SUSP_ASPX_PossibleDropperArtifact_Aug21

Rule Info

Av Ratio
5.9
Required Modules
[]
Name
SUSP_ASPX_PossibleDropperArtifact_Aug21
Score
60
Reference
Internal Research
Date
2021-08-23
Minimum Yara
1.7
Author
Max Altgelt
Description
Detects an ASPX file with a non-ASCII header, often a result of MS Exchange drop techniques
Tags
['T1100', 'DEMO', 'WEBSHELL', 'FILE', 'SUSP']
Rule Hash
182cc17bc9c2e5015a07adbcd1c734a9

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
13
Suspicious (< 10 engines)
130
Clean (0 engines)
8

Rule Matches

Total
Hash
Timestamp
Positives
VT
57
a39be1a395280bb4805c46a42818651c8a71e7600b0ae4e66ff1e1f5d607d4ce
2021-09-24 13:53:39
3
56
3f1e9a3856a947a5709f50da23ce2412baed664c4b9bec492e368178c9b842dc
2021-09-23 17:34:35
3
57
252459af8ff0223a14f90429ad47ee72b9ff364310ae40b7413bfdad14a92185
2021-09-20 18:22:50
4
57
fe8da3382d36259c74197580968acd4841f9dd219e46d1e6818c98a326ebaab6
2021-09-20 18:20:38
7
57
44cc98b1f6d68eb6337ef852bf9bd673f027be0be7d4d47de634e09f2876b511
2021-09-20 18:18:21
13
57
cf7be27fef5ea0d625d17d87aae8c22907612cabca5ddd03eb33b55a1545a0fc
2021-09-20 18:16:07
12
57
edfaaefd18327c1fc8f3778435f8345179d27078ac690b3f9b0e7a5d6e9a75f3
2021-09-20 18:14:49
12
57
90e9267c40f5319b0b6035b61aac7b34388be192ea8520abcc014a522c3cacdd
2021-09-20 18:13:38
12
57
caeadf7e2c70807e002aee6758d9bb36eca531e0dd7991afbc1f2b9f4f4bc354
2021-09-17 23:07:20
3
56
94955681b886118cd1d2d5f1fd93d3f8f5b570a701340ed1142aab45bfe84f27
2021-09-14 10:32:08
4
57
9d39585a55e9e6e100a01bb18d30a0da31d280b1c4846be699ac7192ce493cdf
2021-09-14 09:44:32
11
57
50ecf66dfe2cd21b75e8a568e4eaad0cd33b5dc320cde8c2cfc4de6a5a21367b
2021-09-14 03:23:32
4
55
1da946432086a771c6542e1195f39f4b60f6e3c318cbb8625867ba435f531dfd
2021-09-14 03:12:33
2
56
894334ab1726fcd341c65dee8ac2a5cb4e6667bd461cde6685e88c63966d716a
2021-09-14 03:12:27
4
57
b2b56855818007463951ad9c7491204a23f7eae8953761ce71c9334eb6cd29a4
2021-09-13 19:34:10
4
57
760ee6d1dafebbdd55e228f7b406d700318b1b3d47cba2e8c52258b2b557e81d
2021-09-13 16:41:00
3
56
a4626992b992cf286a915ce9514190f2a785b24749019d05705b4672469655b8
2021-09-13 15:11:35
3
57
c090ef2fcb8787d00105f57cafba8c8356b362cfaa15f2bcadd6e0b79a894d37
2021-09-13 11:31:54
4
57
ddc52c922d8d420e727cd119cdc5c0fa98d7238222153281a589aea1a857314a
2021-09-13 11:19:49
4
57
b1de1a3e50471b8f92d2d6c6889c9bce78c058f9360e66209c4828e20986beb5
2021-09-13 04:05:50
