SUSP_PUA_Rclone_Oct21

Rule Info

Minimum Yara
1.7
Tags
['FILE', 'T1020', 'SUSP', 'EXE']
Name
SUSP_PUA_Rclone_Oct21
Description
Detects the PUA rclone, a tool used to exfiltrate data
Rule Hash
4a88f1eaf6fc5dba661dc9e53528579e
Reference
Internal Research
Score
60
Required Modules
[]
Author
Christian Burkard
Date
2021-10-07
Av Ratio
1.16
Modified
2021-11-04

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
3
Suspicious (< 10 engines)
27
Clean (0 engines)
95

Rule Matches

Timestamp
Positives
Total
Hash
VT
2022-09-28 14:14:42
0
68
ea0aa8855ec9e8a071771dea2268703e316655dd6ac65fdd89dcbab9a445d9eb
2022-09-27 00:03:31
0
61
4b39f4f4e5dd0d10391ef94f1d31a2a387904b48a4192862497ab47f6ed0c323
2022-09-26 23:33:10
0
63
3d911feff22d243c02461903a74ad0febc4dd3de07146e364532fab126f224d3
2022-09-26 23:28:20
0
61
3ab3f6453e5c7c9035d35c95d8925e1c289617b0dd2945871e4aec48a126828e
2022-09-26 22:54:17
0
70
c8f223ccba57b725ef064c3c4ff0632e624dfcc49ecd1e4fff990b7a76cd34f7
2022-09-25 21:10:53
0
61
2af790751c52de102e3563e8134e4f43acc9ce7b3dc6e55e0ca141f0ccc41b9a
2022-09-22 14:08:41
0
69
80296e9b3fdbf7fc779541fc0e104d1655caed74f3173e4fdaade337b22e62c8
2022-09-22 11:17:36
0
61
7583a9fa3ff417e61852db0b68808034945fbcab904f51432e40a8f28f7b6e37
2022-09-21 03:43:44
0
61
e4021f41b31e632e5545f8db8a91e6ccee38333441f891d16d117f241b3385a3
2022-09-19 12:07:22
0
70
569253afc9a49d7b458a3db19df2c9c2dc678dadfff44f3bc6a8136587f0b734
2022-09-18 10:08:29
0
61
caf652e729bb95343718bd27c1d97b6d2991deb5d5071817d0945c6cb4e8d968
2022-09-18 10:08:18
0
61
e303dc05951d446db7c10dbf4f89979c5dda5abf9581ac02a38e4b3ac0d52eff
2022-09-18 10:08:10
1
70
9601356918582aea29586fe10e3cfa72571e45e4458e762f0aaee36c2ef27ec0
2022-09-17 22:12:35
1
69
54e3b5a2521a84741dc15810e6fed9d739eb8083cb1fe097cb98b345af24e939
2022-09-17 10:35:47
0
60
94e994bd4a37b17ca358b45fd8a83e7030020ca724dc87d20ed437d52db0179e
2022-09-17 10:12:30
0
62
7d755fc6ee6581d7fb31a506f46f27c3ab347ed6e6be5c4e8b61a67538528319
2022-09-16 17:56:26
1
69
57378a8f8ba81c4a7b020b00b899b898748b92d92a027446d3156dad909368b3
2022-09-15 12:56:42
0
62
fd4ba144d78db55040f7a442a1c68569f62cdbc0a88ecd3669a7afc53cc0dc48
2022-09-15 06:17:37
0
69
2e438fb839d5d255e17c9d7b7444288ff48104cfdde64ba359f75b15ec656669
2022-09-14 13:27:00
0
61
89afb8e365b878862db870d9a578007fec1e8907a38936ad4ba5f5b64e06177b
2022-09-14 00:10:02
2
70
