SUSP_ELF_ShellCode_May21

Rule Info

Minimum Yara
1.7
Av Ratio
0.35
Score
75
Description
Detects Linux ShellCode loader indicators
Name
SUSP_ELF_ShellCode_May21
Date
2021-05-19
Tags
['SUSP', 'FILE', 'LINUX']
Required Modules
[]
Reference
Internal Research
Rule Hash
3d405417444f8611025f3c61b0d5a98f
Author
Florian Roth

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
2
Suspicious (< 10 engines)
2
Clean (0 engines)
140

Rule Matches

Hash
Total
Timestamp
Positives
VT
30997c71141b777f350f4ea4e9e731276644f5a7960433ba0a247bbaa3ab9366
59
2021-11-26 04:07:07
0
4eb89f000cd1257551de5bcb409e3942d5250ddc06f84f7cf81d332bc2ccbc1a
60
2021-11-24 15:34:04
0
761d93c6082ee95a6e5191d3856a3551c754c75a231ccf4c4f16bfedad406a5a
60
2021-11-23 13:54:21
0
f028c7fcc64ce266e28b426858b45dc3ae5cd8cc3ac2840720d000f4db133b8a
60
2021-11-21 22:21:17
0
66ecd4e8549a31d9f4723dc895d14674bed9deeb63b3e5933573b23be8edf61e
59
2021-11-21 22:20:15
0
06e33b04d56d474a138039ff48167a906e1c6d8f119c17feb65175839b59289e
60
2021-11-21 22:20:15
0
69cb99db4db8425d917c04504e20379abff23024e06c9cc280d0f0ab14615ae2
59
2021-11-21 22:19:11
0
28a4ce92b835ded7a888d35dd0524eb9e2da8caaa37e51a90b74833f1d715b2b
59
2021-11-21 22:19:11
0
a8da765fed5b23031f2f807e583fe2d4542c5c922f6968b429d781e2ca0384fc
60
2021-11-21 22:18:09
0
1a7f4b55e1eb3a01e0e3078081dd2da602fdeaca39483a8686b11ec6f364b5d1
60
2021-11-21 22:17:07
0
2a778d3ba2dfa1bb4fcd8abc1bbcf66c7bb646ac487fba3fdbc26143ab7a4b37
59
2021-11-21 22:17:07
0
c527ce809d03f23b8bc3e22aef2059e233cf33a76e8525d2cd02beb5f9aafb9f
60
2021-11-21 22:17:05
0
e2787b453448d8c97c45a0f8c8a3b1916a8fbcc02f7293039a76e360232b417f
60
2021-11-21 22:17:05
0
a335a73e936c3dad73e3014f8cd25e57abd5d7622cd0be2798932581c61cacf4
56
2021-11-21 22:17:05
0
8f8be508caff68bb1e4709bcb3377fee7e2eaca0390f923aefdde46d37437759
60
2021-11-21 22:17:05
0
d0345c753dbce452143987b4a111649af3d409f4b6919ada271fc7aed150824d
60
2021-11-21 22:17:05
0
9853c637ae5bcd791d95912d500a8e607005051e1e63b0f3afa691ab3ca749c0
60
2021-11-21 22:16:00
0
d7561700c98d6babe77aab4e1a1698bc751b87f0ba629d85cbbc4b141bc92af9
60
2021-11-21 22:16:00
0
6a0fe4b67c638212fe2182e98cb06ae618b7b9bbe2b21b5ee958e1e831a7ad9a
60
2021-11-21 22:16:00
0
cdc5de8cb3ba63fd4118dbf23be2f6f400c4c23dc21fd04674db0669e7f5f6d0
59
2021-11-21 22:14:56
0
0c10fb5f611c616f4c91ef049deedd7d156a3559b345a8453eeba35ed6c2ff54
60
2021-11-21 22:14:56
0
5a4879380f28f55f8647d709c38d0dd7c04a9888b7a397b8b4ea320de7928f75
58
2021-11-21 22:13:53
0
c079c76a0d6b67eed5ae590102fcf53fa304e51c5d130e7dd22364eddae06437
58
2021-11-21 22:13:52
0
7123f63fa9f4b70fc36015e22bf983cf8de9bd1222129734a5c2e0dbe5455652
60
2021-11-21 22:09:38
0
45492e21e0be55f2f7dd0ef805fb2bea39a7c3ccc43d7eb49d0ff81047a1d0b2