3
57
81f804bbf1be8c43e46dc92b7e35af9dc078df7364a15bf2fe9407a656513326
2021-09-13 04:05:38
4
56
d25f55a2e7958be59cc047acc548e549d8e0cdb22a68aba4fc1fc810106a8b06
2021-09-13 03:36:56
3
57
d696d0b2cdaffbdfcc2140d3a6381ccde29acbc9ebde822d0e84868028891608
2021-09-13 03:36:56
3
57
354cc25b1e337e8431fadf3d136c7afd9f5f92bf778cc3f45c8d6d3b84040fba
2021-09-13 03:35:36
3
57
5aee4c701c1235797f1690ed4e5a3a07e9a67f8b5dc3bed4a623140fd60a16d0
2021-09-13 03:35:34
3
57
12d507f8dc32e4a21c64fe0608c913a60f5ddc28aaf5fc0bdcc41be07b0626b8
2021-09-12 21:16:56
5
56
d4faf3b5167b5727645858ce521e846b2f5b93b5fc3f3537bb80d4b918de3220
2021-09-12 06:28:21
3
57
7cfd1f39b920eba6f0fc316d2843c0c231ee4753782ac5c1b162bdc696fc0916
2021-09-11 18:53:55
3
57
6b40917cd1b9a3a9f3c9f821de25ecd2db6439c42c30b4bcd909b5cf629fcdfd
2021-09-11 18:52:44
3
58
71c5ddbe7c0f35cf5f7379615db1cd757886c8ab9286205366d2db9da9b4e768
2021-09-10 19:07:18
3
57
b4d95fa9a44bcdc855ba1bcd9ffb08655361a4f7fae209183534bfaa2b00259e
2021-09-10 16:47:34
4
57
27db83b021f38e377419139d0b8d8b38e3692c9c6a239e0efa09b390da4f7c07
2021-09-10 00:40:51
6
57
a233b59fcb781d8d52fba16414f43e15dd9bf8988e57436092be8a1092874a20
2021-09-09 17:44:06
2
57
f44ea71fe0c61462d4838b9385b4d03810c35ae139b09d513bc37ec7d6ac83a6
2021-09-09 17:31:35
2
58
59ec34ad3bc754b522d22499d584c8ba54e700acf2bbb3c5f36f728f9e4ce9cc
2021-09-09 14:29:25
24
57
c40bb70961718493bca3154fa66d56b5e7bdd6329d50e28a44f2e3ebed86d947
2021-09-08 23:48:01
2
57
9e39fc0efa51117fea2058e5f42ec6b46aef4d0f22ed0a729e6b55b4ca92003c
2021-09-08 23:33:19
2
57
d076fb74b46a87d0ce60a659f76051e4dec926b2c2b8fa056aba8c5205789c7b
2021-09-08 23:32:09
2
57
149fc40ae7d5bb326f6d79fbdae4bd60508ecf0eff7b4233fe06b74f4c55575d
2021-09-08 23:31:03
2
57
ef236d68bb3281ed0613f8464c3be896e21c91215b2bf691ca8ba20149870cd9
2021-09-08 22:15:06
2
57
003ac94211125c22dd207e6e7c47ad6e11f8aa67400b023619244ebf877b3984
2021-09-08 17:53:23
1
57
2e9e7b216c0c5f4e2124c57078b9cee9b06b2b706d8c6333908a26a72bd7c8e7
2021-09-08 17:51:08
2
57
f1a94d155426f62013c7e5db5739bb4e1fdb7c8f9ffce559ad24c02bc76a1d26
2021-09-08 16:44:39
2
56
5e325fe1441f8ba12a24322f35650cf753f3bbe6929738f790a51946eac4be78
2021-09-08 11:50:24
2
57
ee0263519006e1351964f0029615b196f5ee99da1e17c0a4fcc471cb87cb745f
2021-09-08 09:36:05
0
57
93a592203aba8b0780da6b131aef65a924f5421b76aa0ef263b3b12c963804ff
2021-09-08 01:20:42
0
58
