SUSP_PS1_PowerShell_Loader_May21_1

Rule Info

Rule Hash
1f6ee60721b865064ec5802dd287deb2
Score
65
Required Modules
[]
Minimum Yara
1.7
Av Ratio
15.91
Reference
Internal Research
Description
Detects PowerShell loaders based on characteristics
Author
Florian Roth
Name
SUSP_PS1_PowerShell_Loader_May21_1
Tags
['SUSP', 'SCRIPT', 'T1059_001', 'T1086']
Date
2021-05-04

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
35
Suspicious (< 10 engines)
42
Clean (0 engines)
9

Rule Matches

Total
Hash
Timestamp
Positives
VT
59
23b6af3e13bd339aee17de067ba49cdec7b0da543ce68eaa4fa3d26322cc740d
2021-08-01 22:14:39
6
58
ff78148317485bd5105b1760c257baef56cf9928f09beee1c67817b03d12cc3e
2021-07-31 15:22:18
16
58
3b245e29e08a28ba62c18f6d34d0af72127c5b5c7030e3dbb7e6e3e5151730e8
2021-07-30 05:18:11
3
58
ae1be2d4f97e0f435dbcf714f631033e294abd159dd76e9d78e6e10b3c8df4f3
2021-07-30 05:13:51
3
51
cf33200482c6e3c66b4f0573adb72e5633b37aa352be9e8d7d14369a7ba24504
2021-07-30 00:34:48
0
58
d53e50362ae2dc2544ae991f0082eee91742d3c79b74163da9d991de5a620dc8
2021-07-29 05:34:18
15
58
7b0d61e28b5b467901e35caf346b61db013b3e3e0cd6b87901d0e9e3374be463
2021-07-28 19:23:04
1
58
661a8a04754fed8fc20a9b0d289d87b4f3b1ea02879bcf3eccccb30e4cd4108d
2021-07-28 17:28:16
0
58
294fc110e302d6112bbbe78997a8d45c7140d4a0e24e7bfa9d18ba3e56cd8400
2021-07-27 23:38:24
19
58
e59baf2410a056e409b8fa63a96f20d55c16e1b43baab77d73083228d18277c2
2021-07-27 07:51:42
20
58
a5ef1b46e8dbee615f83c235706d7f0ae83d7df6279e3d7ba6098ea170b4c27f
2021-07-26 14:20:50
7
57
39c2ed40fbc771aac192d62b67804d1f5f4761ef5d3a217b6ccf597006812be2
2021-07-25 01:04:29
4
58
acf88b9224ae067d92882d1c8ec1461a663e83f02848488ce125dc0538d87a39
2021-07-23 20:57:37
1
57
aca2766496eae3bec921f89c61fcd8d2e802c423cdc80244cd557edc9b7860f2
2021-07-23 15:44:07
7
57
23c42a0b7f73ef49a22b102a9e8d2ae1033d07fef595436a818af67349b5387c
2021-07-23 15:37:04
5
58
942432ba3d8a50e8f07c1dfdc4fdaee181191f3599f7395bb0744c5e80a93d4b
2021-07-23 06:36:29
14
58
c1b6b8aece88cf30fff1fd35bee1461e34f4799eff1406890e079bb2c7bfb9e5
2021-07-22 23:37:00
2
58
8ebbf0767bada09ed90cf39d1ca0649b666bc1afd277ad5123b304f24ef5f4ae
2021-07-20 05:31:57
17
58
fe8eadf001e0ff2dd0313695ddb23e22353723692d005669bb139ec8b276c7e4
2021-07-18 18:27:03
12
58
a0df60527a84e5b217d9c4d561d9391a0d669d62e52a8b88b234b02e3b92995a
2021-07-17 15:41:26
16
58
64e5cecd1729ddc488ae84ac62193e3d6e00bcd0e779bf9679c3b45ff1280a07
2021-07-15 21:43:31
12
58
bcdad67753e881c2001bcf94a9eb5f46183daa6bee3df94611060cad92a70f49
2021-07-15 10:30:52
5
57
ec5c7539fbad904955416a7e2da9a59a719348a1c61cbc09473c92e1aa1a9734
2021-07-14 23:23:53
19
57
9615318887b6f73446155a650c312e99a1479a3b83d98ef5aa2bcd9f69d42d04
2021-07-14 11:00:20
10
57
ccc08752c83139ed076096cd4cae1127797864c366517870ef37c6c079e9e87e
2021-07-12 14:02:09
