SUSP_Download_Githubcontent_Shell

Rule Info

Description
Detects URLs that target githubusercontent with the shell keyword. Often downloads of Webshells or similar
Modified
2022-03-28
Reference
Internal Research
Tags
['MAL', 'SCRIPT', 'SUSP', 'T1100']
Date
2021-09-07
Required Modules
[]
Rule Hash
138f66fc206d14fc18e3ea142e4936b8
Score
60
Av Ratio
5.93
Name
SUSP_Download_Githubcontent_Shell
Author
Tobias Michalski
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
17
Suspicious (< 10 engines)
35
Clean (0 engines)
106

Rule Matches

Total
Timestamp
Hash
Positives
VT
56
2022-05-25 23:03:14
c2ba4e4bf9057f0dccd615c094bda04ef036327e377f9095a202fdbdbb421aec
2
57
2022-05-24 14:23:46
ff7112e83a47cd6d352be3ccd374b382afb9b604e657766ba27c3754dbd0b948
1
57
2022-05-23 18:26:59
9f9f2146ae8c99acd21a3ecb82ba4b3627ef2db79b6f9a8ef7f19f7898c2c7ee
4
57
2022-05-21 20:54:35
2fed7f59dd85cb6240d9ea65d72ba3fae0cf89feb590e752b07fa76c23db8d5c
2
57
2022-05-21 19:54:50
ced348965af33b2911fdb885d12613ed81709fa68e66533388aa37a174cb0e3b
8
57
2022-05-20 23:29:57
4e882894ae19bec696046ec2c358f6be7eb8583a895455b05927748ba0d2cdac
0
57
2022-05-20 23:08:30
5ef44749c4bf0b665df4241957b46308e33e71da87b6519515229c54da8c098b
0
59
2022-05-16 19:25:01
4c53e66fe673bc5c60064b51320456ec7a2cd9df63dc324f8c8601e3eaf2fea8
1
59
2022-05-16 06:55:07
fd3139d79ca2963dec5caa4d6622f38c6ea23c00bc85103c1931efddfbf1b739
30
58
2022-05-15 05:40:33
0207e28146aba9a8df403f325ed8aef93909d89db8f098da688a1e0b8872179d
0
59
2022-05-13 01:21:24
f5f041f481c93130f79b119ed959a66bf9ec8ee6a69090371e5df6eb145b47ca
8
58
2022-05-11 23:09:49
da49a6a0b33f306f79e52d9b606a4b2bd9590c87dae7b9a1a9c3ad40a01c5fd2
0
58
2022-05-11 23:08:45
4cbcfb19b73fad438f75ad0485cca000199f1dc83def8fc6b5761dae77a48ce4
0
58
2022-05-11 04:13:01
23b68f73baf4112d9d3b34763708d4b78691e38e2ae3b41510be4cda731acc6b
0
58
2022-05-11 04:10:35
49e02c44778be0e4cdd1d36afd4b4a18b4cc32367ca52416f6c8fa06ab80b81b
0
58
2022-05-09 16:49:36
bfbacb8508b43eb1435a22412db41ccc8f17af180f3221fdc7eaa0af5a194676
0
58
2022-05-08 22:08:39
7d45259b51a27d97146908acd786a54d6112aaf2d3ff386104575e8bfaec9ab8
0
59
2022-05-07 09:53:31
e0b45f933d9c91670209f1b8c744ecdcac9f2985db52b2a0afa443f667d9b7c2
0
58
2022-05-05 23:16:37
3c0b742a46df2e4912333caedc49f1cd1b12876440c19b4749fafc951d8299c2
0
60
2022-04-29 21:32:27
718314e03bb2ab6d1c4445a147fb0ac9ffdd497623cf0586ee648bc8b876389e
0
58
2022-04-27 04:10:02
f930ba13c22534ffaf77e7d5835ee1840af43dc585d039a4796c3a24fd391e98
0
58
