EXPL_Log4j_CallBackDomain_IOCs_Dec21_1

Rule Info

Av Ratio
2.97
Score
60
Name
EXPL_Log4j_CallBackDomain_IOCs_Dec21_1
Minimum Yara
2.2.0
Required Modules
[]
Description
Detects IOCs found in Log4Shell incidents that indicate exploitation attempts of CVE-2021-44228
Date
2021-12-12
Tags
['EXPLOIT', 'CVE_2021_44228', 'DEMO']
Rule Hash
790752dafd8f11b3356865e224d9b7e8
Author
Florian Roth

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
50
Clean (0 engines)
39

Rule Matches

Positives
Hash
Total
Timestamp
VT
2
ac3b139dafadec67d8ef5eed5226be8054f0ba8338f9b04b64defd2c504e6085
56
2022-06-17 06:12:26
2
7eb04d01a531400161d34ee90a68516f5de89e88453bdbe902a5ef93d6640324
56
2022-06-16 23:19:05
2
69fb39a428314953ff609eeac9806ecdcfee005220a609315b8cec44625bfd03
56
2022-06-16 19:55:25
2
639880b8d611e3f7026345da960a00912c842cea410d4b1c0b4b460b8758e881
54
2022-06-16 15:50:12
0
1ed5be5d8c19de4165f30da70fcaf3a12916427318e68b647b627dc8d8153d2c
55
2022-06-15 11:08:12
0
b1e189573b8c34f327a9e08609d067cda81a71263959dae948d2d50ecb6ccdf0
56
2022-06-15 11:08:06
1
397ab1d688093f8bb4867b68222bef9d1f9a17c10918b725f512aa8153bb200a
55
2022-06-13 19:09:14
2
928b3ade412d3525700771e1854edec11bbd7825aea2f0baadd6a892a13ea981
56
2022-06-12 17:19:55
2
d197fef4f3422c319950dd7a9d87b6793a2454c4abb346d553a73c72ebbc08bb
56
2022-06-12 08:48:51
2
aa343f6a41fb1683cba785dd7933568d845e37c065f2ad1d21291d2558179405
56
2022-06-12 04:22:08
2
2fbe9a5f21c450ad59bddb01795674440ee66fc802a5da3858137d8fc9e9da5d
56
2022-06-11 04:13:12
2
91a3772a5285fd141f8e464d9a10eceedd06537c85d61e32993e6e949c858fa2
56
2022-06-11 03:47:56
2
1f73c09245510f5c17ec58a370512931756f220723ff74ac18d843cf5a2fad00
56
2022-06-11 02:23:06
2
466d0a403553251ed6440afb46e721f072bbdb5968f4eef51d9a92742b72ea51
55
2022-06-11 02:21:51
2
e49ba479207679c2065ddd41ee070b7af6a27ab0831c1fed56d39eed6dee6f70
55
2022-06-10 22:50:18
2
a570be887ce616a9b5e50e9865fba3efdce3828927f9fb2d1523f68bd7fcbfe3
55
2022-06-10 22:41:28
2
0257584cd0d3bdd0b637f16503c12fda9aa845f68a5ef875fea4c0b219ee52fd
56
2022-06-10 22:06:07
2
b59d81ea197a3e369080aff21d2e06d854defd0052c8f86e90b4f90dab7e3682
56
2022-06-10 21:57:39
2
f63ec63fd69a16c2fd6b3a1ebe90ae452a651301b26546723f1f79a343258d45
56
2022-06-10 18:42:07
2
98b4a28229c47bf32480c9e9daf632138965144a71f6f25b51fc4eda2f8cedba
56
2022-06-10 17:20:53
2
5328fa23f5882d65fc4acb8f824e7346f15d431812ef8c421a4cd4074ef8c135
56
2022-06-09 12:09:43
2
c7d101977f80fe219795cac1be1a0c84f68fec3b6eae5090fba701668f140abc
56
2022-06-09 00:55:39
2
01ba6a0b72911e810b5053fa23f49da21cbb4bd1f8eb894325b826e4fda49b12
55
2022-06-09 00:55:38
2
5d49853b8e7dffbc00a7ebbc7fbb0ab69d28409a1f5ae4931fbeaa4b5a276673
56
2022-06-08 19:17:00
2
1e4b8e445953459c0699853e4f17a9acc29f9a78c059aa0ffb8dcd847df81b48
55
2022-06-08 19:15:36
2
b7bd4cbe440c7c4326370a9ddca561886daa0f29bbd0d7ffc39baa3549984fbb
55
2022-06-08 15:49:01
2
7890cbd0dcc3c92ac97338e054c1205cdb43a059a039428c4b745f438f260295
54
2022-06-08 11:48:25
2
