SUSP_EXPL_OBFUSC_Dec21_1

Rule Info

Av Ratio
1.95
Score
60
Name
SUSP_EXPL_OBFUSC_Dec21_1
Minimum Yara
1.7
Required Modules
[]
Description
Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228
Date
2021-12-11
Tags
['OBFUS', 'CVE_2021_44228', 'T1027', 'DEMO', 'EXPLOIT', 'SUSP']
Rule Hash
724a4ee987adc7983a920783f6e6ca13
Author
Florian Roth

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
3
Suspicious (< 10 engines)
22
Clean (0 engines)
57

Rule Matches

Positives
Hash
Total
Timestamp
VT
1
397ab1d688093f8bb4867b68222bef9d1f9a17c10918b725f512aa8153bb200a
55
2022-06-13 19:09:28
0
73d93ffab80eb4358268a1784dba66224fc96fa23b26a65f9201bf631e82c7fe
57
2022-04-21 16:10:51
0
c9478015f13863e57635fac5bf559cae3332e7024cfcc45d031eaad56c7b62a3
57
2022-03-28 18:16:03
10
d09222c19a6115b9a46adedf69ce4764904ca20de56acfc7fa10a92d75a45c8d
56
2022-03-08 21:30:36
0
da3e9e5f35f966c5cc3fef913384493ad514730055a0f4b5ac7dc45177dccaea
56
2022-03-07 22:24:04
1
f5739eea1ec7519fba60d1c9f559b7b52b1c7256bdb7235ba30fc22147b468cc
58
2022-02-24 06:36:02
6
5b8b39c2f3d026b30705d4bb9a7fc9fac41544899c17e941e021ab73fc25a588
60
2022-02-23 08:23:43
20
9809d340828f8016d9072f9f3696794fd0c24d5ce8a68f036cb4f406377a8e52
66
2022-02-21 22:13:00
1
8845a935b8fe3c921185076ad079b9f6de20d7e2ae7883bc3f2281b2c53e4128
46
2022-02-12 15:23:31
1
6017c3fd9018ac504880fd21fbe3da92b0637c4ce82fbb514780611929c4a53a
55
2022-02-06 13:04:49
0
89f176012dc40154b5f06532369bd4c5ffef67d13f5524add2227a37b0f4560b
58
2022-01-29 17:09:24
0
cd2419c5ea0e11e20f63aba4e2232a44ef35cc7a025b57974fac64b48be34e0b
57
2022-01-29 16:59:07
0
3d0e1ec7c7bbb53fa4245cabee6aa08b1e692c4bd372c0336edb98590938cb49
57
2022-01-29 16:46:08
1
8a03946b8605d375cb062d4ed4c02bd218b8094a55458842d69f3c9d88703563
56
2022-01-23 13:56:19
2
6e32e1cdeb9f01c039a8b6032663a2fcad040d2f2bf2950f8a46746d460e3277
63
2022-01-23 10:24:59
20
546e48de6932caf4c22dca427695afb0958b4e9ff3e0ebb7ae4ec50d643cedb8
68
2022-01-21 07:09:09
0
ff49760b49fdd7f235bad0fa6cc8dc1bcd34ee5c26d7585e92fd652a26962541
55
2022-01-17 07:43:38
2
2046c50543bae7e9ee03b4af98bfab56d2b0a17e976faa2e5fe0ee97a7c3fdec
57
2022-01-14 16:09:36
2
e5252cbc40ccbcda3834aa31500a5a2503928ad2de164f9bc94e85f3446b9cb2
56
2022-01-14 12:56:22
0
f307f3f33e01dd487c2ad55952a2b49acf6de2f2f0d990004eb6bdf23ebf2f2f
61
2022-01-11 19:04:20
1
a79409dc8dfb29350eb5331e15dc8c6607cd398dc4eccb78bcdb33defee9ced0
68
2022-01-11 19:04:19
1
89eb10301fd2da791f383591b8a9c4b2a7d85864d2fe93dcedd31b0a40c267a6
57
2022-01-09 14:39:06
2
35b1dc9c8c26c6762c9d163dd54e89427b19558249675d2040941c5fddd5848e
58
2022-01-09 12:16:29
0
6737a45eb67f2c6003b04a14c450be78b5dc4185e989cb384699ef48865c88a5
