MAL_LNX_SSHHijack_Sep26

Rule Info

Name
MAL_LNX_SSHHijack_Sep26
Author
Pezier Pierre-Henri
Description
Detects Linux binaries that attempt to hijack SSH sessions and steal credentials
Score
80
Reference
Internal Research
Date
2026-09-01
Minimum Yara
3.5.0
Rule Hash
004660f5b6b2b1eaca6afe897fbf1a78
Tags
['FILE', 'LINUX', 'MAL', 'T1021_004']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
32
Clean (0 engines)
53

Rule Matches

Timestamp
Positives
Total
Hash
VT
2026-11-11 11:56:19
0
65
d6cde9a91bb16007e96355ef68b64da1b5cc714a8999c16e10d050f6407c5d5c
2026-11-11 11:53:31
1
65
411dae7e557309d72896513252e820090721937b9b15b0bcd441d6c3b7420ece
2026-11-07 13:19:50
1
61
8fcc68e519ace2c083e53be0dc9a31cd2c26934ffd465f3787f08010448c39ef
2026-11-05 13:03:00
1
65
b7ca07ef0d71025e7d26c4c30aecef72efe2846f2c94b24218194af648f49542
2026-11-05 13:03:00
1
65
21f93b8ab65a48fbb2c31bf6b9460fec5a314f82b468335cf2c40788e2629d32
2026-11-05 13:02:59
1
65
746e727094eeeb5ae2e719d022b3b8b3782cb6d395a18accc9cc6f31e67065d8
2026-11-05 13:02:59
0
65
8e3a29e3dc5ef35beaa200fa29632e12271400b63e359db66e2d3bb939306b15
2026-11-05 13:02:59
0
65
9e902a7b110d77d52fb73105774194fea3b3593032730461999648cd01ce3b12
2026-11-05 13:02:59
0
64
2960b704473a397a6dc9be8eedaeb8f607e644f2ef55de738b29c09305c2b2c3
2026-11-05 13:02:59
0
64
5e6362c7a026f076e457156e71edfce5c6f649182b5a1c9ec76ef8b4481d408c
2026-11-05 13:02:59
0
60
11de9cb9bd50b33604b23203451bfd530dd1c7613dd1df4d086559164d3ad6c0
2026-11-05 13:02:49
0
65
551853c479acab41d273f9f7155a460e61e9ea798fa7ff5937686b352a76b090
2026-11-05 13:02:49
0
65
31b4b53b24d22a71bb1f83c2e524372c727ca1ad9cff8dc5e08b94269e52e31f
2026-11-05 13:02:40
0
65
ea83c97a612a9e74a513da4f5c250f698314bd0e4ac1080d9f3af454517d5c83
2026-11-05 12:59:49
0
65
37fd7ec99b26a307c9eed192700e7b655697e245c501eb0b07b2f4ab2e3ff639
2026-11-03 13:35:51
1
65
c2f0e75abcd7808d2dd005c480ee8b62ee4db02af795d299aa3e6c0933ad6d86
2026-11-03 13:35:50
1
58
61a365fcd7d8bc806a15333cdb6cdd8b2293b6c3df26a27848461d3c3f5a51e4
2026-11-03 13:35:50
0
65
4a2bc8f78e0ae10ba522e323837f1e61e7736382b8271d5b2d1d1be89d9a6eb7
2026-11-03 13:35:50
0
64
dd22468464dd0287f1c27403914c396f0f021e102155b74fabd19e728bd94640
2026-11-03 13:35:49
0
65
734d0c1631eaceb22a26f9294d6c65f1c689d28af52d0579dcd4f34b281851b4
2026-11-03 13:35:49
0
64
5b16447aec473bff2360d846fd3b82016c451fc3127cc082c5f03f19e9225242
2026-11-03 13:35:43
0
65
deec45ade0673d9f200133b2ba3ddd7d02cf55f9993372e6888c88ad845b808f
2026-11-03 13:35:43
0
56
51a5cc63815e13581a593b1b9c3885e127f1456d8f57ff1f04d3a523dbe61299
2026-11-03 13:35:42
0
65
c9703e40657162a2b826c005781963bf9a9a2a4e92f2384f289331bb5efc79f3
2026-11-03 13:35:42
0
65
597c7f6827f51d10c425114b24b703165262614a188f3dc7b3bda9ed729b4090
