SUSP_Base64_Encoded_Exploit_Indicators_Dec21

Rule Info

Name
SUSP_Base64_Encoded_Exploit_Indicators_Dec21
Author
Florian Roth
Description
Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228
Score
70
Date
2021-12-10
Modified
2021-12-13
Minimum Yara
1.7
Rule Hash
09b45d81c438c03ac8eda9a4b6979bfa
Tags
['DEMO', 'CVE_2021_44228', 'FILE', 'SUSP', 'T1132_001', 'EXPLOIT']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
12
Suspicious (< 10 engines)
57
Clean (0 engines)
43

Rule Matches

Timestamp
Positives
Total
Hash
VT
2024-03-23 13:17:44
1
59
ce1484265f81f17377fc65b7c9acad262a8bb236f84f0cb252d1bb55c47e5897
2024-02-05 14:01:02
1
60
3116f7af0b6fd98ff87e5c2dfe97ab765e78d2ee0f5d1e380a4033ff098b86da
2024-01-29 04:22:37
0
59
3e4ea484ab57f70a7869fb16334120eb8d0ab787a241142bf5f0cf1491382a79
2024-01-18 22:37:08
0
58
ed62729f0aba392982753cbe0f8c205257bca7a81b44f37d6d227da28a3112e3
2024-01-18 13:51:02
5
56
ce4a6cf8f4cc4bd4ea17180731ca2768b083c9fd3aa042fcd5183ed9d1a2765e
2023-12-07 06:00:15
10
60
321db2daf957a449539fe8ae1df30d2a99ce4fa1528d26da6c3c41693f9a5984
2023-09-14 11:49:53
2
59
67a3449d6f00173c5da0c6ef50f7ec8c2453b21c82012cbdf78162cc9eb12b62
2023-09-14 11:48:39
2
59
ee408c4de0c6fb3f48a8bab019aae58de8d2f6c9d83d2d6991893bf44547678f
2023-09-09 13:19:42
0
59
90c37c6b3edfb8c95ced086a5afbbcf46a73c6b79a8f8f8166d8733a851f677a
2023-09-08 16:25:18
0
57
f899b74e9f320e54e10c6708f1d956b8f3b49a49d95b5c5c4689242605c004c9
2023-08-25 06:48:09
0
59
3ce3fc5440688692719c6ad5d2ac22e387bc7273511f918e6dcb3a8d2cf9f86b
2023-04-14 02:13:12
8
60
a9e62d88ca8670c5c6c9b14ce4652b56a78945ed33d0c11e5f8cc30604a4a105
2023-04-13 15:11:03
0
59
988b4bc4df516762681c16ea9427adb4531027023352d9640d767668288a2d29
2023-04-09 01:09:09
9
60
277f8cf1e9c5e363810ca63ecb2e5e73b7a7f8c6fb695fb88716f4fc17a1e4f5
2023-04-08 01:10:32
8
60
0a01c37f7f8ef845174e658fcee4c9958fb859e270e6eb1fdd8187aa28747f03
2023-03-11 00:12:22
19
59
a2856a105584ff31aac6688bbb97b9fd724b929ef4719eed0cd63265812fd53c
2023-03-09 21:12:28
22
59
8dbd281c98c8e176621566e3a77eb8a3b7ae4f254773d56f7033f903dd09a043
2023-03-09 21:11:15
23
59
921ef62b3f202ec8b01924feb5ba51057b7a926fdb2300a44ac71c1b1a05addd
2023-03-09 21:08:46
24
59
961487944beb663f02b0b60ce01fe0e3fc86b8f4669923abb7628f40afd101bc
2023-03-08 21:12:06
24
52
29316f604f3c0994e8733ea43da8e0e81a559160f5c502fecbb15a71491faf64
2023-03-08 00:30:14
23
59
030f41373567846ee18716605dea3ef94d1861b9c32b664d25026d41c3557c00
2023-03-05 21:11:58
16
59
055c81b3c56c79813905dc055ed8822067fffc0576343ac54b5cedd0e3d6b074
2023-02-20 14:20:51
1
60
fbe52200264043b2a2bbcb84879ba44374fa04a19bf7aa17266b7226b5fb70e8
2023-01-19 17:04:10
10
59
fd893fa4adb3371edbecfcc26f1ad69886c0f273bb04db18d1652ab93db8e1ef