a49a49579d8e8322edd8ad0ee00c36480582e698bbe3d3d69d349a4d5752175f
56
2022-06-08 09:13:34
4
88e1b0b16f6306fb1a7da1f5a059beca9ae8bcba3494775180be398c16dadec1
56
2022-06-06 21:13:09
2
e6166da726b5a6d87f1acdaff30cc9a25527be7f231eb3615ffe72cd2a2bc4ad
57
2022-06-02 13:17:10
0
2aa19f41a2ec845e7a7994df63d58183367ae9bb22e51ab9bc0015466b94765e
57
2022-05-31 03:24:08
5
35b8d1371352cbf3569f33c62128f15b83880ad5ba4322dc937edcc824a2c1da
57
2022-05-26 07:06:30
3
45e4d666445e600305aabceb2e341d592bd931e20fe0d9bf661d7856ef02f544
57
2022-05-26 06:12:41
12
5581c131604d1f40b8f7be241327a3912ad21fd18c4fc8e0d96e08c035d1f437
57
2022-05-24 17:33:26
0
247c37a4dd686724b96afea8fe483692014ef357ce04c78eec345a936b760aa2
57
2022-05-17 12:15:54
1
8925dfb0fda52b019a94c54d8b2a219d1d054fbcc924be81a4f1f3018f08d7dd
49
2022-05-16 10:16:59
0
4b636207b7170f34971adb65f465a4211ea07545896ccc996e3609ea1796b50e
58
2022-05-11 11:10:11
0
d780b3e8629186d781e95399b40fcac0ac7f152376f9613ad7809451996481d6
57
2022-05-04 09:20:33
1
b3163f0a1fbbb12567ce2ad58240c0ed7d3aee2ebadfa86e65fd8559f959a09c
58
2022-04-12 20:29:42
1
e1973fe8d87fe89ea1980779a3d7aa5a40e3bb8b1a65d3e59b9aebc5b4d40cfc
58
2022-04-12 13:15:50
0
ff485a12c0c67dffe33aecb7241273108a05b8fc64c221dd94100361d81e14ab
58
2022-04-11 06:42:37
0
1d343ad82ac9c6ce05df300a1cf968b08b0edf8a2247331290f82062af67b762
56
2022-04-01 11:06:30
0
c9478015f13863e57635fac5bf559cae3332e7024cfcc45d031eaad56c7b62a3
57
2022-03-28 18:17:15
0
95ec3ea12a01c409774bba91c883b5b5e76e63864d02e60aac93f9b2d8413f79
56
2022-03-23 06:20:26
1
2d6dc041a7826eddb499903ab22720e4ae318347fb28b0acb6e038fcb9886085
56
2022-03-21 07:37:34
1
bc288661fdae0002b266ab41d1c118f386cc24a2293c458c52538adbe9d6a4a2
56
2022-03-07 01:01:15
1
e69b525c418739f5ed03c615e1417693a955c6914561018cdd82d0ca7ba63ff8
58
2022-03-01 20:35:13
0
042078257f6bcdec2025db609d2c43d309db3ae168cb13c2ea2d1cbf79081f2e
56
2022-02-19 20:13:23
0
5a8a29273c752de1556fc179d102ea6e81a28c7c7eff8ee4b5b95c84030fa46e
58
2022-02-15 17:06:53
0
69a3b5f869ba4e7b54e5341c64af044f38e10b68f66bd4472dee48cf2abc1433
56
2022-01-28 18:19:10
1
7acfe4b98bf8d284f93879ca33c923e03ea9d3f5a34a2520596602bb53419d0c
57
2022-01-14 10:40:21
0
cb536c90a751e66d0ad62823089a9254d2dcc9b02ee08cd804586e8c1ba39bf5
57
2022-01-10 11:46:43
2
35b1dc9c8c26c6762c9d163dd54e89427b19558249675d2040941c5fddd5848e
58
2022-01-09 12:16:29
1
0b6944b57703017eac041812086ae5e376820063e418df2e26a1dfe23aefb276
58
2022-01-07 21:40:16
0
93678ac9ce8ca1637e2bac6009702b8b5c278f2cb75f02bc0a41bd1f5addcf3e
55
2022-01-05 08:31:58
0
4c82c0a5e413245a8b28a517a75a277001fd140e5bda258fa6b6f6c91506aa5d
56
2022-01-03 19:03:28
0
d1e8c08e3444b58245337eb435acc8ff22703fe5896f2775d86b5839a9dab6f3
57
2021-12-31 12:08:35
0
9ed63244cc14540fcf9c907ddaaed0d1475668d9476be0b6f580a6bb960881b8
58
2021-12-30 21:28:04
0
48f8feabb0509204eed1ea1ee8b9834a85fc6eb30a647d26437eb82b08fe7beb
58
2021-12-24 23:44:12
0
ac46725d732f453d039dba13f410be7016750621551d4e57a2d5b769aebe3191
56
2021-12-24 13:11:15
0
b6065c7ed17bcf2471a2a72dfce26f0cdff5e4ba7f02b826fb0093cb94e8efea
