SUSP_Screen_Capture_Indicators_Sep26

Rule Info

Name
SUSP_Screen_Capture_Indicators_Sep26
Author
Swachchhanda Shrawan Poudel
Description
Detects scripts or binaries containing code indicative of screen capture. It doesn't automatically mean the script or binary is malicious, so further analysis is required
Score
65
Reference
Internal Research
Date
2026-09-16
Minimum Yara
3.5.0
Rule Hash
d2c58163c9caccd9666d4d14a22da25c
Tags
['SCRIPT', 'T1113', 'SUSP']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
13
Suspicious (< 10 engines)
15
Clean (0 engines)
67

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-11-13 23:34:31
1
62
947c9c575052097edec7ecfff1e0d1ec839713ebf61b9820690fbe4abd07d52b
2026-11-13 13:15:39
0
62
6f6e7690f127cca505113cb1e123a49796869a5a2b797d4d0e884b8366759cba
2026-11-13 12:38:10
0
58
b5e46f5f3426be1d8d826716e4cf3eaa2a6dcc4806e57c18a625fd74b1c77b0d
2026-11-12 18:47:02
0
62
0c27febd803c1f90b0fedc8142abbd1a7a258cca404a27273a3efaa9c5a3879a
2026-11-11 04:21:29
0
63
d59c1a9986dfec261ba10c4a119580c780f1059a46db4d8c989a978451152e93
2026-11-11 00:50:09
0
61
06360e95e724e1b3c59f441cdb4f2ce217bb60d01498c2fd4d3227c0f4c56cc2
2026-11-10 16:04:41
0
63
44a9bebf44fc9e96feeafcf09b64e10e4d6596548dd17c1b8678a55f338e307c
2026-11-10 16:03:12
0
63
e644ed57eb46053514410da6142c1a7238ba10cbccea0af0e5236f03e12a81d0
2026-11-10 16:02:43
0
63
372ec5d39d7dc860507b27d474c27d73d349b9c40f73febbad047b60637e1fb6
2026-11-10 16:00:59
0
63
07f87c60fbbb65cfd59784861b413116d163cac7d0ff014a68d2823bd0dee603
2026-11-10 01:23:52
9
62
33c984f405cec8ad157eeac5e92632eb5c00c6af8269a6835d67e4acfc940296
2026-11-09 21:15:55
0
63
ce23762fb95438b0a603a2a6ace5a578b7867f7ede0a01fa3938962d20545057
2026-11-07 20:05:12
0
51
984be97d9ecdfcd08e1fcceaadebb4c8f0e28dea408a91798b474747780b84e9
2026-11-07 02:48:39
0
62
1663623c32275215b46007408f795d64c07e8baeb60c0bf827c033b076549e5c
2026-11-05 23:27:29
7
70
2919097e0b0f25c10b2a3ead54cd708d822122a6bc692a2866b055092fee29a3
2026-11-05 04:28:06
0
63
2b0cc2b5e7c10ee94a4784d981e4224c8438569e8ba9e61ae53dcbf92342a86b
2026-11-05 02:03:26
0
63
a35bb7f5f9c7106e1cdc74b027fdc738172d5a8ce2b01555e1b7a8fceac63333
2026-11-05 02:03:26
0
63
7d6596431f6d6de43de166d7b51d6bfbe2b11f4d66555d0d19945b6792789662
2026-11-03 23:02:39
0
62
d1de0492c7db883dec07595bbcfd5de4c7617b84e83b18e940363a43b0b7c199
2026-11-03 02:59:58
0
62
f6e79704973179b631d83fe7406f227b8e408606b0271d2bc9fc6c8749d26053
2026-11-03 02:58:51
0
62
23b570f49e4255e824f47b9e2ae19c4afa8fe97264e38e3333e8a8d61b18da35
2026-11-02 20:01:55
1
64
dd4104b7755ed7a37e487aedaf8ed42d7c82c8536e0c19aa6ee489885b794966
2026-11-02 19:49:09
0
62
f2dadaf10437eddb78f7cca85b6f2cef3cc869ebaa1c22da45d3389f4b9bf9e8
2026-11-02 19:48:31
0
63
c173d36e79e1408de5e3bfe53feff4491208d98e3f9672ea96084ed13a600337
2026-11-02 19:35:53
0
63
38f22f8e35b6d77cd3fa0d8da428d0a591c3873bbff1ef0fc9da93788c7c2eea
2026-11-02 19:35:01
0
62
7c604956d60e66133b168b9a4047ad9a9cbd0cc8878208bf9313393273488b04
2026-11-02 18:31:01
3
63
4b754db36152b8c48ba496190a516b9bc048a88989bb5942382bce3c691f8099
2026-11-02 17:50:49
0
59