dc82f0e6c35051dc21d778020a43770dc18b9c7ddfe397bf6af42c0dd9f055f4
2022-09-12 18:16:15
0
69
019e2b5b6e6430ab95e079af46ebba90e1e87a9f44b6d64016ce7223560109df
2022-09-10 01:34:41
1
69
56a05efc148b4ee8ba31d299795942b8668c6150ef4e2650c9857eb7c0ef5c7b
2022-09-09 13:17:51
1
62
3b1c9e3c4a2ccbefb3774503335398c1d4868772a8b61fc7915e5b75ed0fa3a3
2022-09-08 22:47:45
0
58
f685dfbc1834c8a2e219fc7059dda83145b74025e0e9645ae7c9301ae5958a2b
2022-09-07 10:09:33
0
61
fabce0216163406b910ddbad14cddee9df1373970725d986459925bef55526d5
2022-09-06 21:08:42
0
61
f51e45d43c4f646eaa9255cf519ee0ced331cae812f221fa9df7621125be3019
2022-09-06 21:08:39
0
62
146979bfe17689c306ecc171e315a7681e373e5efb2d0e0397c1a20bcd202ef8
2022-09-06 21:07:26
0
68
ff35f5a3fd7438ae32bf1001e846126620bb295dc2d5c4ae0015e74be0ea121a
2022-09-06 21:07:24
0
61
67e1962a36703bf5e1f455ab2e8f4114855eccaab191bb08a6c77d20cb35984c
2022-09-06 21:07:20
0
62
8546cc960ee4ae586b375db53422082722236f8955a3e38997f4e21d709b65fb
2022-09-06 21:06:13
0
57
e1c9ca118daf22d1b48f7f2628d8346a99c368af8dbe74a88a835ce43e45ff73
2022-09-06 21:06:13
0
61
d051f858cebaa2b2cddb8ee1b984ce62f25557b6073859bd1754c4b3e5bcfd22
2022-09-06 21:06:13
0
61
1a687e5167396ef2afa486da346d7f4ecc9ed3b75c957008ec6f0713f8f2dab4
2022-09-06 21:06:10
0
62
49df2964f5c0b33e63a935b4e67bceca30214549507673450225988fdc46a6b7
2022-09-06 21:06:09
0
61
6a6d162898cb100dc28ba3f69dfac304e5cb71163aa762b495b2e6292bae2283
2022-09-06 21:06:09
0
61
72781ff0d82d4cc468804474e49512fda712c11531340dfc0e000981d6edd863
2022-09-06 21:06:07
0
60
7ff6da9b4265ab24e0d551af0c15eaf119215266144440974547da0281b9ccaa
2022-09-06 21:06:04
0
62
9c256a265fd7b03b7f4c551410122151033f8a51f20babf2b2165fadc00c161a
2022-09-06 21:06:04
0
61
6e3be5a3592ba8716a413a3438e4a0527015c8501d31cd9e86cb89593c660a79
2022-09-06 19:56:59
1
69
6ad342fbfe679c66ecf31b7da1744cbf78c3dc9f4dbc61f255af28004e36a327
2022-09-04 09:53:19
0
62
306b2c0311f5e28432c60f5ec7e0f9c78e0d422dfc2c9e629680ab80ffc60b83
2022-09-04 09:53:19
0
61
6dd27ed85f3f870044d89dd19b7d2ea4c15be487d298c40fd232922df8acd222
2022-09-04 09:52:14
0
61
af7af691a6e7388d0619b20fb7b5a4684380a187e77c6438ac0d21a91514cc2d
2022-09-02 15:10:28
1
70
71d73bc601de4693ab089d55d56f43fe2b0a9b5a2792e35db938cccf174eb02c
2022-09-01 11:34:13
1
69
1322aee109215fb032a799ea02e60048594dfc1012bab8ec998f6aa88e1ed1c5
2022-08-26 22:37:55
0
62
b4fa4c6f7ff0c3e4e7fc1ed65dddd577c1d33f15c49d33047dca3bfde4b19a94