59
2021-11-21 22:09:37
0
b503912c8db94915e6c2d9104b952b35d9d0b0dd30d9931f42931485b47d9287
58
2021-11-21 22:09:37
0
ec24fbcb4e3605be0cdbf4f566aeb57225e273f62d2a4ced5c96f5214ffef31e
59
2021-11-21 22:09:37
0
b7cd4a51be210dfb848e06a454d2dec07ca5833c7c35f934201f011a5d547799
60
2021-11-21 22:09:37
0
21640854eda9cefd95cceaeca0f92353a93cec8ffc8958835b28c91ee32914cf
60
2021-11-21 22:09:37
0
e8d1069a2a05c043d625e1ad1d837860f54889584bd3e103ba7bcd5e37be5929
56
2021-11-21 22:07:28
0
68d5aa43c8153ac8f39e57f6231fc9b3d914bc8a284c39c30d116bf94af19044
60
2021-11-21 22:07:27
0
da479a29e34cd1b308e722966fa8b9b20043d1d5e6a549a9b9ab09cabb7b9295
60
2021-11-21 22:07:27
0
36f4960497ff37d84b588453674f82571866f3a8567207680284aa1c4d6bc980
60
2021-11-21 22:06:24
0
3994b76a66d2be2c424a9f8cb6fdbca82a859d5e9b0ae20d26456a4d41ffcb5e
60
2021-11-21 22:04:19
0
e5761d01379f7594507755e9944d73997437730971b0c9328899e408474df16d
59
2021-11-21 22:03:16
0
cf81a7aa73e566588fc4ac4ca077e9d7b93347b9f7ea284fde0b35c8bc202700
59
2021-11-21 22:03:15
0
5d1af2d4f19d94a7084503e0ceb921be076017f623e2580f3325f32533769ffa
60
2021-11-21 22:03:15
0
943be87fc4c653cf371d6dc7d654359a7f65e1255adc311f1c71c7b799648463
60
2021-11-21 22:03:15
0
d14091a650bc5e7e085d6f6814fc0009f3fc26b822433bc5e9fee6fa07c34631
60
2021-11-21 22:03:15
0
5ade8190eb1a5f14ca8345b0d7eae205b5590283c2e7e1c5cd0759de775f961f
59
2021-11-21 22:03:15
0
8e4b5ce94b943d7bbb605394d11eaea07997b460aa82be0b555fd013067e39da
60
2021-11-21 22:03:15
0
50162763da2c1d2a406d34c9b5c18494138701c8a62c8de8466be026e6e74939
60
2021-11-21 22:03:15
0
fb3ae78f6c1ebe7782f97ff29761955c1047dd2805eb15ba44a16a6246631849
60
2021-11-21 22:02:11
0
b4fed1f1b6c6485aad0c9b3299931ad91e7771a57b6d14dbef2ca857d75b86a3
60
2021-11-21 17:35:19
0
143d3c463500c78c1b971411743e7379352a768df605fa75708bdb9be0ca1e07
60
2021-11-21 17:35:19
0
f176df85a9143e1311e9602481f2d159c202b545634308079afd89afbc22468e
60
2021-11-21 17:34:07
0
165d552fe687b2595b64a9650bef66b4fe8d79439b17e5d885a6ff17d9d40cb1
59
2021-11-21 17:33:59
0
d75e13a82f87a34e7d534f9df8069bbdb275c69ac1f691ce4c249af3b51014e3
60
2021-11-21 17:32:54
1
45b742aee62d5ab7977edde1105a2445007be37ff1c6b3e4389878043fb69416
60
2021-11-21 17:31:39
0
5524a1c93b7708d05fc4dfec4a21784a5f4595ea7a852c6285cb2aea3da34032
60
2021-11-21 17:30:22
0
11ac55eb97490e6386961f7ae36ecad9125c8e5d2f839b81928b92e594ed0376
51
2021-11-21 17:29:15
0
c73e966994d3972a25d6f15b8dd1653c1544226322bb1b1aecb90307244e3454
60
2021-11-21 17:29:12
0
1181c6da12421cf2295a9fa68ba14c7d20fece02f7ebe35969a66196ff0963ee
60
2021-11-21 17:26:54
0
ce7be50ba570dfafbb5664604d372c880f645cc091edc367b2c861b908106031
59
2021-11-21 17:26:53
0
a772ca4086d42d9b1742defa96228c9f0ab377eaab92b1878d4637a8b42308c1