2022-12-14 05:34:29
1
61
14d2654442fa7768160e9b13adc7b1e4c43f39a8d992e9be34e3f40e13465cfa
2022-11-29 11:45:56
1
61
8d56caa364cce1d8a23f7c560f9f9887b8f0e6075deabcc5e64938275ef5aec9
2022-11-27 19:29:22
1
61
c585f22ca8feadd2c9565e724d548f1bf5fcf0c659087087ce58008d31fa5b54
2022-11-24 11:57:04
1
61
7a76dc835ad8aad245b7701b04783c406c8f9e513ec63700af12195217d90c76
2022-11-24 09:37:32
1
61
1b1a1b532923cf69c197f16e08a2c86e9aa56ac430b1f79c75debc49bfbe22e6
2022-11-24 08:08:22
1
61
98fdfcb1cf0a69521c4127bd04623fea0e17151e26dacff574e4402a7e689953
2022-11-23 08:12:23
1
60
cf9a5bde0eafbd083b48ca6f907a3d313b61431c70e382d742759abb3edd7195
2022-11-22 10:08:08
1
61
0317241e4aaa87c80bdab57f32a2fafa7f46b730e6c7a38cd031d8a9193d7098
2022-11-22 03:12:15
1
61
333ef80ba19815c3f427dd5e9d8dc98132e9e49e3cc39bab8727a67e9bae3a5f
2022-11-20 04:14:36
1
61
80c28e9539b58ce9ac38adf7e1f1824e60d0784f03946b21a5c593223500400e
2022-11-18 19:49:11
1
61
9b19ec862725a2e478863c41e4c033ca4c04596a324f25b0985d2bfb5fb5066c
2022-11-16 09:07:15
1
61
4e9ce6d0042e86688c826324e6d92f2d3f101159de9741a2f4e68d45daa3a0eb
2022-11-15 11:37:32
1
61
004251aae37b06b2ade7db976275ce475af10a9a32524365b1dca16738ab9d7a
2022-11-14 16:32:51
1
60
fe9bddc6e3bf4903bfdd1bbec08e2a9be565974b431c9020fdfe02d47833d686
2022-11-14 14:07:37
1
61
a3d38be05fda7cbb1a0166514bea9dbd8d9ceea6b01d2c78b8a2c3ae7fce1b3e
2022-11-14 14:07:37
1
61
d1ef6cd040240a868c80d77ee0429df8bd0bf28b703edf40b64c63970bcbb736
2022-11-14 14:07:36
1
61
bef793050b6aa3dbfebc5d6033320d51c23f4bb64336a5bf4e6b9ba618aa5445
2022-11-14 13:55:48
1
61
ee98da38fa1ebc7e429771d06aa276223c6b59b236de97d348d66e49826b0dae
2022-11-14 13:54:44
1
61
6a911cff59a0921ada0e4e8310332bf22b6a3c8df02091521c5300558f01cad3
2022-11-13 21:14:43
1
61
ddeccbdbb44c22de57feb7740f7e78e57679857170143e3ad7c7214db7ff356b
2022-11-03 03:42:08
1
61
ff8e74bc651b29bd2dd3ca85750d5911433dc8e56707d19e770eb0342a44f9cb
2022-10-03 12:53:42
0
59
6d26f8139fc5852a0bc9b7a52f04580d813c49a0b26c2090b29aa0fff9cd599b
2022-09-29 11:06:22
0
60
b122e85904baeb7506c52b2171b94a0bbda0d187bf209fec3b90fa3388225bc5
2022-09-27 13:24:29
1
60
8ea0c73ff2a3cea0154553d7ba4172fa3ca328fc6f66e1c166ec0d9148ec006d
2022-09-19 03:16:06
1
59
f1a01e3d8430e84e0021b90d68c9e2b2aaae58acedcf7088f57a954a976c6692
2022-08-26 20:28:46
10
59
6f123ff3106f247e75c9560325fe99f8c0854beaa5ff365a86f408aa7455caa1
2022-08-25 07:14:32
1
59
be198fa8fc602e5c1c88f74adfa67df7ba009543f701928146cf117eae9ff225
2022-06-13 19:09:28
1
55
397ab1d688093f8bb4867b68222bef9d1f9a17c10918b725f512aa8153bb200a
2022-05-26 07:06:30
5
57
35b8d1371352cbf3569f33c62128f15b83880ad5ba4322dc937edcc824a2c1da
2022-05-26 06:12:41
3
