SUSP_PS1_Obfusc_Combo_Base64_CharacterConcatenation_May22

Rule Info

Author
Tobias Michalski, Christian Burkard
Reference
Internal Research
Minimum Yara
1.7
Name
SUSP_PS1_Obfusc_Combo_Base64_CharacterConcatenation_May22
Date
2022-06-01
Description
Detects a suspicious combo of FromBase64 and single added chars
Tags
['T1132', 'ANOMALY', 'OBFUS', 'SCRIPT', 'T1059_001', 'T1027', 'T1086', 'SUSP']
Score
70
Av Ratio
32.04
Required Modules
[]
Rule Hash
3fb8c0ddb44a936543abf218ae212ed2

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
105
Suspicious (< 10 engines)
22
Clean (0 engines)
3

Rule Matches

Hash
Positives
Total
Timestamp
VT
c78547a1641a89be4c0855896a0c108c0dfdf91a741a4140566edc8f96caec16
24
61
2022-11-28 23:51:19
6bb39f0564ca9890ff63387c52f0f07e396b470b75ae69eea8db3180b2e86033
35
61
2022-11-25 13:56:13
98fa071311fdbf091d7a70d9b943478c942dd827cdbd389d62f057b7c125bb19
33
61
2022-11-25 11:23:11
8e53557653aff15cbfa320782f52e1d1ec4b0b406931ba21c3b857742b320ed5
7
61
2022-11-20 08:09:28
1c075cf54b12c283f2faa0addd8981585d950016b34bebec132d8e5ba78b97c7
30
61
2022-11-18 02:10:27
ce90d6ef6429f97d87eec3990337fcd365f43e03bfbc3d2e644c4720c82313f1
24
61
2022-11-15 10:07:00
083e45f314c6cb3a813c8f93ede33327569dcbcaa2b8dc23faf56d5046febdc8
1
61
2022-11-08 04:13:39
a6f55957542982348eb412b9b49797e1931183a6bf395016885e1294c5a08dbd
35
61
2022-11-05 23:21:40
bccc37d9cb242e31e21e6eb83301f2b47345aa13644e5ce717e1652e8e0ab2f1
18
61
2022-10-31 17:27:04
6eadd5a9eb7eb44f3ff1728f2bc525dfcc0e669fe18babf476e2b85a4e06a573
5
61
2022-10-18 12:34:06
a2e86e80932b6518d45b6885db213fdfd4ca70f2b4a4c12fc3cd9ccdd8441c59
7
61
2022-10-17 15:30:08
16b2339a3c951d0d5854025ddb35372f4da1f44cb4d01048f17fb8bca982e298
17
61
2022-10-16 09:18:15
639c751dd840d446cabd502a1cb8c0f77587862bced063c762cf5b3f207049d3
16
61
2022-10-15 23:44:15
4546c6edb62e137d862edfaf6331ce6e7dde5ca386920734c35b13b479a2a84c
30
61
2022-10-13 03:36:09
3729f57cc03cb1af621cf95ab887619adea3fcb1268ddf8252d28f65a0930437
23
61
2022-10-09 03:47:16
209146d1773e8c4608b04501a39595a19ef49b3841002963f9ba104182d93cbe
29
61
2022-10-09 02:41:05
c335e85ed38903e68db51501095e539b68477a850e87ddb3ba6d07af1cb0cc2a
0
61
2022-10-08 14:11:27
507dfd57cafc20bb9201f2ed962f2ae1b04aa3242c0a5413d210544b2ba6277f
24
61
2022-10-07 12:10:11
70ecca1a89055c5055f73561e0bf67426fd5c920fc03901b06f0cc6375f76474
22
59
2022-10-04 12:08:37
af96ec414d8ee7815530d52a1d00602fcdcca206c70854601f6b66c7731d9aa2
27
59
2022-10-04 07:26:30
7ad3a8810a02e6f81fa9019e8f7a4927d5ff6578823f94a2977930272dbf632e