2026-11-03 13:35:41
1
65
14337bc827a35216ef999f58800229bb26b166f92f0a9dee79ffd9a7c92e8e0d
2026-11-03 13:35:41
1
65
32bc7ffc8456f2307cc15b545a396aae7c6bc0a7d73256724187da0b23f56837
2026-11-03 13:35:41
0
65
3531addaa99752098a6174b063220132931bedc0ea146e1794d075b1ee28ebb8
2026-11-03 13:35:24
0
65
e62a13a35fbf2219bc53bc335985eacc952ab023a3ca365fa99566e18c242bd7
2026-11-03 13:32:09
1
65
eb81ebea86c755a2210b85c5e4b3c67a3b8f812ad509f45adf5b3c18457061a8
2026-11-02 10:46:39
0
62
9d991acf05c10e20a1d1dde4d5f16200eea799c7b26e58ef538cd95e36ca4024
2026-11-02 10:45:19
0
50
abd030a1f10b875f70176ced9e3a50b5b81cc40e3c5c4605e7c951cbabd5f00a
2026-11-02 10:45:10
0
64
4c51e87f8c3890958c77cc04f6cd63e42ebd89ef86cd343b23c607098431dd18
2026-11-02 10:45:09
0
64
82c61ce50c868f14c4e8e9fd84ad9f3302803c1427c9158942d21c3bc5cccd36
2026-11-02 10:45:09
0
63
744f315882fc480d8e27a822385e0284a3cb536fdd9f9071ebe6924205881e47
2026-11-02 10:45:09
0
62
836cfe7e4d3caec16923d8fe8d9929c45b0c678449daabd4beff71a0cc39e6c7
2026-11-02 10:45:09
0
59
989980e475952207a2cdfd27860e248fb5714a94230754b97f82d524ad09f21b
2026-11-02 10:45:09
0
56
7be4411fc5e729e11d99e8135c5195ea320b3cb56b231cc9c241b83be1576153
2026-11-02 10:45:09
0
45
89b58cc7757eb36f664eebc02dedd8dcda5b2133f794d682c864f93605ac31eb
2026-11-02 10:44:49
0
63
8632f8c004fb29cc57dc049b6fb492fe643c727cf917378d6d1ab1db7991f3d8
2026-11-02 10:42:10
1
65
9d4168ec2633576c64a421c06938d1feb126872dcae83d42b068c759d1392b28
2026-11-01 17:50:06
0
65
a3e888c462bac24512ff903771e093f1dc512d4353bf4c8a60992b605fc3091a
2026-11-01 17:49:55
1
65
0dc0ab7be374b683697c88cf7c061e7014c13c17ceea4b48a5a5bf83f4d62378
2026-11-01 17:49:55
0
64
00bd17d19919315dba80a80706eadac98b2d2e9653bfc9ffd15641c2d3e93b3e
2026-11-01 17:49:46
1
65
8fb73728738316bda83da342c8919b9cbd65bc35d30f8d83bca7393d2b91f8cb
2026-11-01 17:49:46
0
65
75c55b80fd54e4d324be07cd529ce3eb19369c9ce7cdf9abf2944e69d213ef73
2026-11-01 17:49:36
0
65
af5ca287c775eea5ed676d12b566dd5d4ed55163c03c708a3d25f9a9d62189f7
2026-10-31 22:59:46
0
65
a99b04e0c857bc4fcfcb54b236c7af4e5687e2414ce828eb3de3c347347a704e
2026-10-23 20:34:28
0
65
1b455df21d6d2f7d8d38236d0b3607025d7a2f27142353f9ef30da9f11b8e6ce
2026-10-22 20:19:33
1
65
2e534866566cdf43500f270c769bcdc9598b6db3227378f8f6608c0f4f68020f
2026-10-22 20:19:32
1
65
d8a7d9b474c96e26ff8bc3b8c5ba26727497054398a96fe66bdcf05f5a8e546e
2026-10-22 20:19:32
0
65
eeeb9ce915cfefd605936d039033ec714671300da4aa1932ed8a5ce48340f569
2026-10-22 20:19:32
0
65
649285285fd90b34259df54974386091cf125a6de0ed10127f41b289d2aa7c63
2026-10-22 20:19:32
0
64
5e9a982e4b2d84af3666a22879c57b06fa32b254d00e64ace670c2e154007123
2026-10-22 20:19:31
1
65
812c65bc273aa8ca91511eb8dad99a5786146aacc5b6d00b3a6b8f1c2cbe24d1
2026-10-22 20:19:30