2022-04-27 04:10:01
d4882c7028f4ba9a04058eda169e61c594dd4b97d19344b099cf043a186f5053
0
58
2022-04-26 20:27:04
5dc2f0f8f66a8aea96af633ccee074791723146cfdb46189802ec27496bfc324
0
58
2022-04-26 15:35:52
54745d771fede4c2087d0029eb7370f5c188ad25ce0e54b5003c4651550c531a
0
57
2022-04-26 06:03:32
9b46075b1cf4e0c03c023c2e4cc5a02f6f23c12e62ca40977bd6d6f4a5bafabf
2
57
2022-04-26 02:19:36
48dcada8b8c1a7f4facb4839b834f6b80118d9001509a578f53f1cb9f463006c
2
58
2022-04-25 08:59:01
7962a32fdaff4c54600a4691f024d5384d370b360b2178773f3b7d3ab02b6c78
0
66
2022-04-22 10:05:35
c2de675bd15491f7cf80dccd4dbca8b5a13ff151326f7fadac0ca0ab818ac200
0
57
2022-04-21 04:36:36
5b883c352db5dbc49256065d4b46e61258a7c1e82e8f4701070e777f696db592
0
58
2022-04-21 04:35:30
96cdd3c534c5ded373a93d4e85834c0dbff851a07a196c3c0a1ac60c3eff8dd7
0
68
2022-04-20 21:11:12
dbbf26260653838d06925c440545f2ef6e8835219738b0b6a383c73ea8bd2591
0
56
2022-04-20 16:19:06
3da160e09be1e76829ea3cd5d3aad4ed6d1b648d20ec318e6615714a775b3b29
0
57
2022-04-20 08:09:21
8a2689788ab63c80e199172d5d6a3e5feeb482ca5ff1410d164b933463ad471b
0
56
2022-04-20 08:09:21
69aa6b6af5c1cde0c0d831f5ff1a98623fbf1e3734a276d4d3f6fa1e6b07ea15
0
58
2022-04-19 23:28:29
6347d06f9bd003db80d2a31b96993449ea3b00c0ce7b9c067d202dceab291c2f
0
58
2022-04-19 23:28:26
9c5c02c1f9137b2d8e2deccf7faa4600f74bc239b1156f4b6ce8196ef3b17b9a
0
57
2022-04-18 04:20:16
5718672b65947fc6afcd094fea324711d4052482eb671a00f06823c59bde8c55
0
58
2022-04-17 10:32:55
7c14e34de08729014deeeaf9bce7871c2afd62c52c019bf0d3b1715c3a1e40cb
0
58
2022-04-17 07:59:36
e5034ac6edf887dc23b0bb33e6fcb36f637a7e4855abd418d6b53e897edb4b88
0
58
2022-04-16 18:25:58
87300f3220a5ca69eb134270d5f2bd2ed2539302e83cad0a5764421c98cc3b63
0
58
2022-04-16 18:24:25
fe2073c4f1c2245f9b321af05a5f3028a6093ece55fe176b73f8c086e8fc4f6b
0
58
2022-04-16 14:18:41
2dd10cadbca738343199ebaa66813451f2bad0d91bfd51ced37fe320f640708a
0
58
2022-04-16 14:18:36
924019b02198ddf91398324fa281692e0746e4bc5e3a179eb7e16f9bda81fc5c
0
69
2022-04-16 06:27:14
e2b8b504bc737bd562dd5e7f483f8e38537cd16c015b5f957fb73f7534ced919
45
58
2022-04-16 04:34:45
bc13f8a5fd94287b1c769b26fe3c43ad57d62ea5872fbb5e37d1d74f5c5133b1
0
57
2022-04-16 04:33:37
0a5fb191cde67542529da735ee40951e1d61b2fe513fd3e225f0320075ffc1fd
0
58
2022-04-15 13:11:39
c27944945d238098a6ac2290b3afbdd8892bd2d43b14e63e4a476780d40ec687
0
58
2022-04-15 13:11:38
cfc3e583e7298020df876ccc6b1a6b62130217f84f346955301014cef00d7e17
0
58
2022-04-14 20:12:38