22
60
2022-09-27 11:25:51
efb16b66318f6f32c88ef577d6d72c8884c4bf82efd0acc2c279662432f05580
3
60
2022-09-22 05:07:34
c9d40bd62d38a4269ba5afd0f82243ee097a73003e540eda0784f07d3bf4efaa
20
59
2022-09-21 13:09:44
016baa630439f62035082c30c2739595bb60237a6fbec5cdc244827fe6c7061b
29
52
2022-09-21 05:17:30
1f12b8c250aa8f9d1e66caa0955fada8ccafcae1bfa66930522434771ce25525
29
59
2022-09-20 08:07:27
43ea2eea167d3941914612af0a25f570f028e2060c084c9537a61c9e3c524437
24
59
2022-09-20 00:08:00
08ab1ecabddd30d21d699f0e4cf362f207335535c1e855129d245c9134f0c7f4
31
59
2022-09-19 17:38:13
ac8cdbe302f862c4570e6571673f9ede50d1a2def1b13625f7d5c14e1401a6d0
26
59
2022-09-19 14:53:54
37686f77951d999e19fb5d3ad280bce9ade6b187f48c3090a3d84b6499159656
18
59
2022-09-16 16:29:14
a143adad460fb2bb6697132157ee9767c6d725374ef958c2824cf95d3ac4d706
27
59
2022-09-15 15:47:33
a5926ce6caa9e445495f4c796c74e345d255a76b8bc8b149b5e8656cc6de1877
28
59
2022-09-15 00:12:10
7029a6c8a61774d7de7f4c493828c02c77d1af87c4c24729f0252b282120edfd
29
59
2022-09-11 21:08:49
6a5b24f1ab687ba10c17e8ca164ac195ad41a0f524ae19d3d4a3be7d9dc7a403
8
59
2022-09-10 16:53:59
94fcbf483bbf9fc8142f648f9a7cb5723d27a1b386ca7bbcd26e89bb95dba70b
24
58
2022-09-10 12:54:42
71b175ede4fa10ac3016c0469818035115cacbb8313205e7c11cad494fd04309
17
59
2022-09-10 10:03:08
45784628e905554303e015df888fc3a7c3c62f157700e937b3f663e294e715d4
8
59
2022-09-10 07:39:16
0a53be8be486e09d0dd905575e732cda870373b7da0abfcdc112fbe34486a616
13
59
2022-09-10 05:54:53
3203dc5619c0c0ef55ec68de34bb9c07fdf853889ffef925a31a96201a56f70a
25
59
2022-09-10 03:22:27
e79332bc11f7b4b60b9ae75db8dd5e94791bb0c81cc6032c817cdb58feddfe79
30
59
2022-09-10 02:15:01
b2743f7047a7119794a28840403def40e27ff7f9575ef060c458ab4fe3e9aeb9
25
60
2022-09-06 14:00:00
a0bfa955d2bddcde702d3ea50449a8607ac45575fff7d2f10dac795b30770602
31
59
2022-09-06 12:10:54
98fce76afac492bc6b38885671191e6a4cbfad36a1fca4f22c1cfd56436bd05b
25
59
2022-08-26 23:53:11
7e068268ee3b89d1f8800d6354c9f63cd57c00088ce0d850893b4ddd8e750573
28
60
2022-08-26 19:01:39
02a8ef5905a4fadbd82284dd73e1893044461336b02cfb5acd1dc8204cac0d29
23
59
2022-08-23 10:05:48
85c098adecf90ae9729b87821ee93094c2c81d96eae492a7a1f043e9946ed5ac
23
59
2022-08-21 23:54:27
ac054bd430cab4b8ceac3e6bdeef7640b220e7665cac590d4899c6e3b58aa5f9
30
59
2022-08-21 12:55:52
e2698875e316f75cd403c5cc0abdd2eb597e6fafe9e719ab7e612960a2886603
17
59
2022-08-21 01:07:24
9cc58874a1314e639d0fc468d3a18bbe66bc5deea9443216d98baa11913d506f
1
56
2022-06-17 03:30:49