57
2022-01-06 23:26:10
0
83b1f868940a46ee17cbc47ec8461ecd9b85c1951403d5ae43c9ac46631eb2ec
57
2021-12-31 15:12:21
0
3f2972e7bc64908db29524a2a04c8456058ba28aba6e098104c45a0d6934e0ea
57
2021-12-31 15:12:18
0
eec28fc801f021adf5f56fe037c6d7d84ad002c0aeba4976d2a2a9b658ccd019
52
2021-12-31 15:12:04
1
64478431e36f15fbae8566f716d377d43b2a4fa1e2de8745934a9fca1b963abb
53
2021-12-29 19:07:04
0
c96f6c7308bc0a62f192afcd2b9d5206e6724216c407bd6a1cf4bfa51fce8e17
56
2021-12-28 19:05:47
0
74a98efcbf5d79e99ffa2128a9c3f3d03fba423dd55f4e7624f9acc81ab62fe7
58
2021-12-27 22:06:46
0
f988f98fbd7055b3869e157d06eee01dcc25b998868acb81ba6536e449750738
57
2021-12-27 14:42:53
0
ac46725d732f453d039dba13f410be7016750621551d4e57a2d5b769aebe3191
56
2021-12-24 13:11:15
0
0edf44b87750ed00f511aa59ff05ea355d38c7e984ed59670adc880222b32fa5
57
2021-12-23 13:37:59
0
9f1b486ecb28b414f2be6703153baa03d1d2d63e09c0dadd6d15f638a8f349c9
66
2021-12-23 01:48:35
3
094da9fb31b753ed07a99720ee6b251f0d0034ae633f81bb21613f0f9f944d70
57
2021-12-21 09:48:17
0
abfd75f0652bb522a16508c6c291a7e1f3f6a2f9a170b44ecbf65d7330b71591
57
2021-12-21 09:13:05
0
658ecc998b489111789685ed8d410af59a2e696019de676944b964d4def801b1
57
2021-12-21 09:05:38
0
3b5a3fca8a057c76ca026f160a040cba235f23c12ef9a61fcee960e7ed2b774e
57
2021-12-21 08:57:00
0
c2d0cebc8c20afc3efa4a42b2be4c1acef1ff2cd580ffbfcd9e108759887bba9
56
2021-12-20 01:27:49
0
d3284cc8c41997cba356da574ebefad504b66b634178952a2ab37f9e7ec88e3d
54
2021-12-18 19:04:57
0
856cae875b1b7f1ea06e1ca94b942fc9dc702b9b23920013392716f1507797e3
56
2021-12-18 01:46:40
0
afab081b22369bf28d63f17b8f8bd31c8bf1f90b9d8a1b9d8b6cc3140d557bf3
55
2021-12-16 17:30:08
0
2ac8cbcf0e1d631712e1abd1b629d146172f1c1d33f3a96fb718a4b7f1d4db19
57
2021-12-16 08:56:46
2
3bbd3a87fe5403ab4d02378cc1ce2ac0d80e29e82a356e6912da272dd26df513
54
2021-12-16 07:30:09
0
8f808f3f636c486197e9c4e3243091d3cb52d86cbe81a2888c08d5755e121cd2
57
2021-12-16 04:44:46
0
8d280172ab18a45f52213ae4eaeaff6f86c0ff324afe6b1c54d01727fb396af1
59
2021-12-16 04:08:56
2
caee62557f914d5346fb358d61f29cf2c973f6e44c4fd9946a636875c85274a4
58
2021-12-15 18:31:35
2
38a432e6e16430ab03b7a345904b3ffbdf75fb48fa94d835211f83b5454ae0d1
58
2021-12-15 18:24:46
0
5afdd8f9b33aec097938ee15e77e01328c90892b5df2a12b57a395b04ec77883
57
2021-12-15 16:32:25
0
cacbcaaedc0d7fdf744970c741c84c03859eb4ab48dba7fbf22ed34cffba092a
57
2021-12-14 20:19:55
2
1b7d6def1dd599f61b7b0d225bafb911ca850805628e418dfd0c5193016911a7
56
2021-12-14 20:11:07
2
3d138afd0676f62db6b30010f1f7abcca20b7d3d1323654c7aa864b49ebbb98b
58
2021-12-14 19:25:29
2
2abf4856594569dddc9cc1405758d0fe67dd3e62249476a3ac5311afb65a823d
58
2021-12-14 19:24:17
0