37e6a2847d3c037d07dfa0ab8bd9128308f1d553ef16535bd8219c731c24a394
0
58
2022-04-14 20:12:38
6024f2e9542f268295f87c65c3764f7cd9cc481bedd35c9ac97df61413bbfc81
0
58
2022-04-14 14:50:52
4ddb73216c6dd2e0c3a007a03ad0173d7118f82c2bc6ffb450a3b3970fc5205b
0
58
2022-04-13 16:52:12
0403be12699279180dce388fd45a8c1183e9fa37498f70aa3462f33758e41784
0
58
2022-04-13 09:42:49
8e9016a22fafb73c052d523650784421e8dc1af32756850a63a74c623f63c6cd
0
58
2022-04-12 10:20:30
863c6e526fbe76462f4202d89da8ed7e06712159d3a402dd1eeb74b1ca48133b
0
58
2022-04-12 07:36:06
e3ce98440ef496faa4162332a24ba036f05d8fa23c71579d7542e7796076c68b
0
58
2022-04-12 07:36:06
829284f740e090b471b280c7a5f088d4cced6739203a837c90be844af00cbe87
0
58
2022-04-12 04:43:47
86b87635320eee950892ebfed6599318ea9470c30f6ea819525a4b3b5584c075
0
56
2022-04-11 07:11:54
19d0bcc5c306e45d441c06613b699d6a5b0cad3db5b57d1174d3511d0b28492f
0
57
2022-04-11 07:11:53
72ea30768fc678a2be781be22b771980b1d6ee85db1b02da6943e2643e49a69f
0
57
2022-04-10 19:17:31
100bbee8fdbf3aea29d9c2931fdca08bfe324202c6bff4f209b140d088eff551
0
57
2022-04-10 19:17:28
c8373407dbe42d55926f0ee92454e4c5c3732a538857ebe02d53fffe9646ea09
0
56
2022-04-10 12:03:44
e30bcf43b86b37068f8b91d98219e18ddf5e540fbb56c8e405ef255c0bf7e365
0
58
2022-04-09 03:22:46
c14b1001c40cf7320dc953887827b7a6c875580d5133a5c6ce4d0dbbc2543d9a
12
44
2022-04-08 02:08:42
abb8ca95abce0f93176cf5cfada4b149f5b352516c3a488331cad6e843f7b3d6
1
57
2022-04-05 08:12:15
6233da23641990d8370d887fac4b38bb3997b5ec5f7e6e0d71e62a13a6d95add
0
57
2022-04-05 08:10:54
59da80a56b07a6bb35771321a97810a1db3974183145bb7ab40d01f93dddf85f
0
57
2022-04-04 04:07:11
4af78f636a0faed101d4492962b6979956c29d17875a4f08bd056c5569b54e9a
0
57
2022-04-04 04:07:11
4051bc07d60b72923efecb7dbf9f466c656d7322e16eff187cb3b397892cc7b9
0
57
2022-04-02 03:13:03
4fd5e849e5fbcb513174c42829822de872be073b9ed85eca99c1e365a8f20868
0
55
2022-04-02 03:11:21
3a06e106393d8268ecebdde5a5b8a8ee3082feacc5e21f810e91f7a6b56daae5
0
57
2022-04-01 09:10:29
43b785c20bd562a006c3020559552dfed52269bec55f3b6c2fdd1e0e49b04355
0
70
2022-03-31 11:10:46
393318994a2472d4cb45ced842b23b60d8c35f4ce50f68bc0216308a266948af
34
58
2022-03-31 06:11:55
7ded092d9e903c071b9cfca5d668d631e016662e6b0e6c577ee06b9aabe0f14f
0
57
2022-03-30 19:32:07
92617d8577d1bf99542a334d387dcbb3ee6c5a60b0594ad8b27731bf8f6274db
2
56
2022-03-30 15:27:52
5ef6b55341b7c9b5b876193815c53c001535186687b3466ee1f427e02bd7610c
0
57
2022-03-30 13:12:33
41efd9213902261d1e6db51999d9fe3f3b5f8aacc510b858e162e53936ac34b3
0
58
