SUSP_Base64_Encoded_Exploit_Indicators_Dec21

Rule Info

Author
Florian Roth
Minimum Yara
1.7
Name
SUSP_Base64_Encoded_Exploit_Indicators_Dec21
Date
2021-12-10
Description
Detects base64 encoded strings found in payloads of exploits against log4j CVE-2021-44228
Tags
['EXPLOIT', 'T1132', 'CVE_2021_44228', 'DEMO', 'SUSP']
Score
70
Modified
2021-12-13
Av Ratio
2.96
Required Modules
[]
Rule Hash
09b45d81c438c03ac8eda9a4b6979bfa

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
3
Suspicious (< 10 engines)
47
Clean (0 engines)
37

Rule Matches

Hash
Positives
Total
Timestamp
VT
8d56caa364cce1d8a23f7c560f9f9887b8f0e6075deabcc5e64938275ef5aec9
1
61
2022-11-29 11:45:56
c585f22ca8feadd2c9565e724d548f1bf5fcf0c659087087ce58008d31fa5b54
1
61
2022-11-27 19:29:22
7a76dc835ad8aad245b7701b04783c406c8f9e513ec63700af12195217d90c76
1
61
2022-11-24 11:57:04
1b1a1b532923cf69c197f16e08a2c86e9aa56ac430b1f79c75debc49bfbe22e6
1
61
2022-11-24 09:37:32
98fdfcb1cf0a69521c4127bd04623fea0e17151e26dacff574e4402a7e689953
1
61
2022-11-24 08:08:22
cf9a5bde0eafbd083b48ca6f907a3d313b61431c70e382d742759abb3edd7195
1
60
2022-11-23 08:12:23
0317241e4aaa87c80bdab57f32a2fafa7f46b730e6c7a38cd031d8a9193d7098
1
61
2022-11-22 10:08:08
333ef80ba19815c3f427dd5e9d8dc98132e9e49e3cc39bab8727a67e9bae3a5f
1
61
2022-11-22 03:12:15
80c28e9539b58ce9ac38adf7e1f1824e60d0784f03946b21a5c593223500400e
1
61
2022-11-20 04:14:36
9b19ec862725a2e478863c41e4c033ca4c04596a324f25b0985d2bfb5fb5066c
1
61
2022-11-18 19:49:11
4e9ce6d0042e86688c826324e6d92f2d3f101159de9741a2f4e68d45daa3a0eb
1
61
2022-11-16 09:07:15
004251aae37b06b2ade7db976275ce475af10a9a32524365b1dca16738ab9d7a
1
61
2022-11-15 11:37:32
fe9bddc6e3bf4903bfdd1bbec08e2a9be565974b431c9020fdfe02d47833d686
1
60
2022-11-14 16:32:51
a3d38be05fda7cbb1a0166514bea9dbd8d9ceea6b01d2c78b8a2c3ae7fce1b3e
1
61
2022-11-14 14:07:37
d1ef6cd040240a868c80d77ee0429df8bd0bf28b703edf40b64c63970bcbb736
1
61
2022-11-14 14:07:37
bef793050b6aa3dbfebc5d6033320d51c23f4bb64336a5bf4e6b9ba618aa5445
1
61
2022-11-14 14:07:36
ee98da38fa1ebc7e429771d06aa276223c6b59b236de97d348d66e49826b0dae
1
61
2022-11-14 13:55:48
6a911cff59a0921ada0e4e8310332bf22b6a3c8df02091521c5300558f01cad3
1
61
2022-11-14 13:54:44
ddeccbdbb44c22de57feb7740f7e78e57679857170143e3ad7c7214db7ff356b
1
61
2022-11-13 21:14:43
ff8e74bc651b29bd2dd3ca85750d5911433dc8e56707d19e770eb0342a44f9cb
1
61
2022-11-03 03:42:08
6d26f8139fc5852a0bc9b7a52f04580d813c49a0b26c2090b29aa0fff9cd599b
0
59
2022-10-03 12:53:42
b122e85904baeb7506c52b2171b94a0bbda0d187bf209fec3b90fa3388225bc5
0
60
2022-09-29 11:06:22
8ea0c73ff2a3cea0154553d7ba4172fa3ca328fc6f66e1c166ec0d9148ec006d
1
60
2022-09-27 13:24:29
f1a01e3d8430e84e0021b90d68c9e2b2aaae58acedcf7088f57a954a976c6692
1
59
2022-09-19 03:16:06
6f123ff3106f247e75c9560325fe99f8c0854beaa5ff365a86f408aa7455caa1
10
59