2022-08-25 16:14:40
0
62
f3df90846f2b1e5f888257986f3e4ae5d5af0af650a6ff115b3bce72bb347497
2022-08-20 03:07:13
0
60
9e649a5a60123bdba62c129593b9017756f3723e3665468998018001f3d78caf
2022-08-18 20:13:43
0
60
f805a7dfb182afb201194e2ecc121ca9586f84f1d5df781499a9fd931e856e04
2022-06-17 09:00:34
0
57
4fbd3d33faa395ee0b14836d69289482521f1e31fa7fbd64229dc05fde65242b
2022-06-15 00:31:00
4
67
69a608d0378447f19989f2f48598299eecfb43694eb5e53d2b0e6ba629a9a73e
2022-06-14 19:40:41
1
67
b9a6ae0a83a7e866f1127ddee0435ef44fb066b6d6a4eb5cd13b9eefdcfe6fcd
2022-06-14 19:07:01
0
58
8831946e5c45e3c4860e65d6a194d3c6766b1f60e034c8f1681aae93eb599494
2022-06-06 08:01:27
0
66
6084131549c1a0063dd2eb68d7eeaef33215dbc78bf4841a4f133ab6178c8a4d
2022-05-25 03:12:44
20
67
745b3a2495efc0f3887908189ae71d4333f9eeb2d8d83923302905aa1c196931
2022-05-24 19:09:57
7
68
ca9f0840e7827b5ca3593610e3e7b7e9bd5ecc69dc415ca5eb8d5f427f26e646
2022-05-24 19:09:57
17
65
5449ec23641d1e98b112fcb22aeede4d0801f2af403bd625af2cd7f70f84a539
2022-05-18 10:18:00
1
60
a30308840a40cfe13eb7d4a39a2fea9841637d2d3110974531d3eddbdea8ef69
2022-05-18 05:34:55
0
66
c0494e3d454c6f4c994763cdab7c76442b05128d30e5ea9966558c038e0851b3
2022-05-16 05:08:03
4
67
768b3952643c6f7bc3b20a81aad0b75497b7bde5c9bddab7e4cb4f6dd74993e4
2022-05-03 12:25:39
1
68
d5e01c86dab89a0ecbf77c831e4ce7e0392bea12b0581929cace5e08bdd12196
2022-04-30 12:22:26
0
61
7d30db13cae14b3c6c202e1ebbe2888df2abc242a60f8d3c0d80ad39557a1331
2022-04-29 20:03:45
0
66
9870b159b19b37cbf36f0d8d3132f1c85c1d871e874a93c5c51de90fcef1f56f
2022-04-29 15:50:29
0
63
855110b830e17a9e981c4d3dd0db2c55bc0fafd42b68382f5f188b53e718fd12
2022-04-29 15:21:30
0
59
deebc0703b37d4d478fdab1eeaa6cae69685e9317c9508f578c3e2f674718028
2022-04-29 11:42:45
0
59
375bedabe0368e4353b8c89b5c1034788dfb8bff46b8a05ce43916f37999699d
2022-04-29 11:37:01
0
59
4e1b3d96a831bcc78e515d89dcaa1f61a545691dd05fc19ae1a1c75266cb14a2
2022-04-29 08:53:49
0
67
922857b9ac0fe1349dada8d0ec149577f95bd24b000d4e68252d83e80bdf5997
2022-04-15 12:40:37
3
69
e70ed531c8a12e7ecce83223d7b9aa1895110dc140edf85afc31c8c5cd580116
2022-04-09 07:39:13
0
65
ea540171cb6337a95de91a2094b1cbf3281f9a0b3425e46fc20cdbaeb3f80f2a
2022-04-05 14:08:15
0
68
7c2634c768e12c8619283bf2b04303aa6a681e2e14fee5a2c61ef5ec6ec11801
2022-04-04 06:24:05
0
60
f462d4e63f319d9b356beff326e7095c4af08114d63f6aa7ca5352b367aa28ef