d9db05b5ae8b6e2911da6f3130c2df9f77a0cc9c1ada94dbef9dec08fbabef1d
2021-09-07 15:30:42
2
57
d3142dff9306c8014449b0cb6b19ec324fa7f0dfad86d2ae6b777933c8075175
2021-09-07 15:05:46
6
57
dc5f25344237b471a25a3e62c7bee921a91a7c0c09578e381c20e5aff7753379
2021-09-06 17:42:52
2
56
0d8824c22a819a86619bd4ed2b204f08986e70bcb93c82e7685041039f681580
2021-09-06 17:40:31
6
56
d16c5c1031fff665dea8661cfe58948d55daa24048b67e4c9718f1ab0fe09431
2021-09-06 17:12:35
2
57
547abefd7e6168ff49943be150ec5881ad0b676391b715f19524d9be5bbe14c2
2021-09-06 12:37:27
6
56
640d85aad75ed79cccda6ed045ab02a54829e5bcbe3ab025d42ed8a8750131a5
2021-09-05 10:20:41
1
56
d584d5bb264c4eba590a19d50e2ff3232f0032e466e9892aaa08915b5d9d6048
2021-09-04 17:36:38
2
56
0ce2371e23c8c2dd3b4c32d57922f67933cfb8fc0685e57c2f320606aeed6006
2021-09-04 07:57:24
2
56
1d46476684259eabec0dd6f4d43f5e698367b6db4a250ce8c058ae894786fcaa
2021-09-03 22:20:15
2
56
a6756a853657bed0baebf10c3b29f1a2dc9f3502e25d78e74bdd67e72130a0c9
2021-09-03 18:55:41
2
56
669bf4612671bc23d09718ced54be029a7bd78851fac42768b551e5eb10f773d
2021-09-03 18:50:01
2
56
01ead86f03132846d2fb9e12bfd90e1f0e5cb2ee9011eae994f1b01d93d0021e
2021-09-03 18:45:43
2
56
e1f8b085dcddd76dae47fcf239e88c8e09230fac157db1babcf0a711681c74ae
2021-09-03 09:40:52
14
57
28c481f0ac650bda988f2331d91b77138760df3561e2faa41c354ea919db7324
2021-09-03 09:31:47
23
57
fb8138da771c40f3c2d519ec8204f87e0b15a31969c735faccbce706ba64b59e
2021-09-03 09:02:02
20
56
74ebf0533b4c78ee51833c80fdffff97794ead91a0ae2c60ebb92b8093ea51fa
2021-09-03 08:54:22
20
57
a9b563809d982e35ed5b0c3035bd6545b24ab0895b05547d0ce95ab8e3ecf54e
2021-09-02 17:13:12
2
57
9dc437db3042db293333bfc0bbf8a2680b132cd2af471d51587b9342863b5d97
2021-09-02 14:06:05
2
56
28e0dd0d737b0a4472528e3dc56051c95ad555474ce450647eea87978d45b68c
2021-09-02 14:04:58
2
57
de9d94bd3836be54c0ccd7b30e8905e8acb6de319bbd215e760702fae6f11aa9
2021-09-02 12:26:18
2
57
6a67ef54c9f5942f71b5abcc1684eae5affbca3dc642b9bae9ff556d01f48d66
2021-09-02 11:47:31
3
57
7a624f1eb90cb6c596289c8e2263e2faf445a34fca82a0b7fdf0851907287881
2021-09-02 06:21:17
4
57
46cd129cf21b74d2b620993324fe866bb319cd1cc85f7e2ced18e1be2b94c021
2021-09-02 00:11:39
13
57
a64ca716fe516b2b91e169e18382b30209fedebc4bd04134acc4d5b66f4742a4
2021-09-01 18:03:08
1
56
85cd9b4fb24a44b598e7a551a956741d85e714232519babd2d465990a2c6a9fb
2021-09-01 17:30:04
2
56
0c9262def06f4230ace9ac29864bf04268c90b216ba447b7917355ec41534302