0b7a0a71f4e2571f797cff059a081089bc5a09b18e4ef7fb6661a8ec429c1950
19
56
2022-06-16 19:17:08
076b22f6815cf168a813fa64e7f0b7e45d5312de16f8c9e65593160cc2c9cb1e
5
56
2022-06-16 18:50:08
32ec74ccefc7d7feb5c8817097652fc6014c6217f5b6a2695a95e680d6958153
27
56
2022-06-16 18:16:28
50eb0ffb78908931ee490fa8bd772301efbf64cc61499d625f273bb7fd6e194f
27
55
2022-06-16 16:10:05
cb22379a5c294d27ee150123247831fbb30acb38b01b235ab4ea22507cd5d090
18
56
2022-06-16 15:14:23
a830a4e986d0b0ab45a121fd067bbcb5f17c1cd1220cfede49b9d45e5c61a1d4
10
56
2022-06-16 14:27:57
cec742d1d54625aeffb86834cee278aa90822c90aa5e9203bfbbaf80dd9f74bb
11
56
2022-06-16 14:08:02
7e3247883be19a94f3c93bdf6f94a05bf03a00274f48908314e569204af7f11d
23
55
2022-06-16 13:52:45
73705716172ac96b070b00d6fb09d58f44275259af893779beea6ea8fc7ae907
23
56
2022-06-16 11:08:15
f5d8ce5844768edb7bca00f2365b5e4ea4170f523f97f9cda0b1a3edb893a0f0
6
52
2022-06-16 09:54:52
d193880450e2fc96229484ae38a2e6e41c91716d2746432ea782572a1e27afdd
24
56
2022-06-16 05:18:47
fd4ee34a813f829594cc2dc760afada467c1320621e66491517e4bf95a0ace06
23
56
2022-06-15 16:55:56
d24eeb669f70dbd9a7e95a72206a5d93c117951d404864dbec7fb0d692770f34
19
56
2022-06-15 14:49:53
3b5fdfe19974d64b7018f4e3e0b68b850df3881abdd67efc068fa518b51e1773
3
56
2022-06-15 13:23:32
29a2e761b63e40523d9dc42f00235a7c884cfb035ddbbadd377cebbf0f6f9a68
23
56
2022-06-15 10:16:18
dd2b0c59ad2b28643a627c2544fc4a6cbc499aab6b340d2e76eaeb0bafe5adb0
25
58
2022-06-15 09:55:52
26a0d403343757dfe73f9c3203a2e401db3febfd37dc6c0bd7739c528dfc88bf
24
58
2022-06-15 09:54:31
b32dc832c74f91ca6566a29b055b0d214142904310c9fa60cea1d4af36450465
7
56
2022-06-15 09:42:06
e78dbcf9eb548872f3da21953f67d02a0d157dd12a0194a044a07eea47278304
23
56
2022-06-15 09:14:51
a190903509ff8827a3c95c3a790fefffdcaeadc6dc6dfd9656d83f184b0b9760
21
59
2022-06-15 08:50:59
2cdd875b905065d9e35e323eb56f8f5b1dca141be94da35f79daf833d88728a7
24
56
2022-06-15 07:18:30
9959f8340d73eccb3c328ae37eba68f8c3f9b47815d796c2e2f5dfcedaa7946a
18
56
2022-06-15 05:11:59
c61fe40f46226d24f0f17c46acc4db6a0091c68abc6a3d995b3f6df1bbfcbb1e
24
56
2022-06-15 04:16:59
ad32d583c227a059eed515ed617c473ca8697d6856276c390b0299b573178966
23
56
2022-06-15 04:10:55
8af0b95e1d25c545ac64f600605f2361c921739ccb719e5484beac890eff6fc1
4
56
2022-06-14 19:22:56
e7886967c692329f846ec87e8c6db4c6d7eca61a2f87563dcb398be0ce3a1d58
25
56
2022-06-13 17:18:54
3bf2bed980adca2fb8035c308241659346a37d70d53ed549d1dfd5a8e03a2c64
30
57
2022-06-13 16:22:35
d16ff4fac89e6582d3735abbca36431dd75375e47119c4cc27cd1840853f78f4