59
2021-11-21 17:26:53
0
6f224ff8230bfc0fa3ef9cde27f7abc7dc3ed25da97790bf8ce9bee13d775771
60
2021-11-21 17:26:53
0
8e0f49371e491401924b88340ced67ab3028a9c8feb56826e56f3ea32a276d06
58
2021-11-21 17:26:53
0
53112eaf75f21fb00bdcbe08bbf3b496810d9f26c5f989edc9fd59367e20a8b8
58
2021-11-21 17:26:43
0
7ee691329800bc1c9606e817b8f12b06be3f5aefc3ef72bdabbca3a2f324ee6b
56
2021-11-21 17:25:40
0
ec42f7d91729e0cc7af4538b67fffca54f142b820b0698715d11be409d4255a6
60
2021-11-21 17:25:37
0
1ebafcf0d88d4467a6ea7ae098afe09fe41b158b6f9313dead97d14bfb487c6d
58
2021-11-21 17:23:24
0
a9b84126d83ca5e7800efc75dfba6ee4a6b724189b1c4eb41d4012d587e21625
59
2021-11-21 17:23:23
0
c082dd1ed392472bdeae76205da5a5ee465a0ea6bf338ed1256d15f2ab46e44c
60
2021-11-21 17:22:12
0
397c9b687473599c2581a2f62ad50c0c95dcd69301c05a8addf07199ee8cf6b7
59
2021-11-21 17:17:42
0
9d78e266019c3ae68b26902b252046567ec903ec07eae0f4e0093ae3cdc06212
60
2021-11-21 17:17:33
0
12c344d4abf0c65e3d90383a4dce9e765457b98cc65c5725c0cff53755e565f2
60
2021-11-21 17:17:33
0
02c70c3290617bd5f5794a10dbfea59a15c1eca49b83040acd771c2551b64cf1
60
2021-11-21 17:15:20
0
9131741e4bddc4fe024714262cb409f0d128260bfad9d4c7931531dd57d7792b
58
2021-11-21 17:12:55
0
ee8e9344ca57050605844c934bd516338aed0d0fca5bf540f459e5fba960965e
60
2021-11-21 17:04:48
0
f8f1240d9f18c3985d12ddb240d74f56e5e3adc5dede4777088d1391aaf7023c
59
2021-11-21 17:03:44
0
57dd62d989bab28b506f0f225ed3bf9d3a65407a36c59daa5ed54e5281fee04f
60
2021-11-21 17:03:42
0
e29f8c3c6f46ff6a98bad7bc4ce5f59cc11cea2231438ce2c0c0956f1522737b
60
2021-11-21 17:03:41
0
d6d05b3b4896484decde1ae1454a77b4ae20f86e689c2fa2be7c064e7f50aeae
60
2021-11-21 17:02:32
0
a815c77ef1996623841e7603e718f4d1b362cf5092575b5bca2b941e19eebc1a
57
2021-11-21 17:02:28
0
b0fafa706ea931f37b398f7b5492d03464a040a7427827ae54a4547cfa7a313c
60
2021-11-21 17:02:28
0
89e463a1b9ad35993ecf978de085b2eff08129507ae3000643c01e0509c54a3f
59
2021-11-21 17:02:27
0
37e195ef6a70a0b8f2413ae8b9719416f1cf4e9cc4bccbd2328b2c1b8d5d7af5
60
2021-11-21 17:01:20
0
e0b5859cdb03a5f858e9772363cfe1eb34219bdf19442b92769484562d6676bc
59
2021-11-21 17:01:19
0
09ea03c002fad228e0e0a461cbda265bfcb1b67b960965bec930bdc0d0f0d1b5
60
2021-11-21 17:00:32
0
b1d4e3667b0685f991985c17e8292253f534b74b2c26456d16f8981b8b514013
60
2021-11-21 17:00:32
0
11d768b10f2bd33f6247822d3ca3dd6f5c9a0237dd1e2804b9d0ab9eaea285ed
60
2021-11-21 17:00:31
0
665c69ad96afb61a3a49caa94e090338a8f8167ffc6424e03170f3a108dd718a
60
2021-11-21 17:00:31
0
cbead3fc611d37d03ae66565a9808f31a4e2df2a7c011850ac500545c76c3676
60
2021-11-21 16:57:57
0
7a1a67b49e40c4980bd2292b026ab80e906b49e427b0e462e4f43ab763f00e0b
60
2021-11-21 16:57:53
0
3b88c0aaa14f3fdad89f09a3f3d90b75e6e47d51670439d8be8713eb63f241ea