2021-09-01 16:46:15
2
57
f0e7c68fed73f2f6ac393e8e293ef6d02e7882351bb3699cc49c7e618a38ccf5
2021-09-01 16:13:24
1
57
03ce360f3d4da33240643f4792f2739c8d86a8264d2a4b302c75ada206b16873
2021-09-01 13:24:22
2
57
138173b22d52dbd815d76f7e59a781161d9f7d878e61df9927bdac264284ac7d
2021-09-01 13:22:11
2
55
b4ed10545f6e1d3981119cb9c7ae2386280011332b8c2170500e38c337155fb8
2021-09-01 03:48:32
18
57
83873a737584e266a94607caab991f44635143142b74a02a38bd8000c9f9bc87
2021-08-31 20:28:06
2
57
090907bd3d74c47a229365968459477368579bb7da8dd8e5c4687e68e6f0a082
2021-08-31 16:02:48
2
57
52f55dae632dfa1c891d9e93d4b2e452aef2a57395bf1119fbeab30c99223177
2021-08-31 15:46:41
2
57
91a34ac3205b5805c0272a512bfc6ed3dfd47dc3f9967d71dbaa2220b61100c6
2021-08-31 14:44:19
2
57
e7eb7630be2bf20ea60c8f064b371cb5a9289b520a8ea8e58c1a647be75c8188
2021-08-31 14:28:25
14
67
eaf57091c67570b7e7f147853fa95c6d4f5ae375b84a069ba0d832248a62a982
2021-08-30 23:42:39
5
57
f4dd6a2a9d98e5b443f2c48d07c1dfa2b476c50d93a8a6e634ba8a3b5e9c4137
2021-08-30 23:01:16
2
57
86ee3a29f9fa73857cf3f5baf9145b04e036b085e268f1a7bd07988c2fa9a245
2021-08-30 22:22:12
2
57
f1bad64788f5105c808a29cb633ea80a5a7a43a212abe9fc353611f78ba14a1a
2021-08-30 18:32:12
2
57
93294afba92c7a208f0f451f879cf595e07ec835f7d2e0a277fc2cdcb089e89c
2021-08-30 17:21:00
2
57
82f2dff544b32d6c0bd23ca5c6ab66cbd11e8aa56d3c99fce90cc47ef1198cdc
2021-08-30 16:14:08
2
57
0891a5f5852fa545c66975a760a632a600a1f30476cf14d70de75a78a72c1899
2021-08-30 14:56:27
3
57
aa0f7f726e46c2ba260f2d42ed817e9780fd4fa69229d7041d00bb859683568f
2021-08-30 14:49:32
2
57
b6201ce466a93a460f6a6708858aff589c09bca4758dc2056b4ab217ea5ca69a
2021-08-30 13:33:10
3
57
dec82a6585071cbce5a34388ae75d0adf21854fd53e20a98ba23d9d4dfa317dd
2021-08-29 12:46:54
2
57
5651ceba95f8d5ec3a44fe2b59f838197752401a3d11cdf5d9f151d9486b58ff
2021-08-29 12:41:55
2
57
46df018134ab6d632a0fde6cc2cb8e9c5db9f9a92a4a773232ddb68060ffcbfd
2021-08-28 14:43:46
2
57
5821400ad8ec51743f2a87516e2f0d94600dd7f184155b87a21b4c725b0f0328
2021-08-28 14:42:42
2
57
2cad7d43c68c89e35ebca28b211099a19c61f3195eccdf56cc1f8a7e240ff77f
2021-08-27 17:43:06
2
57
4166bbd6414a956651375c02c890c5789051b4eafd476bef10ef9c27d76e635e
2021-08-27 08:41:04
2
57
6da2fe4ac56878302394b81654577656387a1627cedf080bdf1fc318fe1a0dc9
2021-08-27 07:23:06
1
57
95f4db364c6bbcf59856ebe38276524c44135f744b68878433eb6526df0b9024
