfbd
7

Rule Matches per Month (last 24 months)