SUSP_Compressed_ZIP_Path_Traversal_Generic_Mar21

Rule Info

Score
60
Reference
Internal Research
Name
SUSP_Compressed_ZIP_Path_Traversal_Generic_Mar21
Description
Detects potential attempt of directory traversal using a ZIP file
Av Ratio
0.36
Author
Christian Burkard
Tags
['GEN', 'FILE', 'SUSP']
Rule Hash
347b0e8102b79d9c487fefe2bc1205af
Minimum Yara
1.7
Date
2021-03-10
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
1
Suspicious (< 10 engines)
4
Clean (0 engines)
71

Rule Matches

Positives
Hash
Total
Timestamp
VT
1
18fd7093b030dbcf9efefc4e8bef25e40674eec042d7dd1d7c0fbc7a017bedc4
61
2022-01-05 00:15:04
1
79dd9112783bc0544c60afd2ffdbebe1181c6da1a4252de5f985c60a77d8a432
61
2022-01-04 22:33:14
1
22fc52d26e52aca7563f74b18542ce485c8929d6c24521b22d242e0dd9cd198b
55
2022-01-04 21:43:58
1
b183449cc2a0e630103c53f3fe43be1b1f76e86d84974590a26b80f527cab2bf
61
2022-01-04 21:29:43
0
e599d4e2cbfb973bfc470fbc718c175f611beef1ebbee57b6880c614fb8c2079
61
2022-01-04 07:55:11
0
1d40cb127355908c1e69bc0e0f2c7c05d79bc2d2953d498dce357272017c1d9b
56
2022-01-04 07:54:05
0
b86cc19e25803ab98ab42476d525ec0e555b88c5a535375259a8bf62c0a8517b
58
2022-01-04 07:51:37
0
4afd1db2765c79eafe5a33d5062769eff9345595716739f6572ec5c66864bd64
61
2022-01-04 07:48:55
0
b6d506936238b609379d1ebe6ced6a7f5feb2235219d92ef70e0f0aedd1076de
61
2022-01-04 07:47:45
0
e08885d8917a4db853946fbd0e5e94671f249055ec451289a45e3cc860dcec28
61
2022-01-04 07:45:11
0
d57cd4193a10d0dd41d94f577c8ea50cd288cb8e95cedb0c327cc9f41f720c29
61
2022-01-04 07:44:04
0
30d691dc0f5df1be536dde4cb38d912f22a36442f6f246c34e3c769d48419bed
60
2022-01-04 07:41:31
0
b535d973e089895d84c8cc2b40a97dabbdb0836656218e3f2632cb6b09ba3ee7
60
2022-01-04 07:38:39
0
25433ee5f4379f63c985c69901359d1674f021438c61d9d04121a0e4168a668e
61
2022-01-04 07:37:15
0
03792b6bed4cf52d92b226dc99a811bfdabe239c6ac64399cd4427c4dc26a7ec
61
2022-01-04 07:34:25
0
f9b70e391a72ee88b5f369ecbd350d9ec17655af42fe37f9246d4f6938eaf63c
57
2022-01-04 07:33:14
0
3b015049d6f6c4382e3f9170dbe113f78b9d376c490992a62cdd4a77a42ac156
60
2021-12-13 21:15:24
0
715d3fdf2bb8de81a977db2779dd6d01796d462eb64c670f886415c8e15a45af
60
2021-12-13 20:02:09
0
24eed898d34c07c2c95ea554410be0bd556d7dfdbf301ccde103d8b3873f0779
60
2021-12-13 19:56:35
0
08326b20de158eab8cfe1e52fc75ae6a465aa56c9983721d5556df3a12293d07
55
2021-12-13 19:55:32
0
5865620492eb7454b067dceead9dfcf581dda896bf668fd20ea65b0ee581cb21
58
2021-12-13 19:45:36
0
19b67a235392d3908b102b749ed6d6e850876b37d43bb7f0c4561fc3184282ce