57
45e4d666445e600305aabceb2e341d592bd931e20fe0d9bf661d7856ef02f544
2022-05-17 11:31:16
0
58
d3713650d9441783e737d81a4dfdc55f03354b35a4988cd419ee563cbd9e57a4
2022-04-24 07:40:25
6
57
d0de6b9da10b1e0b9949f31c05d799cc07c267c5fa6b504b4d5f0178edb79dbb
2022-04-21 16:10:51
0
57
73d93ffab80eb4358268a1784dba66224fc96fa23b26a65f9201bf631e82c7fe
2022-04-12 20:29:40
1
58
b3163f0a1fbbb12567ce2ad58240c0ed7d3aee2ebadfa86e65fd8559f959a09c
2022-03-30 10:07:39
1
57
17936e70307972295bb8e9609bfc9d86ee83fc20e4e81bf19baf5a0ea85a292f
2022-03-28 18:16:03
0
57
c9478015f13863e57635fac5bf559cae3332e7024cfcc45d031eaad56c7b62a3
2022-03-23 09:45:43
0
56
5b2c04c23fcf0b0a0e8ac9077ba2452d1594e862abf73173a8be95fc54132acf
2022-03-23 09:38:10
1
56
254fb732e53d28b4177c247f7548132d6983ab95b9192ec6ef2084e2543db0a1
2022-01-22 21:50:38
1
57
da3e9e5f35f966c5cc3fef913384493ad514730055a0f4b5ac7dc45177dccaea
2022-01-21 16:16:29
4
55
1b7d6def1dd599f61b7b0d225bafb911ca850805628e418dfd0c5193016911a7
2022-01-20 07:53:02
4
58
38a432e6e16430ab03b7a345904b3ffbdf75fb48fa94d835211f83b5454ae0d1
2022-01-19 14:27:56
8
55
cb9f0dca725fa0eae8a39c7d07e62441d6ae50b776df8a9ab1cb7f86a22c75ca
2021-12-31 15:12:18
0
57
83b1f868940a46ee17cbc47ec8461ecd9b85c1951403d5ae43c9ac46631eb2ec
2021-12-31 15:12:18
0
57
3f2972e7bc64908db29524a2a04c8456058ba28aba6e098104c45a0d6934e0ea
2021-12-31 15:11:57
0
52
eec28fc801f021adf5f56fe037c6d7d84ad002c0aeba4976d2a2a9b658ccd019
2021-12-23 03:16:32
9
57
a2f8c3878f0af9cfc0e2278aebd71df4a6019cdf5692b7cf7f9b89c4d9160276
2021-12-21 17:15:53
7
58
e7c7a9c258d952dea928a3624c38ea37f1599b82d39d3c7360b804fc13130084
2021-12-21 03:17:39
0
55
d50fbe7077b1d3f507fea8defe7563791ca37efd6e802d632169a049a90e8994
2021-12-21 03:17:39
2
56
094da9fb31b753ed07a99720ee6b251f0d0034ae633f81bb21613f0f9f944d70
2021-12-21 00:40:35
0
57
0bdfc81dab816e1dd2327ae7cef236fd445f41b35376ced8debd2d7fdff24aed
2021-12-17 23:47:30
14
56
2c76ad86ef6e62403d5a3e522ddd6b681139b4c9f1fb683ce0aeb44121c8ea45
2021-12-17 11:14:46
1
56
6245e1ac4150602a46b67420b44fae3c475a8392dc663f17c3711aa39aaba834
2021-12-16 10:05:59
0
58
f32e675d011bff435f224203e226302ae0297c0bcaa30657b19e096d501944fd
2021-12-15 18:31:33
2
58
caee62557f914d5346fb358d61f29cf2c973f6e44c4fd9946a636875c85274a4
2021-12-15 04:53:23
0
56
832d4658041bb85348c3be1141bee275946d917fd54d26e7b66ea9d453e95388
2021-12-14 19:30:59
2
58
8692666433ec52f108298adc06cb4ee94930ec937e89718db181e4fdf2df83fd
2021-12-14 19:25:30
2
58
2abf4856594569dddc9cc1405758d0fe67dd3e62249476a3ac5311afb65a823d
2021-12-14 19:25:23
2
58
3d138afd0676f62db6b30010f1f7abcca20b7d3d1323654c7aa864b49ebbb98b
2021-12-14 17:09:34
0
57
65e1ed73651cc83d711b9832d7c162659bbf71a343038e094667983b29014243