2022-03-29 06:22:14
06cb3feef74f03dc3c6d89fd5781db2093ff974ed417f72645cd94b601cb6da6
0
58
2022-03-29 06:22:13
5d506f95187fb006af1f17c19eba4433c51fd71c899716cdf4da24648d07b2f6
0
50
2022-03-20 01:50:20
a74c5df510ed1f1a6154f1a33dcb673380cfa4d757db1ea33ae22326353dbc63
0
55
2022-03-15 06:30:55
17bd63efcafa39e4a1f7bdb4e33198653984dd0b6b5d05693b29bb6599e1ac51
8
68
2022-03-12 00:11:31
c4f5a91676b6df2858d7b028c58e2dcb5a26e025d280a1db72d0dfe6ae8bf40f
47
55
2022-03-11 21:15:29
d0053dbc1f53a6dd397fd4ddd02044c1f1047280f6c528012ca33cb13347d86c
0
47
2022-03-08 20:38:59
2c209ffca200c2eae2a442fb9082352aa91577b6b1052b4e02dd2672ea3f7d2b
0
57
2022-03-07 15:43:37
098b571de8435d30d40026d3fea2035ef4adfdfc0d51ed4d0740321b0c7c0450
0
69
2022-03-05 23:56:51
72b20bf8f5f43ee9d3b650a9ae6227e99e99f02ab3813e68223e4325957a00fd
3
49
2022-03-04 19:30:56
4754d0de585787d38e398df3f86b345150728a092b9ea4c1f7a1c2f67dc74fd0
0
55
2022-03-04 04:06:20
a436a50acdd6eb59a811ecc760f892bbebd5254c2415519aeac2a68f03873f29
1
57
2022-03-02 03:31:11
6723b405e99618e123060dcfe830b6e1efa44964c1dd1bc422fe2ef128c10469
0
58
2022-03-01 16:50:21
a721131b213c3a8fb45eebdc1e2c36f289551efaa0ec2c065ba3be0c8dd3c688
7
58
2022-02-28 23:26:23
99211f3228d51f1b872901271f510af3568d636ea8c4d94e64d3951263372b2d
0
71
2022-02-28 01:41:25
e8a3b3a7ae29a19d66f820ecd265b11ab6ba46b5bfeefdf80a1b6d37c8ae2760
23
69
2022-02-27 14:06:47
f13d0b540069749471b3887283f4d70015d076ea96487a1479491cf660118068
8
57
2022-02-26 18:41:04
193853df6c41342d55f7a818ed6d9ec2a2806f7954b26b3da909ba4a02acbc13
0
57
2022-02-26 13:42:23
d78d34de8166dc724b22f1f1d5c37c4cabf80735cf235bd3ec4d3ed01d5dce6a
0
57
2022-02-24 07:54:11
c8238de6c1f63d4ec973405b6792095f0de25f4ca36f2b8f904f80057e843f98
0
60
2022-02-20 21:02:18
f66c8889db007a821315fa40cbd8cae3f0b201d0e3f20466df142dfd7f3636ff
2
58
2022-02-18 19:17:01
1078021da796accdb88f16c0967ae79b856277b873e3656db105cd1ca57aa8c4
0
53
2022-02-18 14:47:50
31166ab25f3a7e29fc02c49d24c1e6057530485c3b4fe99af222d456570035cc
3
58
2022-02-18 14:35:26
94fc58d086ca6d96d42d647c9ad8be5a24cdc9ddc2bb87f79b0a67f5d8e6dae3
0
57
2022-02-16 21:12:21
76880790db1cdcf66c0f8602e37deb0df15d25c77dd4c5ad8292dabfb23ae849
1
69
2022-02-16 19:41:32
069e7be3820c446d01c70bf7f864514e32b9cd7f3f874d53b92e0662587d6e45
42
57
2022-02-15 13:29:58
6ba62ea6b1f3a117f0c943d6e8ad837f7359e00be8b1da567aca06309d13da3d
2
59
2022-02-10 19:14:04
5bc4b2f747aa78f5a258e176d52416a165cf1dbb849f772b8f02cb2a0f4daa43
0
69
2022-02-10 19:11:50