60
2021-12-13 19:44:20
0
677ea9ed306cd29c25f4df5df199c507b8cfe101f5fe4e386c8fb56495ca952d
60
2021-12-13 19:41:49
0
e0128523df129fbbfd9415ff5e8b2edb237936e6f1584eded5c34028118866d3
60
2021-12-13 19:39:35
0
0ad951d6b5e02b36b9bc3166d1614769998ed8c4dd6db5bfb1d59d409971de17
59
2021-12-13 19:37:08
0
d0e6efcdbc2f6de8d20f275f86f7e078b94ae4b26d68f6cfc49554a63a22965f
57
2021-12-13 19:31:58
0
a0c52b059c9e9115e805d30f9c8be33c243019bc42bbb4e5a71fa33fad1d1845
58
2021-12-13 19:30:46
0
d0458d5fc10d92a39deed031b60a6a5e4ef53b1d2781ac647770259f816ebfda
60
2021-12-13 19:25:58
0
40ec4f35824be6f29ebdf983562a6a1608f86c89ec970dc0c21077cafe38e309
61
2021-12-13 19:24:49
0
6996cc185410354206e83e31cea0868ec6cc36659017dd09f8745bc4308efc58
60
2021-12-13 19:21:37
0
3185366f273813b9d47e48a7b9e7eb054739aa7d6824f416f55630c408b220bd
60
2021-12-13 19:10:42
0
1333879129edd24a0fc6a0926c87aacd178a300a00bf3f0a369b869465eb4d88
60
2021-12-13 19:04:18
0
ce03e493b9832498b0e37ac6363e08e4d4edb5016441f693201c7478c2316f24
60
2021-12-13 19:01:31
0
167e78ec126de3d476f2735e4af05160f75556445760ff0f1a071b063faf0123
59
2021-12-13 18:53:47
0
cc971cb75c7057e1109b298dba056b87020ee02aed2f20b3ace0a08897349984
59
2021-12-13 18:49:29
0
a6cb54493ebe3de5280fe98601ceebf074ad79fc8a903df6dd446efe24f0ec5a
59
2021-12-13 18:44:39
0
d85e455ab23652261fad953a6276b7c1adbe159e435a97f5380682df3b20cc4e
60
2021-12-13 18:40:53
0
f80d3da3bbbcd643ca0df8ee8e1ce298b781d9e23fc48151cca7220228a503bc
60
2021-12-13 18:38:07
0
32c07e03682e0f896d7a7fe618c617830f075cea71a1fbb375571f552f07ad34
60
2021-12-13 18:36:59
0
147b8fcb10254e2c7d560c357f7536a919f919e2dad77295043ec2fccbaef3a4
60
2021-12-13 18:34:23
0
546bcd15d1439eb04aa54b6daf881090ff525a4a9dc5d7eea6d3596ab4f03b1a
60
2021-12-13 18:31:58
0
121992a3f5d899d6337f0339085a5b139a481f7e3c8f5fa07cac38d691701bb5
60
2021-12-13 18:29:16
0
6b45b2afa79df7e848bd86d66e2b79cb772deaae47ecb3c6ca85441c48b34bb7
60
2021-12-13 17:47:11
0
7902543b31485ed603d8f119bd389e5e8ef5af2a605a72ef6cb3604ba13e48cc
59
2021-11-18 10:13:09
0
67422f5f2ed5537cd74e7880c3952231f4eae031fc2b088b81dcfe619f968c74
59
2021-11-16 11:09:01
0
3162805d970c38db338e2fbb781f99e2227ad77bcdf8878b90e90ca6d8f1f3f0
59
2021-11-15 20:38:01
0
67c26c1a58f9df20cc9186bc396d4b58a8d11ac98d437dfa67355c2bc823e386
59
2021-11-15 16:28:11
0
ad8dbef947649fd9f9a895e45a6b1886ac09690e32c8e42ac7a98d1e55154122
59
2021-11-14 16:17:57
0
17aab230ebed424b3f9b8782f62a1f4ea6be619a1b1fca712e997db0f0b18491
58
2021-10-18 13:37:06
0