85219481c676180e0f98d8287d0c3570053a65e83d77c682bd121c2a5ef64d90
2026-11-01 03:01:47
0
60
43390e98a941728aaf750f374d1c4e78cc7401df67341a826105327e050e108e
2026-11-01 03:01:37
1
62
fa28e581d1f9901bdbcee43b35c914594222875090348b11b15111dec8df943f
2026-11-01 02:37:09
2
62
2caab090ac392014e238dc512bda1807748ed83fd74ce1accc17072d9e209e4b
2026-11-01 01:15:27
0
62
88d0f0051b9963c75a93837731b28d01806dc411e03701fad942c581c6d0e44d
2026-11-01 00:23:27
0
63
664d33ee17f1ba099b41287c8f03c6726d39f3fea61e277e5f99b4ea4cf8528a
2026-10-31 23:40:18
0
63
9e106ad641f344d14edee1359b85c2e55616fc3729743bb0b3b72f590bca7ae1
2026-10-31 23:38:26
0
63
e986c0bcab3e57d39e5ff1a602dbab693a1b6431e916b63a6cdd1f0f4cec8472
2026-10-31 23:30:46
0
62
a14411d351636716158969acdf3c2e2a3bb2fe8de8b7e8b8bd48a80ab98c9a13
2026-10-31 03:56:56
15
72
02a91036a7e75ce86c897bf4ef44ff6f97a23ef06bf81e7ef4281c3228d7bd22
2026-10-31 01:09:25
23
71
0bea9402c6785a93b0fb41c933b065946ecee22b046b9f88a539f7a90991ac6d
2026-10-30 22:23:47
12
72
46ab0c346184ebcb28c32300351726157a7cdc058feae09ef72c2f62c3166314
2026-10-30 03:19:17
0
62
8bd5ffcfe85e1890e5ef870ba566672863e430b393049f8afc8c9a04d23b0b32
2026-10-28 23:57:17
1
63
4da05418bf3239ba81d50f4cb32036c326770fee20703b76ffc6c592a2289484
2026-10-28 23:26:57
0
62
f3111c3e55af28700d344248f0160f2d12cbb3ac5d9049840368cbffd75d8876
2026-10-28 23:26:39
0
62
88358e7cafdf326b8b264c7e04598b1ae9cc6bd5f5b14c131ec5a848ebd5b079
2026-10-28 23:02:27
0
62
f97be65a3a58c7d789c3ee893a2694c3ca52ef3f6b0dd58cc33f0cdb194b152b
2026-10-28 22:38:09
0
63
8e3579982117b7a1c0c7029aa5413b110dbbf62bb92aa93a685d39790a8898d9
2026-10-28 18:07:27
0
63
77f9d4a9f7f6c31c161aa225f4c2a0fa8a9a432b48d3153bf2a348f2349dfdd1
2026-10-28 11:57:06
0
56
6746a48f27487f6d78195c27d3c2e7f495b388aa61780d76306be7da96bc6121
2026-10-28 11:50:16
0
62
a8d3e81090305edbf25a6f3ec8f57d84d7d1f4f4197ac732be6b006d04320dbf
2026-10-28 05:02:09
0
63
37c1b6e315904c70e2e0a3d389304710992ec22ca7712ea9bd8a8cabd19491a3
2026-10-28 03:22:43
0
62
c9000e31696f623cf6f832c87e5756ac64eb7005a3f98fa1df877a7ad7d7b503
2026-10-28 03:22:42
0
62
0afa9cedf52b077702d51fdf2bd71451897e5360768465b0df4af0000dbe7b24
2026-10-27 16:42:26
0
63
b3c3c1cf79e1c1934188b2900f8b3e0486452dd3cedffe789933b04ed94079a8
2026-10-27 07:53:27
0
60
4fb6c15676c86bfc1dad55fb6d245da2b1cf37e2e02551051233a663beedbaf7
2026-10-27 07:16:18
0
61
bcd3ade5b92ba11649e0ed23b702df3a3a3844f9b3e51446990f5bd6b5bc7ff6
2026-10-27 00:33:26
0
61
2f3ce9d55c8b99777607e777604457218fcbd8b122103396b66d9ed23959b7fa
2026-10-26 17:29:47
0
61
db1f485798fc1aacfde39598184f4a3efae1204fcf3733e2127be77b06a53d93
2026-10-25 21:54:18
7
70
01914ed461fdbf9396e0a6bf95afdb37edbbd8f7b11c951635f9d4df9afe3e58
2026-10-25 19:22:07
0
62
902fb8bcb61830ede030e1a78d33ab8141bbba8f8ddffcddbbf68cd9ab4dc35d
2026-10-25 16:36:38
0
62
48cec0078a8620f093e366be89bd9f87a35bfa456814b393616f42b761344da2
2026-10-25 16:36:36
0
62
098136e776e53cb60e0f8d8208c56cf22d5d7c188ba51a779a26c457940a2702
2026-10-25 02:36:09
7
71
3aa10e695a52bee80cbfde7236b24ac09fbf052cb2d39839dc50fc5a0aa21b3b
2026-10-24 01:30:57
0
46