58
2021-12-24 13:07:58
0
2c9e2437faaa526c00c65ddb0bd2df518196c2fd72ece4f73add5f1b940ec336
58
2021-12-21 13:10:59
0
ef801abe950cf97b8226761028e776135259c83cab63e85a634b288a9dff828b
58
2021-12-21 13:05:35
2
e798ccba97543ada249ba0240cdcc59e23c190d072de9c39ce879fb7907a34f8
51
2021-12-21 10:17:53
3
094da9fb31b753ed07a99720ee6b251f0d0034ae633f81bb21613f0f9f944d70
57
2021-12-21 09:48:18
0
d50fbe7077b1d3f507fea8defe7563791ca37efd6e802d632169a049a90e8994
55
2021-12-21 03:17:37
1
27472ae94cf677c3eebd7047ff78e581c789f1e635a223a5ca5ebbc4ae4bf5b0
57
2021-12-20 09:44:17
0
aabab7a675d314289bdc37cf95c7d368295f6288a596ec42513168704fcc97d1
58
2021-12-20 08:16:34
0
dc819b2567142b5c828a1ee78bd7290cac562ba45a3155a1f215c73151fc7f47
57
2021-12-19 11:22:17
0
dcfe1f489dbbbe6b752ddfb514cc16c8d78b0b210f3ab08713064aa0e3983be3
58
2021-12-19 10:12:08
0
d745f8a2f21ab3abfdb3d44ef5f9873e287e3b71b52b144961a918250182eb89
58
2021-12-19 09:51:38
0
aeb100cc673027fc32f15da25170651a562111460a5741ad06148d00dee26ca7
57
2021-12-19 07:09:08
0
390bc06ffc54eecc28f2d3539e8326b8aa8481e3c589a2768a67505c55d141ba
56
2021-12-17 19:42:04
0
ff8d89415f242cef7b2e49651631f127294decc00334b501b42aa9ee8945c1a0
54
2021-12-17 18:42:35
0
c9decdb3df040f183af7cdec0f61388bef29c031d217df22d81a088727e3c93d
55
2021-12-17 11:38:28
14
2c76ad86ef6e62403d5a3e522ddd6b681139b4c9f1fb683ce0aeb44121c8ea45
56
2021-12-17 09:42:17
0
61c6099cc4895a19dce1f4c49c2dc92a173adce0fa423741fcf6fed70fcc985d
57
2021-12-16 10:06:12
0
f32e675d011bff435f224203e226302ae0297c0bcaa30657b19e096d501944fd
58
2021-12-16 10:05:59
0
8f808f3f636c486197e9c4e3243091d3cb52d86cbe81a2888c08d5755e121cd2
57
2021-12-16 04:44:46
1
5a0df94349e865723ef7f79040aee15e0d166330160926c658b7951f93e4e173
55
2021-12-15 22:01:18
11
19627c3128e3f598b6e79a4c492bb46d61e626278ea7b6346d36a5d62ab37e92
57
2021-12-15 20:06:02
0
227ac5689f6fba53ad2adabc2b46a96dca96db12f66eca13370d2be0f25bf275
57
2021-12-15 12:44:17
0
13d1cbb80ac3e45e924407e737d5f32366b3165d64d5df944881caf09ace4b20
56
2021-12-15 11:17:40
3
0c269d438b712d0d75ffcfc41d30df8d9a7b30659aadba7641f59b3b0db986cb
57
2021-12-15 07:27:50
3
dd73dbc271b3098272d6eddc53c072ab5191c93ff66201fbb19990604bbaa837
66
2021-12-14 22:37:58
3
7cd855e8b671b1df04dde766a99a0791023571d3ab9901433242bc61be3d8809
66
2021-12-14 21:45:20
0
171cd4bb38157ca2a9c7e6457a1fecf4bc72196ad53b3c1299b50e1a1a5d7daa
57
2021-12-14 03:33:09
10
8bd840119a910f1e8cdd02b521037a78d12adf8828ee37d83536c7ef019985bd
55
2021-12-14 00:28:32
1
2780737e9937864f6b006c1f47ab390e76207111616ede87cc189777103e470d
56
2021-12-13 19:30:40
0
963cf06f2b36d514c7b1ae63a59ea98eea844b3ad32b8c78b6afb3619a2f4fa8
57
2021-12-13 18:01:30
5
8ad328025ec82eefb584e7020c9d0c1db3f0e78602c4fe606f5393f638d22aa0
57
2021-12-13 10:49:08
2
609fb5aaf670c5a53dd3f4ffedcb447c8c7fd20aa9f0b7b58077358303a13894
56
2021-12-13 05:56:54
6
4d9ea905cda378e8537bde96c9808602bedc6dd1c42cc5e0a78f02e82f609137
35
2021-12-13 01:33:48

Rule Matches per Month (last 24 months)