96c457e324c3c368a59732783abe3b459ffc1d0374ce3675d8a27ff3f426998d
20
60
2022-02-07 23:08:15
d220951587199e7d0a89e0bd2a0e187223555d694b4678c43a360da8fda5e78c
1
58
2022-02-07 17:18:48
257dccde6dc54c81dc64bc791f04d7ddde8914aa39da79d43633b94c00932402
0
55
2022-02-06 23:18:24
88e85b2ec56480352043bf47b9a6491b66820d23f9d3f88f8f6ed8bb0556b739
0
55
2022-02-03 23:52:33
1323386761e95870396acf1fd7b7099a76e4e8b90297ce78666eb6c758619809
0
56
2022-02-03 15:18:46
edd4ff71cec02e94b284136d1dfe84141e65164ffb322056178c9ca22432db91
0
57
2022-01-31 15:09:02
a6f7596a213707a25bad42ab0020e1af28104d4d91d093b84c4f40f09c7ec414
0
57
2022-01-28 19:46:05
89665100cbdc0aefa7b34434fef732dfe0a69d4e47e0013135ffe60b828f0a07
0
56
2022-01-25 20:50:40
47f39ac20a99d3508d80fc533a192f91f120dfcd9dee75f3088355c71d2a0e63
2
56
2022-01-25 20:30:44
6043a6daaf87243999758754447411f8137999cfc316246968157448b69eda62
0
56
2022-01-22 20:56:06
52e14975775abb0b0351aefdebb833ec7a76f19dea8a732d03498c93b26ea313
0
55
2022-01-22 20:08:25
dc49c869d4b6016f59224dc72bda43446305da25849dcafc772f7fa25b1b2b35
0
57
2022-01-21 23:02:57
1a02cd7f5dcdd64e085fdc86751ca61e4e5ba868d5e45805a4eabdb92bd47b8e
0
64
2022-01-18 02:17:51
d70b3a1ae2eae644fa60a5353cc18e43e3b05b7444245409be869891adb22071
6
57
2022-01-17 11:59:39
bb7335ee97a0b230b353704568e6e0cdf73c0e8a6d0d11d5a5abdd530f3ec2b6
0
60
2022-01-16 20:16:25
0fa0315de573ef7dc107a7d206f5cef1ca1ef5b250be3c1647e433d231d4b9a5
0
58
2022-01-14 22:33:43
75ac68b7bd31c944a9ee2d508a9736b7e4d3235f92a406f7baae0eb0fd7afb3f
0
58
2022-01-14 22:33:43
f05b3676c9e24543333dceb7a2aa918cfe10a7dd161d8f2608276ff238d1eae7
0
58
2022-01-14 22:33:43
e8f16876dc4f3a3b7ddd715c4bb55eab73f399aa79dcf7799f90525958950a4e
0
58
2022-01-14 22:33:43
10217c2151c9ea4ed490d7eb089f13699fe0ef2de0024da9e2ff025395001481
0
58
2022-01-14 22:33:43
1e08d286d8243526566dff7389706f6da81d48e3e02192a603416e5ee2b1bf71
0
57
2022-01-13 01:14:53
af7e5d6fa224b8cbd0651bcef81d2a7dcfd9cde6e7d7f25fad52c732a80ae15f
19
67
2022-01-07 23:46:53
e54f0acc46db1c5541a0d98922e2dc9112b4fec47ecfd378187448a4e9f11671
3
57
2022-01-07 20:52:04
42fb9bf374793344d4bdfb2ebcf4e061620b9e12547d099c45722c22b58cd9e0
3
56
2022-01-05 00:24:03
63aae4551705f6c7c9eab75fd74c583e9142c992434fe11d1b9d66f931f02011
0
60
2022-01-04 00:42:40
bc8e315cab21a8fb3451b2229e3236c7827193849d5a9ded1edec562f2331ba0
26
57
2021-12-30 16:32:44
5f7876078e796554a68dd5bbc9f0bd2d114e70bf28e400802e642fc73ba43791
0
58
2021-12-30 16:28:59
8a795d908d5f8bfa61334b0271b3d097a04f405bb645440202c74978834e52ab
0
59