2022-04-04 06:24:02
0
60
d6b615185978b83c9e2530215295e216e7d208a9992c0b8247045cd1f0607663
2022-04-04 06:24:02
0
60
0dab81bd0d171846c5b63156d5a1c64a866cd7d47b8ced7a2ee6809e625cbab8
2022-04-04 06:24:02
0
61
6485b482b7c0299d35399089fd128b4c4d31d20ba770a258c0f21363e5643c77
2022-04-04 06:24:02
0
61
577e86a99a2944d4643a64cb878e6ba5a1a1219e98e0449cef74440aad08b2b1
2022-04-04 06:24:01
0
60
20e5c3d053e97fa36e1a3d3041791e81046f3ad2491b8a16909a4d81e25dd86a
2022-04-04 06:24:01
0
60
a55d182532f35fbd4b73a604f2d74b6237b06301f7c3dc37281c60afa105a781
2022-04-04 06:22:56
0
60
13d2fba0e06fda2807ae01d26a0936136f9c4918d2212323f131930e1c73e760
2022-04-04 06:22:54
0
60
f7bf06eeea8261844064a9242db9e58a295acd8cd4b9b52fc4694d50eca1c1a2
2022-04-04 06:22:54
0
60
fc4effc4dd8e165586c2ba666936d5c929266e3372cc3c1d819e50b2f8d8b28e
2022-04-04 06:22:54
0
60
53ec9244433bd8492144bf0586e638c0790e7e1d60c3d2ee92dec09c08e76181
2022-04-04 06:22:54
0
60
a230329707e0bc95c58a773fd0f9d2f17a11a80347d79f48bb79c575ac2daa1a
2022-04-04 06:22:54
0
61
695fc51133006492ad6d288444e4394caa5c6cc2b26bd832d50f6094f04f0f8e
2022-04-04 06:22:54
0
60
3db2c9fa12a4fa89253a61611e0d95e5d5fc85869bbe1f8b7c0f6bd7b7afd378
2022-04-04 06:22:54
0
58
86e987fb5d3ffcff3bd9218f42dc351df26f7c02218c5e47e3ee4974ceffa280
2022-04-04 06:22:54
0
61
43343c0a6d6dc0c6f980e10d6d30369b1e6489e8e970db35f181a538688e7c49
2022-03-31 02:10:45
13
69
42966dfe872f54144e6090a9b82aee9b585711274efcd08a919b7f1642762f1d
2022-03-29 19:38:13
1
68
e4f5d69d77c3b143e2005017753399aea68ff4c50e3c6bc29f3b654be1c73b43
2022-03-26 10:45:17
0
61
f94067eee5d53ca73e51c624c6a3446e06b16c9a7263d524e2cbc98361322ba6
2022-03-24 23:02:42
0
63
06eafa3c1d8636c97edbb7243e53b7f7e29e70f953f9ab5bacd8a9b975982104
2022-03-24 15:29:54
0
58
054aff000c7eb194176261b4a7d6b837a2fec97c77af421a293a98fa6037d109
2022-03-21 14:21:31
0
57
8fcdb8b6e698b6b7e55aa93e43273ce6c229753a4323a07a992b960cf53b4ece
2022-03-20 11:54:40
0
58
644fd215888a7ce4cf7525c1c47c27b61fce3ee169d4ae46b299c3ff715b9fc4
2022-03-20 08:14:29
0
66
8b91d861a9396111d7a495c9753d64ebfd48e51d06214009c953b45b875dd6c7
2022-03-19 15:16:01
0
65
a7375647aaf61bdf0c66d223c51ad94cdd28db59a67642004721ccfab1a183a9
2022-03-18 19:10:25
0
67
c7eb63a06c80b8c725308d9a2952ec596ca93069f1e422a381d29e8b1401e1f3
2022-03-18 17:28:52
0
67
f1c87c2a32b1f0d2210a12ebcb1d3146b54e3bb5db3fb97dbd81fe123d411632
2022-03-14 09:58:05