59
2021-11-21 16:57:53
0
20219206e3c34de1f6a597b6f42bfd64c3417f8486bf327c98b6465ac667eb1b
60
2021-11-21 16:57:53
0
100d53b90a2ba3dd41c8dcf996c13348d60f80645bde7f88b281df998d2b6e23
60
2021-11-21 16:57:53
0
28d96c0e770ea5ee98f9d4547a2e3433d3c2205db8edf467c303d6b0f05b4cd8
60
2021-11-21 16:56:36
0
a5373a0b42bfa21587469d0ae26c2cb80374a8426a2304091cd76ccb2fc13aed
60
2021-11-21 16:53:09
0
23a04ccaee5259614786a0a49d558c408ea1826b00317c97fe218e39359d86dc
60
2021-11-21 16:51:57
0
59b8e12df6fe6b277e4516921804712afa00d629720391e82f7dd97d2746d64e
60
2021-11-21 16:51:55
0
b06824f209a35765ce02dc4583b6a9da1e518864d8b147ab1f905bf81ccfe5a4
59
2021-11-21 16:51:51
0
443a8e17efc74f88a07f2bf84d9d898376f3922f8025fb1ff699a0a2b69bd042
60
2021-11-21 16:51:49
0
639437da0132922d5e90d51b86554935ec6997dbff2e92bb3844e69427e4cb23
60
2021-11-21 16:51:48
0
1e88e51da45b6ccef7c591d70bc6e3b30f1a06be8dcd0218bee2d1bda56e47ef
60
2021-11-21 16:50:41
0
f4351c2e6e4b48390a5c1eb08a8142d647ccee2f7bb9bd53cba66a4de61e494a
60
2021-11-21 16:50:28
0
d51f0135ea06f910af5a76029d709898e2b3594eb964dbbf5b9cef346fc39c13
60
2021-11-21 16:49:25
0
7773be3d2353bcd6ecebdb2aa1bb87e000ebddc59db05739723005bb39e91598
60
2021-11-21 16:49:21
0
7837328867ae7612b16f395b8fe74b0b4e899ee6c497abab16fe850a38c55519
60
2021-11-21 16:47:11
0
cc744fac8d327a32e860147666de3667391640499e48e8b9c9fe23e1624b34c7
60
2021-11-21 16:47:11
0
70f74b8ee58520718374a910390fd7dfca4f43a717823de9e872b7181cdd6466
60
2021-11-21 16:45:59
0
facdbfab451b007b1d75a9bdd9b729f7694756acb1b04b30af9b35a551d5d7c4
60
2021-11-21 16:45:58
0
e39852d2dbf87d982501dcc214b005bcdee5e3c013c8b12c8ea1c35a800440ff
55
2021-11-21 16:45:58
0
f1a7035b35be0e9cd8e8a834203bcd813b1666876052c5ddae6f64d3e6016628
60
2021-11-21 16:45:58
0
3931ed93ac2db38993fb1b44c5cafa3c61a093e04c1d84a57e5897a896c6cb85
58
2021-11-21 16:45:58
0
f2b198b388a40128409a8be0bdbe6b2c72be06f5a148e12bf82ed1f296ad31a9
60
2021-11-21 16:45:58
0
2ddb3a8876029477fc1367b536d23dee16a1195150392427452130ec2903bdf8
59
2021-11-21 16:45:58
0
20dc439c60348e6346c6f5872a11333ca076b5dceab40de7926f2287b6f13bb8
60
2021-11-15 19:12:28
0
2fc95da94b4dcb1e937ac9335437cb3979add01e841e0184d6ad172eb5eed283
60
2021-11-08 15:47:57
0
4e8ec7d760ea7fdb6a295b6e6427d7f93fc0381b137ee814d76801d316338355
61
2021-09-28 15:19:54
0
9c5e9b54cf48b398b8c6d8206964a4e0b0d99fb90a09009c191b3becfdddbe52
62
2021-09-24 15:36:41
18
2c6c71d20d77196d094aa17edbb4fe5978c17bf57caa39ec67270e1cd507c3a3
61
2021-09-20 20:46:52
0
a985e3571489e38c43b23c61a3ac07de013019665a21eb973e3fc994e0b79cb3
60
2021-09-07 19:06:08
0
0325c1c475da30e6345844c160bf92f901f26b63c6896343786c3a7d0a12d00b
60
2021-08-23 22:50:21
0
b155fdae0348bc07552098ea01d9073b0093124fed5c789dabc9462aee91457e