2021-12-21 19:12:11
ae69b05551367abed81fed99bbc6cd85a3cc0bae7331009e1ef819b076335b8c
0
57
2021-12-15 07:40:03
a3a620b4bc6d77a0edd622037fe0f760b828b97d3ebd3c36de702d4505e07bbb
8
57
2021-12-15 03:01:46
b24fe38e7da122396c9b8b462e59a832f5ac7e2e256262370da87e873c734866
0
55
2021-12-10 17:11:32
e06318df247029f1feb01b1bc2ba4285c050385b95ffebc982dbba981d881f10
1
55
2021-12-07 14:12:16
94929076fa4ec5b10a8da9d1489c1613ff0b6ac74e61c3b58880f38533b5ffef
10
55
2021-12-06 14:24:31
3d125401e43a88f2233ecbfadce03f5f6a19fc183e6e73561abe48df3b06c165
0
54
2021-12-02 19:15:14
05cf43a154d11fed2521d9bb11b3326fe93f787cf753332015ebe431d696474d
2
55
2021-12-02 11:51:37
8bcde12cc1013dcdfe0f211d47801417245eccd7d2cd00e4cd028a8f3428e235
0
53
2021-12-02 11:29:26
f97f185dda0c950ce9ac61fb2ab73e3083f0324b9ff7444a73f450dd107e7cbb
2
55
2021-12-01 22:27:59
67ea822cb0927f843c6761ee1c75af127707f5f6e2346c4041e4b41b0e6e7a70
0
57
2021-11-29 17:32:46
4d507113805316d808ef62ac812eb2db5a202e5e0e5ee0c0e158f775a5bb3318
0
55
2021-11-22 16:13:33
c29ea81e6cfc9f4929e22e5a07db71b3b7eb309b0d2ae454b37a1f98f50c135b
0
57
2021-11-20 15:47:47
d7770f00344c69aa315ea5525df615aca998fc78272c48a6f780021ca37c2333
26
56
2021-11-18 17:08:14
ca7877f90fdc4361d5247b35d3318d7c177cc866dc70f2bfff403b5b4c76f632
0
62
2021-11-18 09:19:01
6c9f47abbf08fa127d8dddfd28f0e6502616086a8d8cc3f61f444d760a359378
4
56
2021-11-15 17:15:35
885049521d1a5eae0513552431abdf07df1a8051c90800a4eb5545b5da630aff
0
55
2021-11-11 11:06:04
53435f99a220b34755ecf8c8132b7c8b4d255e112559751e61462d9bb428bbff
6
66
2021-11-06 09:49:21
7bcb22cea325e45ea1e5f0b851da703dd9aeb104dbbfe8b7c8b2e8265a8f6803
2
58
2021-10-26 12:22:04
f8bd7010d6c6a106a74b1941853fc3099360aebb18c48c8da5a09b5dd5d84304
0
60
2021-10-18 14:57:23
6ff97f0eb7a5fa67f1ad83a2e9daa8bd6a2d59b7f9617e228e0396c1b057de09
37
60
2021-10-18 14:52:11
6983443a3ecf0d87937bc9950d552bf100daec1377642f90d7c75f2a0136dc46
36
57
2021-10-13 13:08:42
93333b7142237e3049bd58e9eebfc869cad4d5bfb2278ba6e9c4da8ff1ded279
2
69
2021-09-28 10:44:15
677ea61fd1a90b3889682a983bf98df968a6cd159c6cfd8fd77f25b3a0081d69
22
69
2021-09-27 18:13:48
c77411f09f8ed61a5479bd88a571b423a557be2f4b4d904b38b5ea5bda373275
18
67
2021-09-26 19:40:58
97d4e76027f9ff2730f965f1350fb0541546da0101a5e4d7b38a709a1f92f3f5
9
67
2021-09-25 20:35:37
4991a1e9220ec88bc7ccd56702b59b35f332d37253fb78860e0c1569cdff469f
9
67
2021-09-25 20:11:04
c6b87bca70acb2ffdda7cafe8e7ce3090e307042297001e345a01d325ee8e764
17

Rule Matches per Month (last 24 months)