2022-08-26 20:28:46
be198fa8fc602e5c1c88f74adfa67df7ba009543f701928146cf117eae9ff225
1
59
2022-08-25 07:14:32
397ab1d688093f8bb4867b68222bef9d1f9a17c10918b725f512aa8153bb200a
1
55
2022-06-13 19:09:28
35b8d1371352cbf3569f33c62128f15b83880ad5ba4322dc937edcc824a2c1da
5
57
2022-05-26 07:06:30
45e4d666445e600305aabceb2e341d592bd931e20fe0d9bf661d7856ef02f544
3
57
2022-05-26 06:12:41
d3713650d9441783e737d81a4dfdc55f03354b35a4988cd419ee563cbd9e57a4
0
58
2022-05-17 11:31:16
d0de6b9da10b1e0b9949f31c05d799cc07c267c5fa6b504b4d5f0178edb79dbb
6
57
2022-04-24 07:40:25
73d93ffab80eb4358268a1784dba66224fc96fa23b26a65f9201bf631e82c7fe
0
57
2022-04-21 16:10:51
b3163f0a1fbbb12567ce2ad58240c0ed7d3aee2ebadfa86e65fd8559f959a09c
1
58
2022-04-12 20:29:40
17936e70307972295bb8e9609bfc9d86ee83fc20e4e81bf19baf5a0ea85a292f
1
57
2022-03-30 10:07:39
c9478015f13863e57635fac5bf559cae3332e7024cfcc45d031eaad56c7b62a3
0
57
2022-03-28 18:16:03
5b2c04c23fcf0b0a0e8ac9077ba2452d1594e862abf73173a8be95fc54132acf
0
56
2022-03-23 09:45:43
254fb732e53d28b4177c247f7548132d6983ab95b9192ec6ef2084e2543db0a1
1
56
2022-03-23 09:38:10
da3e9e5f35f966c5cc3fef913384493ad514730055a0f4b5ac7dc45177dccaea
1
57
2022-01-22 21:50:38
1b7d6def1dd599f61b7b0d225bafb911ca850805628e418dfd0c5193016911a7
4
55
2022-01-21 16:16:29
38a432e6e16430ab03b7a345904b3ffbdf75fb48fa94d835211f83b5454ae0d1
4
58
2022-01-20 07:53:02
cb9f0dca725fa0eae8a39c7d07e62441d6ae50b776df8a9ab1cb7f86a22c75ca
8
55
2022-01-19 14:27:56
83b1f868940a46ee17cbc47ec8461ecd9b85c1951403d5ae43c9ac46631eb2ec
0
57
2021-12-31 15:12:18
3f2972e7bc64908db29524a2a04c8456058ba28aba6e098104c45a0d6934e0ea
0
57
2021-12-31 15:12:18
eec28fc801f021adf5f56fe037c6d7d84ad002c0aeba4976d2a2a9b658ccd019
0
52
2021-12-31 15:11:57
a2f8c3878f0af9cfc0e2278aebd71df4a6019cdf5692b7cf7f9b89c4d9160276
9
57
2021-12-23 03:16:32
e7c7a9c258d952dea928a3624c38ea37f1599b82d39d3c7360b804fc13130084
7
58
2021-12-21 17:15:53
d50fbe7077b1d3f507fea8defe7563791ca37efd6e802d632169a049a90e8994
0
55
2021-12-21 03:17:39
094da9fb31b753ed07a99720ee6b251f0d0034ae633f81bb21613f0f9f944d70
2
56
2021-12-21 03:17:39
0bdfc81dab816e1dd2327ae7cef236fd445f41b35376ced8debd2d7fdff24aed
0
57
2021-12-21 00:40:35
2c76ad86ef6e62403d5a3e522ddd6b681139b4c9f1fb683ce0aeb44121c8ea45
14
56
2021-12-17 23:47:30
6245e1ac4150602a46b67420b44fae3c475a8392dc663f17c3711aa39aaba834
1
56
2021-12-17 11:14:46
f32e675d011bff435f224203e226302ae0297c0bcaa30657b19e096d501944fd
0
58
2021-12-16 10:05:59
caee62557f914d5346fb358d61f29cf2c973f6e44c4fd9946a636875c85274a4
2
58
2021-12-15 18:31:33
832d4658041bb85348c3be1141bee275946d917fd54d26e7b66ea9d453e95388
0
56
2021-12-15 04:53:23
8692666433ec52f108298adc06cb4ee94930ec937e89718db181e4fdf2df83fd
2
58
2021-12-14 19:30:59
2abf4856594569dddc9cc1405758d0fe67dd3e62249476a3ac5311afb65a823d
2
58
2021-12-14 19:25:30