60
2021-08-23 19:35:15
0
2ae0b8556069079f70518f4a0979aa7c1e262f38a7285c6bc3395cedf9bc57d5
60
2021-08-23 19:23:26
0
73fd59ea002e6554a0c9a49c9fb4160085a47680ef25bf5a4c004d377fe068bf
60
2021-08-23 19:13:59
0
0074f9904257417ee8d5f7f3d7b6c62517e3041ceba1ad6944259b90bf3732df
59
2021-08-22 23:48:46
0
2e1f7b55305aab74ee99d3a0520b6f09c128dccb995251dd3eeaaac21aea421d
61
2021-08-04 16:36:04
2
bff2559a0b801848b726355cc3013a1cdcc798241daf253bfdfe71b6ca0aa0d6
61
2021-07-27 04:09:11
0
ba7b9f230de56df911b76c5f0bce3562de3594d87d982c44360e49a45f2194e1
61
2021-07-27 04:09:09
0
93f3d84398bcc7879fdc5f61b8798d21a8c7b1fb654993d85e3978cdbfb9b250
61
2021-07-27 04:07:59
0
5bcbe65c01112a1b31ab2fb99bb9219533f452f6e5985b11b0b8ba8beb82f37e
61
2021-07-27 04:07:59
0
84916c0551fee7fe2841d9753b927703260d06fb18a01649c7060f15a1faa3fd
61
2021-07-27 04:07:58
0
ecb747bf07712be4540ac006ab61d9aa069a9cbb4f5de9e19ce37da2abcbc753
61
2021-07-27 04:07:57
0
71294006ee548b608c502b354e658bb5c2d21c5c46868098001479aa9699541b
60
2021-07-27 04:06:50
0
dba1e67359ef6d89a066cb53d98cd51c92836a72b3510100d0ba413addcb6933
60
2021-07-27 04:06:49
0
ad8899084fe135dedb0a2141b7959cb945d40e25a06b4d87c549063456602886
61
2021-07-27 04:02:25
0
c15c5193ae9f72b7f036d47f1d16c769b905fbf40256105ae9c2eeb9f18dd385
61
2021-07-27 04:01:12
0
231858ebac431aebc5c3b803b595164c88d0ade736b5e21c1eeaf6dec681ddc9
61
2021-07-27 04:01:12
0
aa1ff241078d9e79278c5bc9f1875d7a5b9d3c169a2a60c8995f632fa606b409
61
2021-07-27 03:58:02
0
e90bccc858f0d015e3c4cf8af69daac6c1ea384ef98a14dffbf49b4402cf04ce
61
2021-07-27 03:58:02
0
756eec535a44874a01c16f15ddd224e92d508e7a5669556ab9a647193e220999
60
2021-07-27 03:56:58
0
30b754cc10d4edb85b5010db4a4c40fc276024fbf4e6e32b9e3595074d9e2c1c
60
2021-07-27 03:56:58
0
8f8d890522416f9e53c006f2d718ca912feac2e1b8d322cc4ca6ccf610c63e01
60
2021-07-27 03:47:02
0
3f1e0b78a4a1b5ecd45210002d3b29cc861c233be35426e6c2c36109aa2d5204
61
2021-07-27 03:45:40
0
4fb7b51011568e569e8be760fe48cae249e0305ce569851c48cd28eddf8eb37b
61
2021-07-27 03:45:39
0
b3e7c14730292c5b77fcf83ab754027fc32d30fd4d2fa417c98c571972e1eb41
61
2021-07-08 17:45:51
0
96680e97e51696e36d70236f3f8470675dd7dd0141b4bd577fe04f61b738770e
61
2021-07-08 13:10:51
0
38f40186d0719e82b4f722a975db8f6439c628f8f797cb129f8ee0165ad885f8
61
2021-07-07 16:42:13
0
04f20cccee21f3aa3791df17a23151b452c53f30a1d0765154be877ab1e99426
62
2021-07-07 06:52:16
10
8d5cab9e19792b8bebe07c538b35924cd6d5ada8f13745bd2b12799794e18fbf
61
2021-07-04 01:43:52
0
2cfa824d34275165b0463fa884d117dd015b5ef05f7e7452edfb05d2d6c63c58
61
2021-06-02 19:25:11
0
cca036f973686e7b7119a64390d214d2bfd6b64896782744937e92ac7f895ff4
61
2021-05-30 15:18:02
0

Rule Matches per Month (last 24 months)