1
66
e77a63e4ae176c26d0125b7ab6fe9d89716da0cf17e2932e79edad9013b66374
2022-03-14 09:57:01
1
66
eba3eb03134561bd0f246b6260e834c96f38ff85dc8e1d26827de6b8b44f4615
2022-03-13 07:53:21
1
67
2df5fb95052fe1ce7b838ddc2c032eb90b6187f4b8520606b211c8616f6b0115
2022-03-13 07:37:47
0
67
aebfeccd40fccc9c894494d362fc890c99d55760ee89c46c4ee562c8f22d408b
2022-03-13 07:14:52
0
67
80df5e94eaed039145eacd4d78869b783f5e32cea36daba6f0dce3ba6020a054
2022-03-12 09:30:13
0
67
d161f50d5adbb6cba5b04359b66c3da608ac033ab753646bb454716ab0327110
2022-03-12 08:59:23
0
66
06dc72abb15cffb9a9eb6ee9539041ba924300d57438c7256dd733d67c39d0b4
2022-03-12 08:40:09
0
67
f20799334f70e4c20809670dd24b66246ee78ba3595be16f024836193b1b3c7a
2022-03-12 08:37:39
0
66
ecf0a925c6f29f94e1353bba59a23348a05b71e275bd30726806e1b35e0941f6
2022-03-12 07:12:35
0
66
e8bfe72c2945e9a68ca6dba4ad7697d7ed52013f988ad5b314f1cc298ba03c84
2022-03-11 13:35:19
3
61
9a93ffe22a820341cce95a130ebe0ab8650c6925bdd5563172e1a62dad0b6c8a
2022-03-11 08:04:21
0
65
5d71b860d18ca8650226c153268016cd4df88cc1763cb6ece57a10919b3b389c
2022-03-11 07:51:26
0
65
0a48d08af00d9e362d6593a09ac535fdb517d25d272819e1a7a4de535296d5ba
2022-03-08 20:59:40
0
67
e06e41684e7ef2036bf86df6c23ce23e47c1d3decae28ca059f06366e93e263c
2022-03-06 15:08:33
1
66
206657fc034dfd59838bc3bf6ef3080ce4a5b5c7296c6262191e3ab78b91fd8e
2022-03-06 08:30:53
0
68
8abec168e40d85e256da533ae2fb395297201d2e272da9109e3cd1ad8c48619e
2022-03-06 07:53:16
0
69
ca98f3e0b45cac59f30ce81f157d0df6adff78979a386c1e320af6543c128846
2022-02-28 13:03:39
1
69
f271075fea4f019adbfedecc6a0b8b403ff28603d94a5961b0fdc2274c4b5230
2022-02-27 06:20:39
0
60
30874e1768847c9134090e01baea99d82adb0a519108688d2118dc1c206ecfbf
2022-02-26 23:30:21
1
70
3fedd8ce0635011143c7b1e69ed999069997482c34a335449d633d345a009783
2022-02-25 15:02:14
0
70
c0cbb415787071093ddeb80d3a18a11ab4ff9046407ea431fdf904e6a9ccc426
2022-02-23 18:07:29
0
62
ac6e7c6a620493f1fbb2173688ca6f5969be42960077a1e98347541a6b505918
2022-02-21 18:13:29
0
61
3633984526e54aad0f88d14383de453c4f19165f660ed2a67896de036dc48247
2022-02-16 23:10:39
1
68
0112e3b20872760dda5f658f6b546c85f126e803e27f0577b294f335ffa5a298
2022-02-16 07:03:04
1
63
cf9c4432bd568150c2615fcee122086da2e8886a8f3847dbbcc221ffc3f48ee8
2022-02-16 00:53:49
4
67
a8d26f39f0481bea3e31b36ae5168e1582827bf56cbff036c1800a7ed9dd3b59

Rule Matches per Month (last 24 months)