000cf39c16eaa9403041d0a6284820193e491e389855ba449aab576ae7250e98
58
2021-10-18 13:34:47
13
1bdce1ad74cdc44507a91e089dfc43fed5c17c150c24818e7822749f8eae505f
62
2021-10-08 16:16:24
0
c103bd1925a7f92fb55d559d7a1c49bea9d8d960f218a4b8b45951333846c277
60
2021-09-22 13:20:22
0
491a0b48aa3350c1dfe74c71773d374f047d4cdedb7dc6e2bd81d50c508893b8
59
2021-08-22 12:22:42
0
f0e6c9c1655c3237540df7a91f46a5cabf009966ae2d6aa073d141174f2aadd7
60
2021-08-21 10:19:48
0
53167208554b0221ed0316ba347b65d3ae72a1d9c988f4753b21d19f2e8f4fbe
61
2021-08-14 15:51:11
0
8dd124be250007808832f736d2c34c0f3cf4224beaddb4edbd43c852fdd05f9d
61
2021-08-13 16:44:26
0
7ad150eeac33c7e436c992827dc9ac1a9929e6b5e7e45d7217c525702cfbf437
61
2021-08-09 15:44:39
0
8e191813a207c3bb3185f8554b1b36924f8dde6224fefee167da689d9543ffa9
61
2021-08-04 12:32:14
0
ab54a625fff145e9959ba5acd935c3550c9f9411534664f0ef59beea0d8cc50d
61
2021-08-04 12:31:10
0
d382c0eba0c54af28337968f8648223bf2bfeadaffed12a3c71fd4acac302b0b
61
2021-08-04 12:30:03
0
195e64ddcda20e5691747717383783beb75efa64edbf1666fdf672c9eca4195b
61
2021-08-04 12:28:50
0
71c448c10717cc02f9981fd40d623169efd3485e705b4c33c3208fb6b6e6b083
61
2021-08-04 12:27:47
0
588c6a56a8163e5fc02e6393b6f0957febe58906dde49a278a14858d7033760d
60
2021-08-02 15:34:32
0
ba4ede18a3813d29ba7a257f2c9b297fa3fc2e9ff581f237ed05e6ef044df8e2
62
2021-07-21 17:54:11
0
0a7f61476dad052df7cd311707eb36dcdde50612aaa36728f8fba1f289818e14
59
2021-06-24 11:21:48
0
9d916db03aa2e85384b257daddf7ec681079331d105606d0654b24daaaf26658
60
2021-06-22 22:11:18
0
23b9dbc22d75b3e24b4324db8668af0f5f3259f589f2effc70eb091d235d295e
60
2021-06-22 13:23:59
0
b3f25a17a20943b46f4cdbfff8f39472e9e16803933de4a5651890c6c3f2baed
61
2021-06-19 10:54:15
0
e71fa4cf00b70859dcf0fd8dc2d7fb4001a8536fc4d8bbcf87ec2060a82ef320
60
2021-06-15 20:44:16
0
15ee2fd87f705f60e4fe5e392e9480f95caec375b65b2265313429ebf125bef4
61
2021-06-10 13:44:14
0
cf9769655a6b5a49098253fd3a6c20a6b4db1d999a19cbfae14bee1585a59ffb
60
2021-06-05 17:03:43
0
3125629d81c0f486d2774c6b69557a668bc5003e34a7b00937e3193d183e18dc
59
2021-05-31 18:58:11
0
46dedef42e0da20464ed78310d9b145330aefc3b0830bdb65b06c9bc4843a5f6
61
2021-05-28 11:29:02
0
17786ce4ff513533af69f272922e6c2c9634fa6b3e236a89a2b461c71483b446
61
2021-05-28 11:18:13
0
b8b76c1651b09392364b6b95d799342d06a64197b9d8289f89c65841320e1e66
59
2021-05-27 10:59:06
0
1dec9e613a38099766f86a266678fd8d446af38df058792ae3176fc0db700230
61
2021-05-25 13:20:09

Rule Matches per Month (last 24 months)