216c6ef06a71e227e3e26dd34ee478a5ab4ff09c027a5db58741b0cf277fc9e2
2026-10-22 00:49:48
1
62
18aac3cb4eed8a203e0b11ff1d82ddf6f21faf6a908916ab2c2d010a60190b13
2026-10-21 17:01:15
0
62
6632a72d423e2fab0ce253d5b7ce52eb564fd290cf98c538b607e48a1dd0c2e6
2026-10-21 14:25:56
0
62
4bda9692b2ddc86a12a3b11da0f5738346cb1ab2ef3537fbb8616ebe3ee940cf
2026-10-21 12:19:58
0
62
92940d99a032bf3f7fb6434d7986982a13bdf285a0120e4ca93c7baa645ef484
2026-10-21 04:21:57
0
64
4fd90d785ce405a74924ac06523375799e76fabf97bfe9c602ac158492e44860
2026-10-20 09:44:16
32
62
89c491ebc550c003395388f161f1b9b9b86827ddb843746abcf144a86c24e5ba
2026-10-20 06:12:56
3
58
9165aca66a9d89b749236dc2f49186c042cfff76acaba9696fc9b1b0e798fab9
2026-10-19 23:41:49
0
57
0d3d5cbe1081f4982dceac16cd7e79f2bba0de0d7c7ca665c55f760dc52800af
2026-10-19 19:25:38
11
72
74ef1041d43f8c61ffbe916a5a617413a95afb2217323e4f93afca89f48aa721
2026-10-17 22:32:36
0
61
f5768e276c8bf90beea53e9b2fc8e7be681bd56e0fc1a3b74e8ab96d0dc8f906
2026-10-17 04:48:26
0
62
43f142b502baf9e7b629325f48e0bee31f851697b979390fbb4c5082ee19ae6f
2026-10-16 22:30:38
12
72
0316cb9cdea73adf41bb4868a61714fccc971eeef6b811c6deab127ecccfd8e1
2026-10-16 06:18:59
26
55
d7545b6dacebdae27effb3c778c5e349027ec789c76ae4f777bd9ba56a70cdaa
2026-10-16 02:34:09
17
58
9cb364fd94f8ddfbde23079d51dcf2761fb0408f58f926a065c8e4ed76d0342a
2026-10-16 02:28:58
15
71
49d7fa8039c0d4bdaf726a6b540b6a22758589ad0e7b7c49ccd9136337be39a4
2026-10-15 03:00:07
19
54
10f41901a3e5da8a9d1f64d6dd3ac504afbb4b1e43eae4635fea189c8a7d1727
2026-10-11 01:11:56
0
62
e0255ba47cd5c547e53b3cd34f1fadcc793d404108646d1756cf045376eeaafe
2026-10-05 04:11:38
14
50
c8a2edc52bd034fa36525830f338f2cb48007465240257876bb5d1f1f6ef9034
2026-10-03 02:50:17
0
52
bb5a7d9f61c71f97961b936d85b89d0f344acb9f8918ba2c2590ea39c0b3b202
2026-10-01 04:03:19
3
62
30226e03f52febda31fee8841d5e4a31de3ae87c56450a1c6c2f6b5a9d7d6a80
2026-10-01 03:51:12
10
57
9f1402143a88942d1d0454816fcfbd17c69f6a9f2d36b16eebf4aa7ee2afa069
2026-10-01 01:23:55
0
62
ea80395ccbbd31ea06858d158e01388e674df709e5ab5356bb0d27087c59243e
2026-10-01 01:23:49
0
62
1d7c102f62c70d34bc7572bd8869a31ce578f796ca2add958b30a65d721b1f53
2026-10-01 01:23:36
0
57
c064bb79d330208b97c08f9a84ab34b4b16b13ba887bbe33c319d28338bd8bcb
2026-10-01 01:23:28
0
62
ec8e72b27160d742ddaabf4a354249ecc6312b0f3871fc966b32f18eb20bbdc2
2026-10-01 01:23:17
0
62
71adbb10ea043e00bbe0424b5e26020356dccd6b847a221b6f1ddba846a37f9d
2026-09-30 01:34:45
0
62
ebcd62ee3b701422f114411f538e07d2e162b546c6cb680495bed0492370c68a
2026-09-29 20:22:46
0
61
b83d9fecf665b9c98cf2357e6f067d2abd73ade647c22f5428eba3b2612c24ff
2026-09-29 12:10:37
0
62
d721985a6b744d0daf3dabf986ab236f5586ae5a99800f68ea7e1792f773246d
2026-09-29 11:03:17
0
62
360b17bc0733d64decc2cc2b6afdd27e70c602096f356ea004bb0cccb4e776b9
2026-09-29 06:27:19
7
60
3408939eb256f6a1e786ee31fda00556ad56cf2eaef93d711a5a09b2c1ebead6
2026-09-29 02:10:00
5
60
818350a4fb4146072a25f0467c5c99571c854d58bec30330e7db343bceca008b
2026-09-29 02:09:09
17
69
1480a54d433e13758b2cec03fb5378b36284ce7a027b8968be69e609cc34f6df

Rule Matches per Month (last 24 months)