14
55
2022-06-13 08:47:52
81fb0d6e6bda4bc6e3b5470fe314de548af99e94a9b04fa9c9a6b1a84f127e0b
16
56
2022-06-12 18:19:30
c0accfd941e138a42268daaeb074b795839851c9bc33960b4606d89bbe9d12ef
13
56
2022-06-12 18:15:39
bf0492d49d2e5c61383b2546df3eec9f2aa40272a79b741a377c9e5d620a8440
4
55
2022-06-11 15:18:41
98a81f7a4a9c0c26686ff8a86a0c506b7fca33b475c91eb60c04fc950084a67b
4
55
2022-06-11 15:11:50
b1153487214b3fe9b2b41341ee8fcf54b2b8a478639e2d36687fa115704882c5
14
55
2022-06-11 01:53:33
ca7d181a7146226a24e7e3c2f80720b9ec9bb182dafb27053fc286cd4f27f953
23
56
2022-06-10 23:59:21
8e0f87c8efefaed76b706d6b72e07ec75566b6dcee7622e55a2e2a5339f200c8
21
55
2022-06-10 23:27:20
6b91b022e1045598467214bd95333cd40ed3bb6d70a441e85c2e773cc92a45c2
22
56
2022-06-10 18:55:17
c901bad1777ca42bea4f6d6f4673cd2bb1452ae0273c8ab10450000fe0e7cd8d
25
56
2022-06-10 14:25:22
e5c1cacc1e16872c8063e470b9028295f94ed83b559d4442a803f16c358d3cf7
23
56
2022-06-10 12:33:36
1748801dcef62d58b3824d3c164dd657e50be073a7c5e630ed3e1e595b0ef221
24
56
2022-06-08 22:22:54
ce7624899c20f14304260dc74559207f4dbd903a95d3e3966d1e345b0d45aeaa
21
56
2022-06-08 19:42:44
3aa16a340aacc5aecbdb902a5f6668f117b62e27966ab41f8a71a1dd1a08f8bd
2
56
2022-06-08 18:35:02
529f707c4023542fef2b9c5737ecf643b40cdef6e2b0fb6ab7788f7896afa7f5
24
56
2022-06-08 18:08:27
08e69b8d1b779c5981e8d284debb90ae039bea475a938de25ace539dc26f1fed
22
54
2022-06-08 14:03:29
9dfc54450552ad0cbe930716b0d2c915544378d30d6d22f463e2dad3ceee1fcc
23
56
2022-06-08 14:01:13
cdec208ec12fa58c122db1887abb7f58c7998a9ba6eeebffc501e11de3975215
23
56
2022-06-08 12:02:08
9ebc6bc23ecd75e320b24c9d6b7c8738ed85b4538751ebd508d6fb914ac27fb1
21
56
2022-06-08 12:02:08
bd737f105f39f5e824273b8423f0988c1499cabd040e65035a301ab853eaf345
19
56
2022-06-08 10:23:01
dc009a09a03b95862c3eaa5ef6bc171325bc3f8e9da806a1508ac786f54f668f
22
55
2022-06-07 23:06:25
e3ba1c45f9dd1f432138654b5f19cf89c55e07219b88aa7628334d38bb036433
20
56
2022-06-07 19:56:08
a4e3fb0c055d523e26440e56b2dc015672c4e1e44b35c4a78e87abb751494964
20
56
2022-06-07 18:13:16
3b25e5d0e26dc45096399399c661fbf92e027b40c8f333c8a106c49223aaeb2e
21
56
2022-06-07 15:08:23
313593fe6d197de79cb95b4b76e04eb318d4cdfde65d714c6e51cd521be4e74e
1
55
2022-06-07 08:06:53
cee035a6cb3d2e6d3680e2413beaaf8b514b952086a4637a90c113884f0bc847
20
54
2022-06-07 05:01:38
eefa6d4aa3e729adba1688cd737f78d5bdc7b62447165b5255541a962a246ddc
20
57
2022-06-07 05:00:18
ae2f202b69d15676baa77c4f1f16dda1d1f524172f99b06fe5a2dbb5f0f599e2
11
55
2022-06-07 03:28:57