2021-08-27 03:08:42
2
57
c8e3852ea076a677b11db3ba0bdb469495349734fad4dec3a7466a26b7e89335
2021-08-27 02:58:08
2
56
3d4e18a26bec29c279c67291792c2e80881246adc9a6b47c18cb09cda5fbedb0
2021-08-27 00:28:32
2
57
b282cd2c3cb8d0c3f76b2953b10bed69a89887c9133f4459685983539e67fdc7
2021-08-27 00:12:31
1
57
8b90125e1dd683864b689067e7b52fe049fb3cb0374f9ccea8ee5c0dbbfcacda
2021-08-27 00:01:54
3
56
50260f9ea28316125c18b8aa46499c8cccc02960faaca85ceb75ac2bc1c8032c
2021-08-26 21:49:45
2
57
0be99c4c17450e904adc5f6eb54173b8cd216d890e585ec62e1c69c2956cb9c2
2021-08-26 20:18:59
2
57
57cdaa3ff622a206c094237290b06beb3d231f544078a2ed3b916f516e047dba
2021-08-26 18:56:44
2
57
f4e77c019f8776237e314261a4a5706bf041fc37d01be2d4f4738a2867dded10
2021-08-26 17:26:13
2
57
35c3a7ac7d2617114146f37b653ea5b71ad2e802f7e7dd53aee3042f5a925735
2021-08-26 16:47:41
2
57
da86632602286546dc5b732100ed9a9b1494250d35f193caa0fc3bb0979c9bd9
2021-08-26 16:44:28
2
57
eb5d1edb3efd97b2b2fd44acb2330645827bae18903f0583d804c0771369510b
2021-08-26 16:39:06
2
57
27f7a0e46cf103b110d9582645d4219627142430a8bf2b8466d854033f56810a
2021-08-26 15:17:15
2
55
ba19e32832cf72ffa10dcf25495821f6fcc261eedecaa0033ce2428a7ce043e8
2021-08-26 15:05:36
1
57
53d8702ab4b788b26cae1303c689f03b9023ca9af6e20f53c9a619e54f914426
2021-08-26 15:04:32
1
57
b0387cdd3566d8f9d08de6542e689c2010a6258a60acd8e1703f6744b8709c01
2021-08-26 15:04:32
1
57
eba4f2430b32a3172ffa933e4de5ebead29a2531c664d944b431cee92bd3cf87
2021-08-26 15:04:32
1
57
9e582c62802d7b50a67a4fed657a7426d7845b85690dcb063b47a59657147632
2021-08-26 15:04:29
1
56
bea1b1d2adc1ceadec6f13cc43e4d1ffdca0513dc014b4dffbedd63b8f6de6e2
2021-08-26 15:04:26
1
57
5432551501c48882b9ab86d78cb47f972f565875ac3a86dbe0bc85abb4f24908
2021-08-26 15:03:12
1
57
f36d80f379d36aa41edb116356a6a0212e8aa115aefc05736fed7c750d8d8344
2021-08-26 15:03:12
1
57
628450210042c97fafb9252ee688bb2652de9824384eb7bec60b01351dfea0d9
2021-08-26 14:42:47
1
56
5c9bd847b93783619246c4d0bf3d93977e0de872ac67ba356e4cf95af0080d30
2021-08-26 13:36:55
1
56
620abc29d7c5713665d12a63da0b74f6da13951ac1419d5ed9d8e6396f51b416
2021-08-26 13:19:13
2
56
00d5716e288e9a87ae811b95d91d2f3b32cac3b903d5a59f9dfa57dec3fadc36
2021-08-26 12:31:51
1
57
e4c7653db816f269985641c51a5e4e9040292b63b2fa67467451b678b631a8a6
2021-08-26 12:27:58
2
57
2c88b1bc5e7f240a86f54c59bad6cb74c4eb814a65db60291288b11e901a41ba
2021-08-26 12:04:43
1
57