0
57
2a27d7ad1f16c90767e1cf98c92905aa5a3030a268c8206462c5215a87d0e132
2021-07-09 05:39:26
18
57
c1780f3ad76af703ceddd932b187cf919866a00bb3e2d6f0827b9dae9d8875b6
2021-07-09 02:56:34
24
58
55ae821cf112ff8d6185ce021f777f73d85150c62a835bb1c02fe9e7b3f863bf
2021-07-09 02:55:09
22
57
da7465f14cd8a934668f59974e8836e02a9b1ff948bfe964040b840ab61697dc
2021-07-08 18:18:25
17
59
062a8728e7fcf2ff453efc56da60631c738d9cd6853d8701818f18a4e77f8717
2021-07-08 16:43:39
26
58
8e374094f100a86d02cbe8ca570b5da4546c71935f0a2cb73547453cfa5c850f
2021-07-07 21:48:42
8
57
54ac1d537670349534ec4146b999b5a6ac2473faef0c704c3b23f1e183d91927
2021-07-07 21:24:04
8
58
326111c12e3679803100b66beb70769c0a23908d714b409a1d07d66baa30a0b2
2021-07-07 21:09:39
8
57
89621bdc32fcd3195b90d63f57fd85b6c4e16ab8a88070759cb9a2232592563a
2021-07-07 13:48:12
14
58
eb4f707cce5e4fe9214447f9c8bb98846c940d041b525391bcbc72c7f4e33ebf
2021-07-07 13:09:23
13
57
cecf1159386f6a3b496220b971383816138fd4551d9779f19d32422f5ba463e2
2021-07-05 13:37:36
17
59
237ef2c4553e9ee9897a6d18fa4170bc0f738b4273f91f7f49e28be11e2040f4
2021-07-03 15:57:53
11
58
64c4ec0b177acb32c7ed993922f668b4d803aac6ce66288a155cdc823ce4cae7
2021-07-02 12:28:52
7
58
0a0733ba7f5633591dee82404cd037196c17b33baa4b0265106fc916295a7716
2021-07-02 00:12:12
0
56
7ea4ba30f4cbb1157f5e5f41691af1163cbaef4cb194c6c2df52bed04d03cdea
2021-06-29 11:15:21
0
57
be4691513dfc458f7d673ce17f004f0f58c51dcec3b40ec94013d1d710cfbaa1
2021-06-24 18:54:16
9
57
c5d855519716b52a97313510125f69fccad6d3ce4ca9a93f3e4e921b9225542f
2021-06-23 17:57:42
5
57
834d2abbb32e0a9e1c0ace71a49aeff377f9bcae58571c6c36e513931332de84
2021-06-22 21:17:35
4
57
16129d56633bf8e55e5095f259030d80f0d3ced1135abb098984d96af9992b52
2021-06-22 20:34:07
5
57
0f1913902d2150f50079e5d1196a7c691fb6d2285147b17f8ab145c1d59c410c
2021-06-22 17:38:01
8
58
6cba6d8a1a73572a1a49372c9b7adfa471a3a1302dc71c4547685bcbb1eda432
2021-06-22 14:06:17
2
58
893d513e1e305e2225ba240c95f28f7635373d6b2c92860276a12b80f27e0606
2021-06-21 12:27:43
17
58
9850a5cc67427147a14c7940914085c9552388a96b6fce653d4a5b9dd8c22edb
2021-06-21 09:52:15
9
58
b0ff380de54bd068144aa359659efe0aefdc5d6e6aa7c883b781249b3682bf1d
2021-06-20 15:08:12
14
58
fd7a51cd971902292c721a2cc096a2a2ec60ebf6831567c378b1bdf8d8516c93
2021-06-19 14:47:25
4
54
e3447566469817c1480d84f12e585026b705e7a79a25ab48818186ef1d4e4c7f
2021-06-18 19:20:52
11
58
d31c8eeab1b7de8a6046bf8cf03f4b37001c657890b222ca154d3d066bb42da3
2021-06-18 18:31:09
6
58
b7a063663ab7e11ce82b8029104205439db57195008599e9eb9df7dc05d6b6ce
2021-06-18 18:19:13
2
57
405ab27a13874a598a7bbb24ce19042b52b15c581d38c179ff79ee1ea357008c
2021-06-11 19:26:35
4
57
3446d77893b2852a536c7446753678604eb5e398d0e07c3c67dda871adb0e91b
2021-06-11 19:00:06
4
56
202c67eb1a574e72322ee4ced60b8885feba865f2d42b0547702cc4781c18f7e