42bd9efe6fa5a65e141f2f3d66aec4c588cd78292a30f3af57f1b24c6889eccf
1
55
2022-06-06 16:01:26
a600bcaa8701a3c32c42604d25d4ead9d74b9c2fa5aa34755bf5ffa0a32516dc
11
55
2022-06-06 12:20:34
1eedbbfd5b379e84f14fbd2b6e66e3f926ce293175445eb19bb661f78abd7a26
24
57
2022-06-06 11:10:30
c0c9392b9334eea2cbe73485ee9c63f9e693908c3eb87f77b94a69eca394895d
14
56
2022-06-06 05:30:10
40049dbad1b57532db765877e792126779f8c2d93142d791540c5ec297747279
20
57
2022-06-06 03:54:48
2ae16b32705f145712aad85b551f1d00ebc6954840f7945ccf850091421bfce6
22
57
2022-06-06 01:15:26
e302ff011bbab714ee7bc4078bc8f8ac4fea0a8c7895feac55a04ac3f500ad1b
19
55
2022-06-05 00:39:11
c858774119e4bf466a3b001a1cb8a846ebe4b82327b2b3376d55749f2bbd9edd
11
56
2022-06-04 14:53:15
b631f6c8b38c1565b372b0af2b9c8589bf9cf91aa6f7c7f18e523a23662a788e
3
55
2022-06-04 05:14:57
2435f5bf0ecf3879794af79674320723316bc83ba910705d1ee7af2d6d818fba
13
56
2022-06-04 04:57:41
f4238d902824d716ac996c75896fbdfc560e716b860fadaa3271b1afe01445ef
3
57
2022-06-04 02:51:04
386ac13cdb3b309b528c6ce39be6b712b43f8b8922cd19e817ebbe70b67133f1
20
56
2022-06-03 23:31:33
47f96f9b888fa7bf3ccbcc29a4adb2d4bbdc14c5413dec572b14bc177fa31103
4
57
2022-06-03 22:46:45
d41220ea115cabb8f22d8f12c8bbc472494fedeaaae5789be7b6192438548143
18
56
2022-06-03 18:08:01
ce5671c292d834b04e0b27276c9b18c9f21da9d043b16ec2b3292ea5ff1b671c
22
58
2022-06-03 17:06:22
e3e4db45efab35e31cce8b6111475eac7a7d8e66842d58f905df5f94a4984fbb
0
57
2022-06-03 15:19:21
5385a798d136365b644199359dc2662de3b0d6c5adc09e4cf9cada074e8a9338
18
56
2022-06-03 12:15:42
85017c355f7544a8ec3676367cf01df2803c0a2dcac5f1b75a4db0e6b0de7e04
2
56
2022-06-03 09:48:52
8918ede0a38d40ee0b89028819dcaac6bb73d2280ad88ea2e1d0a42fd7101aa6
15
56
2022-06-03 08:02:02
57e73e139dff99884e9287266ca4caf826e7ec3b5e93f737198c6bf970b982f8
17
57
2022-06-03 07:35:39
6b817259bac271509241f40696a886584985b078f45923c50a056765f44d65b5
17
57
2022-06-03 07:07:02
8e986c906d0c6213f80d0224833913fa14bc4c15c047766a62f6329bfc0639bd
23
57
2022-06-02 20:51:51
983b6726492937b4ee915c9d98b9665ae86ace168eb903714a0622e5c014f7fd
12
57
2022-06-02 20:46:17
764a57c926711e448e68917e7db5caba988d3cdbc656b00cd3a6e88922c63837
25
58
2022-06-02 20:29:55
fc2887c34e9bd5b5dc61ce389d0b28c25a57e9d2c8bc885a4b8b9527ce8dc7f7
24
58
2022-06-02 12:20:25
4f643bf57abe70e3c4ed64f05167da5d6c35f2dac1d7fda78523ab231f903575
15
56
2022-06-02 12:07:08
800a769983c44b7a6d21c746ffe1c5108b0e73d1a2a35a1691a9126eacb26bbe
0
55
2022-06-02 12:07:01

Rule Matches per Month (last 24 months)