5860d03b8ad1b85f1df692bfb2ca2a78d2ea1f0793cc543e3aef1137ea9062ea
2021-08-26 12:00:47
2
57
24c6e2d04954ecb42b6d12cbd67e9ec9cc8f2a6cf7e13c187b38094e30cba09a
2021-08-26 11:26:00
0
57
12083d48b1f16bcd787fcb81513f36c394265a205537af096a3dd0b997e37401
2021-08-26 11:07:03
2
57
125af0634c47e54fed801b38847becce8ec6b8460bf6ed27538db3cf4b19e5b6
2021-08-26 10:49:51
2
57
e4cc0e0465ff8909d93659fa65db058b9ca82dff9d4a781a33804817fe49d984
2021-08-26 08:39:34
2
57
1a37aeed09ee84089359bf9bf5ab670c01b7d6ca395bdb8ba0a105c7249cf2e0
2021-08-26 08:38:27
2
57
8ee480a11023302c83d4674584f9b9ba1c9e4fb11fcee4c663149b09f125ffae
2021-08-26 08:28:42
0
57
5279ac5028454aefd5ae0052669e5e79047f261ce73c1ba1b95ceebf1705ceb6
2021-08-26 08:25:31
0
43
4456f2b681b4a39204e9d563081efeffadb307f07655b79a8c201f6a3acf094e
2021-08-26 08:15:30
1
57
9575b20bbb9fd2cc0479c95799b5c7dc735ff47beb0119197133df8550bf6b07
2021-08-26 06:58:25
2
57
d98df42ff4b4325b259cfa697a29b74a95571c4489c3249aff5c823030b3013b
2021-08-26 03:38:04
0
57
6496026750329200bd60d74e6710b675766c1d7cde26fa6fc9693048d95c37f8
2021-08-26 03:28:25
1
57
c6b88182381e988657bb97adf8ab1a9a23fb440f4dfd023605da74b2fd3cc936
2021-08-26 02:58:36
1
57
7ce0999ff2353d0d11de43d901a0c1ae234dd58f35402d18cb621098ed7a9865
2021-08-26 02:58:35
2
57
b0721438027f02583335fa80302d448fb498624c8be727e962d099495605cac9
2021-08-26 01:47:00
0
57
b05c4b26438c3ec3e63e4e9db0e9a76946f15b7127e4530ed60fb9a7a8e3bac6
2021-08-26 01:05:35
0
57
18640833d9cb6f190d3ab4e6af792af431c6c958aabd9cd0c6e48db8669b1ebd
2021-08-25 22:20:28
1
57
fb056a7f825405eae08299eb53e19e628c50281ff5d5f3004bf40c9bd1a25730
2021-08-25 18:17:58
2
57
40afe0fa58a0aec46a2c41439e9bbb731f9c4376f96890ecdc5f2a4240207d82
2021-08-25 15:35:23
3
57
ea26ab468138f27f5501d57e77e05961da87caab7cbbb7ec6a0163b68dc0ca25
2021-08-25 14:21:47
1
57
e5f1f7e85110da96963aa5580e7c0ac01bea7bd63825823f471aba5a615f3a5e
2021-08-24 20:27:51
1
57
3a2623c800041b3c100a5b011c68a0429cc18691af4a223e040132362989d15f
2021-08-24 17:29:04
1
57
c8abee8556193915696953c3da9580c1332862af3ae1e1555edb9445f5edcf53
2021-08-24 17:11:50
4
57
412c7194b7dce21cc8a8da5c29a7e9b885b7e2bcabd57762acefa182878b504c
2021-08-24 16:02:08
1
57
db8e8f4884410166864bedae75baf48b081528334210834a992b5bdd12f27072
2021-08-24 14:03:31
1
57
66fa3ce1b6ba951a8919c4a7650506ba0c5c4525a52428649b7e4fc821277818
2021-08-24 12:04:58
1

Rule Matches per Month (last 24 months)