1
65
f93aaf2f38dfe84ad3ccd79be60e9ddbac6466024e9648b7783c2ef3d1c538e3
2026-10-22 20:19:29
0
65
4816ca5a618e32f32659ee6d8a4dd3c770ea4aec763e67a5324b7dcdacd9849f
2026-10-22 20:19:29
0
65
f6bbdc16c153f5e0d0029cae9e2e5f3a6338c57917e9bd45ac26755a4f68e715
2026-10-22 20:19:27
0
65
9f0fe2abc2cb2acfd923cbb76dff91718a2c160783e3064e8645876451c49bf2
2026-10-22 20:19:27
0
65
71e813fd96a513840213dba8465c53c3bb5e9c73ab9452124a41cf954558cf27
2026-10-19 22:32:36
0
65
6683a1fbaada19b4b48bcb92244722d7b8a11eb617558e67ee493417214a051c
2026-10-07 12:48:36
0
64
4c23b4697bff52d98c6d5d66037ef393daf41b503da2db66f0542f14e4e63b04
2026-09-29 21:41:47
0
65
d16d0adffd59f10812371bda803720722facbb3541b345ac0e99f428738a9b6a
2026-09-27 16:13:26
0
65
2688f2e4a150e434fb9ad94a6f5b831365fe3a04f0ab52c4d73f1a7e7830355f
2026-09-20 07:57:15
0
63
6f71c9a426d473ef26a5635a2bab96bb4a790af269a8955e6978c8d1eee8500d
2026-09-15 21:57:36
1
65
78386860bfb26729845c0832f57c24f52505c2d2b4be1cc41dc8cc1fe0f74859
2026-09-13 15:58:16
1
65
bd08c566baf60110ca6d0deaa12e502b69013f7ba41c641ae334e6b764dd102c
2026-09-13 15:57:06
1
63
ffba71ae2fd556ceea5b58968a5b6a8129a57a6b3c454a54c92ca2c20f0448bd
2026-09-13 15:41:15
1
65
55340fffa9e9afc0c4b30cd546be03b9c742506463a67ad42b57926c186cc545
2026-09-12 04:49:35
0
65
b180efb16aab637f94ad253040b184e63649423d8bb277baed5616d8e2dd4af8
2026-09-11 17:11:17
1
64
79e419ef42fb77e62b06f8c1177008abdf56fa1cc7c20f83fd046d21c0ac562a
2026-09-10 16:32:57
0
60
8ceb2a75a163cde219643602752ef315523ece5d071b8c4cbfc96c8893cd0a4f
2026-09-09 13:56:35
1
65
f13f2c2147e3f9fea20bac798a9c141aa3ce3701cb64a636b73bbd982d44eec0
2026-09-08 21:14:28
1
62
cc71512f6b188c2abed3fc6969d2f222d3e520de70f8ac30ff5882e2734a390b
2026-09-07 23:46:06
0
64
bcb8cbe305565f81313ae6383bde69c68437c0e97b58238da0d2d049b7349038
2026-09-07 13:43:15
0
64
e22bc1cb92faccd2f7547395b7327eb42c4fca0a8d40a86d50a5aebe7842b2de
2026-09-06 23:29:25
1
64
6bf83a1965801d4b1dd351844eef7a0112b61b46d99f2a899b583d408b039e73
2026-09-06 23:29:05
1
56
de65e58b1ea401351409bd26b8dc25140a9899e42a291bcaade226c3a8a82680
2026-09-06 23:27:56
1
64
a313dd613382ad0343ce02b3d636da51d208fb1597076612d98ed28f6ecccba9
2026-09-06 23:27:47
1
64
e443b68f9d6db5efb333566dd6429addb0222b0ff1ee03b19fe733a15b2e63cd
2026-09-06 23:27:46
1
64
a503139770caa290df11c3daa14ed867451c2c1e61e79b60736bf502897f06fd
2026-09-06 23:27:46
1
64
3fe292a764d9fe57427ce774a36387d00e9fc3e55b8e958d64e43fd198131e91
2026-09-06 23:27:46
1
64
4fa82068a6baa79d237164270836135ba30e712131ca4d0572e0ddd916c1ca8c
2026-09-06 23:09:45
1
65
4175d1a7845ffb1215765d6e9cc396ae2766025b910e9c1602c39cdbd869d16a
2026-09-06 06:22:05
0
64
6db0c4b46818163d5ff1a43c735457a767bab1781dbc0afc13145ac4ae087a4b

Rule Matches per Month (last 24 months)