2b78008491f788d173191d0532ac6d441654318740c0a75b5eb51b8c5fb029b6
56
2021-12-14 18:32:07
3
69b824b3b2e094e97e0aa46c9b11d843064e616077ac1afced50ae66ac8395c4
58
2021-12-14 11:30:19
0
0a0663e32f9a9c5e1bb7d4bc75bd50325fedfb5786d41fb2ca3cbe362c77b321
56
2021-12-14 10:54:55
0
9d40520da30d4d507ed2f100ef0627de2cafa58bfcda97eb1dc84dc3877a95ff
57
2021-12-14 01:47:02
0
b45ddf15ca7792e9cbc0e5390ad8a1bc5567d20e8d8dfb80e46e2073164de97e
57
2021-12-13 20:09:56
0
020628fd94530a28e53d715a4dd5b6e2ebee66694a52522568a99b5860b8b73c
58
2021-12-13 12:30:24
0
e12f5930db89845c86609a550fb8dec7ac206c1dd8d88baa6b8396497460b74d
55
2021-12-13 10:03:06
0
23c98c1278a7e4290187a4a927f1d627df99aa56781753a42d3fc25d11346e6d
56
2021-12-13 09:56:17
7
e1c46ec8b9f8c57d3d193379849d84fca73dcc4684bf1397ae129b6c8d811529
57
2021-12-13 07:26:07
0
a939b1db7a329a41dc80282f57a6f99d71a6086655ffdca25917a80a2f2bc9a2
56
2021-12-13 07:17:22
0
555c237debfa272cf7faf0b4cedcc53f2302702da72677d20d766fe60f067e56
55
2021-12-13 00:41:05
0
30c54cfcf088fdcc349dcc7f58b73794afb83b675dfde152617d2a121ec49ad8
57
2021-12-12 09:17:43
0
dd2eff8ee8d8a5e5cfb5adf9f575ccb92d6faa570ee6e0241dfb33ebd2343ea2
56
2021-12-12 07:26:49
0
b5808176e1f4d67f1ac4599f137035944c399df92e0cb5fcebc34287c99d03bb
56
2021-12-12 07:25:48
0
c85db5d0eb26979a95cd653e28d6fab134f5ce03574c21b74791de75e5a67de8
56
2021-12-12 07:21:36
0
633b0b7efede0053e4b4ab0aee3a511d459c0eb2f78a3389cbe2aebc12cd38a5
57
2021-12-12 07:20:32
0
6ddb9de34b860ccd16143e71d9a6f24baafe78c36c885499a991e6143c7981e4
55
2021-12-12 07:17:17
0
4fa7b29c5546c65fa743a68a1d93b79dca6ee1ee1d4ecdb90ff9bd13250716d9
56
2021-12-12 06:59:10
0
754d9ab8d25c82be2b5dc6d100f1461a70a21765f83a7d36e457f8203e89bbd2
57
2021-12-12 06:53:47
0
edad7ef9c005c757bf2ec6f51579df2b967b96598c8e31aa207f16aa71969609
57
2021-12-12 06:53:47
0
15535e00e8000b285fb7117586b186d60a10a00f0c1f89b1f96c089535bfad6a
56
2021-12-12 06:53:41
0
fac8b82a8d39d2849cbf43fba1034b13ef72479ece67f247bfc1f9b017bae391
57
2021-12-12 06:52:35
0
d4915c746032aebf735e9cb72af7ed455462825a8502596d91e034c2adca5926
57
2021-12-12 06:49:54
0
171cd4bb38157ca2a9c7e6457a1fecf4bc72196ad53b3c1299b50e1a1a5d7daa
56
2021-12-12 02:30:55
0
f2bd9ddcb8bbbd919bda0bf5ffcc35093554a0ab2bf75dd008429486720ff86a
57
2021-12-11 23:45:42
0
3b5fe8f8e010b1f5c604907f96e01f4d5fc47d413a2493d61185eeaa07e66bab
57
2021-12-11 23:12:47
0
e051327310ca35d4809ee21b723a4e7e44c2c70313a4d59e4677390c14201eae
56
2021-12-11 17:37:41
0
ac8b066d261ca6312c3b2986fe6a95e51528d4d995bad70ee13883709004cbfc
57
2021-12-11 17:33:21
0
d4a17eb8fadfa099686117fb3734072206f060942489cfc39df9a3e48fd81484
57
2021-12-11 09:15:37

Rule Matches per Month (last 24 months)