2021-06-11 13:26:51
3
58
443467849ff06c2d0df6c537407f976ec302ebcd8ca5783d12e38999fc55a2ca
2021-06-08 10:18:21
11
58
586ba9980e235b3372d3baedccb205e617e73da9ae548b3ad3faf058b7c51a62
2021-05-31 20:09:58
17
58
9c03333b6ee274af0b53c1d8dd68b6466c39c221b49c0313ecb66bdc3521d6cb
2021-05-30 15:53:38
5
58
4ed5b6d4e48fd20beae78dd543fe905c4e4778ab9b3376cb8ce7b80dfbaf8b71
2021-05-29 18:44:13
0
58
96fbd41a1e630bdc9f4ff4538557e72815b3ae2513065e3ca344adb55262283c
2021-05-25 16:54:42
3
57
d06f69aadc4c10548901d20130735b006ea987db4014f96f6d19ec697e5fa40b
2021-05-25 06:01:58
2
57
f5c0a60972fefb04883dbfa4d14c44c45eb1b215d17b326958a6b329d31be190
2021-05-22 15:30:50
1
58
a451f99cd098ea7533e80bad8e5ca7787a721d72c20eba873b84f406b5e012ac
2021-05-22 06:14:44
17
59
483c3b1c475e31bd61b4e9e774644945512db7946665b7e1a9f89909680665b1
2021-05-21 07:31:11
7
58
1d21dd7260433b1c4baf235e92798f030fd75f6fb4c8450004e0f208ea0b94c0
2021-05-21 03:49:22
5
58
aa9d0a8fa8304f7a340ca921a934ef42a5ebda17d5977329e3e7ef593a053182
2021-05-20 19:49:14
17
57
e5f8b9aec4ff2ceb9bd9aef5743526ceb73e365bcdb1ebcb1703a71165ded692
2021-05-19 14:28:56
4
57
45fc4f8f59725c9369051a138b35a3d62f7044d3492716978d113a9fa1bffd08
2021-05-19 14:18:06
4
57
31e1a7bf2440d3e13f9e86822a5a121cb5c99aaf5afce071ca5ae168c115f1f5
2021-05-17 22:09:50
17
57
6fffb33099614620ad35b86890fae495e0c984926935f6160754d5316430f4ab
2021-05-17 20:34:49
3
69
c7f330129f9524ba7f1710383b84335bd9995e90cd828281645976b9e568b1e1
2021-05-17 19:58:36
39
55
ce3cf9d051227371a435003fe17ec1b041684fd55a6de2c763b470abaa8e1e07
2021-05-15 21:09:57
10
53
941da851c01806fa983e972cb6f603399fbd6608df9280a753f3d2ed0fedafb5
2021-05-14 23:28:18
9
58
1bd9e7e55571c2a6120b37fb9da3c5813c3c5eae86deb233df02ef800aa4b1b6
2021-05-14 09:20:27
2
58
83575acf1f7903e4fff01f8ce07c99fceeb82aeffc13b2dd0999ebf59639088e
2021-05-14 01:27:48
0
58
973e90370aa3edd6a18681872f77eb68f940cd0483bae1215bf692bb8ac68ac7
2021-05-13 23:31:00
0
58
64efa5828000543cb330e859189d8d3d0660e8541d331e1f3b20168f01fdc7ed
2021-05-10 20:39:54
0
58
2416de42906cea8fa9f443b07bbd9d6cbe66c4971e8f8559d0c65a217874af65
2021-05-09 15:05:52
19
58
dbb3a665f9460343eb7625f8625815179e63aaa83f91b9283a296142ec4b2bbb
2021-05-09 11:27:06
21
58
bef8036dd87fa415fddb030198e0fd79dea8121a88ebedb18e623d02aa400030
2021-05-09 06:43:12
9
58
ce695e2729f68b20ddb2caa473eadb270511072eb2da3134e5fc57f5fbe109d6
2021-05-07 04:12:43
4
58
8fb4f2574c5418a2ae267d3a890149b9fc577821cf21526c7d89bddb0955683d
2021-05-06 16:10:13
19
57
ccacf4658ae778d02e4e55cd161b5a0772eb8b8eee62fed34e2d8f11db2cc4bc
2021-05-05 19:56:03
12
59
b42ddf9dc44bdfe0a0031a2b590276f1ed874142f8d65563c3b15cbf68599a60
2021-05-05 18:55:50
5
59
74dbcd7985a66fd9741807fa3236775f2f928d12cac8625721e448f85899444b
2021-05-05 13:15:47
19

Rule Matches per Month (last 24 months)