3d138afd0676f62db6b30010f1f7abcca20b7d3d1323654c7aa864b49ebbb98b
2
58
2021-12-14 19:25:23
65e1ed73651cc83d711b9832d7c162659bbf71a343038e094667983b29014243
0
57
2021-12-14 17:09:34
a1b9bc554dc8ef326449c910f8c695c686b82a6f35f3112d33c5d9f160b001b7
15
54
2021-12-14 15:28:37
bc07f56c6ca3c35115caf47ae585e43b9628b15237ea07ae716e9a5fe9077229
0
56
2021-12-14 12:16:01
83c96295a76b77cda82b74ba97c33db8f03965cd5f1025dc623b764322d2edd1
0
57
2021-12-13 13:12:41
020628fd94530a28e53d715a4dd5b6e2ebee66694a52522568a99b5860b8b73c
0
58
2021-12-13 12:28:50
6b5b251a8ccc3892eb6838b4af44924aaabb99181e95f7e175472b788cac7404
0
56
2021-12-13 08:27:28
2d0e0b944881ac3ca2ca890bcaf4e427ef1267cece95174fd5c94890a1bd2166
7
55
2021-12-13 07:27:27
e1c46ec8b9f8c57d3d193379849d84fca73dcc4684bf1397ae129b6c8d811529
7
57
2021-12-13 07:26:07
a939b1db7a329a41dc80282f57a6f99d71a6086655ffdca25917a80a2f2bc9a2
0
56
2021-12-13 07:17:22
85b6b2454e750d5a8a0307a6938ec4380723f5cde1a1a87a4e843b6942319816
7
56
2021-12-13 07:17:19
e47e705b6d7a1ccba7b0c421c4f07ba4b6ceac6e7123fc1d2cb05d1aa4f3a4c2
0
56
2021-12-13 07:15:03
332b6dc17abf9ad6ef9860db7139dc1d481f8d4091ee001c94e79ec42ab9792c
1
56
2021-12-13 07:15:00
2c77a8a26b4bbf1aeb2d101036c1354580f0875df81e8eeb9930f505b0edaad0
0
57
2021-12-13 06:47:20
6b5109e1e4c76b5e06d9bd3118e26215651ecc152fa957c360017da9689b7683
0
56
2021-12-12 07:30:04
1034307a9f000a7a5c835e014c663050f0b3ab2ef60e761968f2967ba589d619
0
57
2021-12-12 07:27:54
dd2eff8ee8d8a5e5cfb5adf9f575ccb92d6faa570ee6e0241dfb33ebd2343ea2
0
56
2021-12-12 07:26:49
b5808176e1f4d67f1ac4599f137035944c399df92e0cb5fcebc34287c99d03bb
0
56
2021-12-12 07:25:48
50b1e878e0b87c5e1b27db6d58bfa9dc1363f1d2bd2dbd58fd771ffb38450c62
0
55
2021-12-12 07:24:44
c85db5d0eb26979a95cd653e28d6fab134f5ce03574c21b74791de75e5a67de8
0
56
2021-12-12 07:21:36
68a95c15a7f0b50a1eea5acf053d3fdda53dac46cb36392e8ac574d82579d4ea
0
56
2021-12-12 07:21:35
633b0b7efede0053e4b4ab0aee3a511d459c0eb2f78a3389cbe2aebc12cd38a5
0
57
2021-12-12 07:20:33
033209c1c40b22d986140f866bda49499b2b4c5490820cee1946b9c2ba7bfc47
0
52
2021-12-12 07:19:29
8ee998cbaccbfbdea23d37c6cce5991bf63628a1a8b01925fe355c2e3dd8def3
0
57
2021-12-12 07:19:27
6ddb9de34b860ccd16143e71d9a6f24baafe78c36c885499a991e6143c7981e4
0
55
2021-12-12 07:17:17
e3c0e3ebe483448185263b7a61e139fd83003f145eb51ef199ee267921995d8b
0
56
2021-12-12 07:02:25
ce06ed30774e245c4eead6b62e4a173c886a87b7d8b9fe7ba5d7c4b0b72fe08e
1
57
2021-12-12 07:02:25
4fa7b29c5546c65fa743a68a1d93b79dca6ee1ee1d4ecdb90ff9bd13250716d9
0
56
2021-12-12 06:59:10
171cd4bb38157ca2a9c7e6457a1fecf4bc72196ad53b3c1299b50e1a1a5d7daa
0
56
2021-12-12 02:30:55
0f6eaec34516e9645410d704dd6accaa381dd23ac2aba3801e208f59d296923a
0
54
2021-12-11 18:51:56
c0ad8b4b83b3d408d0384b43a4e558d94453147c99aa0b4bc662b4896638c41e
0
55
2021-12-11 12:27:16

Rule Matches per Month (last 24 months)