2021-12-14 15:28:37
15
54
a1b9bc554dc8ef326449c910f8c695c686b82a6f35f3112d33c5d9f160b001b7
2021-12-14 12:16:01
0
56
bc07f56c6ca3c35115caf47ae585e43b9628b15237ea07ae716e9a5fe9077229
2021-12-13 13:12:41
0
57
83c96295a76b77cda82b74ba97c33db8f03965cd5f1025dc623b764322d2edd1
2021-12-13 12:28:50
0
58
020628fd94530a28e53d715a4dd5b6e2ebee66694a52522568a99b5860b8b73c
2021-12-13 08:27:28
0
56
6b5b251a8ccc3892eb6838b4af44924aaabb99181e95f7e175472b788cac7404
2021-12-13 07:27:27
7
55
2d0e0b944881ac3ca2ca890bcaf4e427ef1267cece95174fd5c94890a1bd2166
2021-12-13 07:26:07
7
57
e1c46ec8b9f8c57d3d193379849d84fca73dcc4684bf1397ae129b6c8d811529
2021-12-13 07:17:22
0
56
a939b1db7a329a41dc80282f57a6f99d71a6086655ffdca25917a80a2f2bc9a2
2021-12-13 07:17:19
7
56
85b6b2454e750d5a8a0307a6938ec4380723f5cde1a1a87a4e843b6942319816
2021-12-13 07:15:03
0
56
e47e705b6d7a1ccba7b0c421c4f07ba4b6ceac6e7123fc1d2cb05d1aa4f3a4c2
2021-12-13 07:15:00
1
56
332b6dc17abf9ad6ef9860db7139dc1d481f8d4091ee001c94e79ec42ab9792c
2021-12-13 06:47:20
0
57
2c77a8a26b4bbf1aeb2d101036c1354580f0875df81e8eeb9930f505b0edaad0
2021-12-12 07:30:04
0
56
6b5109e1e4c76b5e06d9bd3118e26215651ecc152fa957c360017da9689b7683
2021-12-12 07:27:54
0
57
1034307a9f000a7a5c835e014c663050f0b3ab2ef60e761968f2967ba589d619
2021-12-12 07:26:49
0
56
dd2eff8ee8d8a5e5cfb5adf9f575ccb92d6faa570ee6e0241dfb33ebd2343ea2
2021-12-12 07:25:48
0
56
b5808176e1f4d67f1ac4599f137035944c399df92e0cb5fcebc34287c99d03bb
2021-12-12 07:24:44
0
55
50b1e878e0b87c5e1b27db6d58bfa9dc1363f1d2bd2dbd58fd771ffb38450c62
2021-12-12 07:21:36
0
56
c85db5d0eb26979a95cd653e28d6fab134f5ce03574c21b74791de75e5a67de8
2021-12-12 07:21:35
0
56
68a95c15a7f0b50a1eea5acf053d3fdda53dac46cb36392e8ac574d82579d4ea
2021-12-12 07:20:33
0
57
633b0b7efede0053e4b4ab0aee3a511d459c0eb2f78a3389cbe2aebc12cd38a5
2021-12-12 07:19:29
0
52
033209c1c40b22d986140f866bda49499b2b4c5490820cee1946b9c2ba7bfc47
2021-12-12 07:19:27
0
57
8ee998cbaccbfbdea23d37c6cce5991bf63628a1a8b01925fe355c2e3dd8def3
2021-12-12 07:17:17
0
55
6ddb9de34b860ccd16143e71d9a6f24baafe78c36c885499a991e6143c7981e4
2021-12-12 07:02:25
0
56
e3c0e3ebe483448185263b7a61e139fd83003f145eb51ef199ee267921995d8b
2021-12-12 07:02:25
1
57
ce06ed30774e245c4eead6b62e4a173c886a87b7d8b9fe7ba5d7c4b0b72fe08e
2021-12-12 06:59:10
0
56
4fa7b29c5546c65fa743a68a1d93b79dca6ee1ee1d4ecdb90ff9bd13250716d9
2021-12-12 02:30:55
0
56
171cd4bb38157ca2a9c7e6457a1fecf4bc72196ad53b3c1299b50e1a1a5d7daa
2021-12-11 18:51:56
0
54
0f6eaec34516e9645410d704dd6accaa381dd23ac2aba3801e208f59d296923a
2021-12-11 12:27:16
0
55
c0ad8b4b83b3d408d0384b43a4e558d94453147c99aa0b4bc662b4896638c41e

Rule Matches per Month (last 24 months)