SUSP_EXPL_OBFUSC_Dec21_1

Rule Info

Description
Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228
Score
60
Date
2021-12-11
Minimum Yara
1.7
Name
SUSP_EXPL_OBFUSC_Dec21_1
Required Modules
[]
Author
Florian Roth
Rule Hash
724a4ee987adc7983a920783f6e6ca13
Tags
['FILE', 'SUSP', 'CVE_2021_44228', 'OBFUS', 'EXPLOIT', 'T1027']

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
35
Clean (0 engines)
71

Rule Matches

Hash
Timestamp
Positives
Total
VT
d6a03544323b518c5966416ed80e00bef08018d4ec2475e88b97f82f78718195
2023-02-07 08:07:26
0
60
d4157866be762acfffee54a6417e940a6681cb7878394ea8d262709736591737
2023-02-07 04:36:53
0
60
6e78e5e5b1519f3f35ddc69ca40d648b6e98e584c635e3cd1f1f6a9cf7f00e4c
2023-01-12 17:02:19
0
60
07a4369908e569cd52ab79dca96c4766d51e401c7241ed2e9f7e54f5ecc9b6ae
2022-12-12 11:53:13
1
53
091d9790057cf9d955ce27c8f9697cd063ef26725a47e922ce911576cae68f56
2022-12-12 11:51:36
0
61
11f444b46f245918bfb5ec055a9eccd59654d37bdc1433d61b5ddb9aa8196ebd
2022-12-12 11:50:57
1
65
489033f1fad953820aee8714f889e17808eef9ec6267cac13f0f0d6d78f4c07c
2022-12-09 21:07:31
0
61
7df78c3fe9819f3af920337980e9d2d67753ccd9e8566db6c62d86074868d33f
2022-12-07 15:33:42
0
61
e376a6fc582eb80602d7e63061d850a41e63b0a0462b9f42cfac700b59080677
2022-12-05 16:14:23
11
60
dff808720bde69eaf8bc5f0576442038171db28821207a470c794ceac220272b
2022-12-02 20:31:23
0
61
1b1a1b532923cf69c197f16e08a2c86e9aa56ac430b1f79c75debc49bfbe22e6
2022-11-24 09:37:29
1
61
9b19ec862725a2e478863c41e4c033ca4c04596a324f25b0985d2bfb5fb5066c
2022-11-18 19:49:11
1
61
a5835ddc42188c594806165c5b110a3cd76db2a92af3d0cc9cad18f41b168a6b
2022-11-15 01:36:42
1
60
ee98da38fa1ebc7e429771d06aa276223c6b59b236de97d348d66e49826b0dae
2022-11-14 13:55:48
1
61
ff8e74bc651b29bd2dd3ca85750d5911433dc8e56707d19e770eb0342a44f9cb
2022-11-03 03:42:05
1
61
0a4503ea3bf09865848689e622ec314f73465ef9b5a0266feaae9f821a9be81e
2022-11-02 22:40:38
0
70
8faf467cc59b1eebaaa61457d4710f223c0ace0a9ff407318ce55a4c704cb8df
2022-11-02 20:53:54
1
55
c9297cb7656089c0e917e49e436ccd8b6a6314d935e5b6260eed8e6fd69e4eab
2022-11-02 20:49:39
1
45
ad9f3ddf8f9517f22a0cb84a8f9f457070059aaea5a35c6456207cd7c5be0f9d
2022-10-28 02:10:46
4
61
4acfb810326ca6f4499e26cee9ceb9b74dd599386b34078e955cb28fa7d7a090
2022-10-21 13:04:45
0
61
16d34a59faedf21a3ce9d7668a220ccede4eea2e9dc53c7faf9aac06e190d7d4
2022-10-21 13:04:45
0
61
44b9aa31b908165ba55a0165e843eeafd146b0e3cbbdc2c2874c74e740eda816
2022-10-11 09:17:25
0
60
40444b54c9e8932b74453d20ad3e6a83035e18af45b41546c05c68d87f386364
2022-10-06 16:48:33
6
61
e45173fa2dfac6bd460cb689f15781a2f4b45269446871e75dd9c43b56ff2b71
2022-09-17 16:01:11
0
59
1542d78013d8c8235ea4e3dd63dbe8c771c76eba86c1e6e794b18a6892e73eae
2022-09-10 02:34:22
4
59
9220e0110529d4fccf47d2fa5086658650d4f39eebb0bb5f8c982cceb2912dad
2022-09-08 01:37:23
1
59
6fb4dd4ae7b1b69433e99a11ce16cab56cf3cd308f0477299129c46b0f824736
2022-09-02 16:03:57
0
59
0770bae524451e38d3eccfcca963f3e2b3275860b64c468a076b117ed92ee787
2022-09-02 16:03:54
0
59
397ab1d688093f8bb4867b68222bef9d1f9a17c10918b725f512aa8153bb200a
2022-06-13 19:09:28
1
55
73d93ffab80eb4358268a1784dba66224fc96fa23b26a65f9201bf631e82c7fe
2022-04-21 16:10:51
0
57
c9478015f13863e57635fac5bf559cae3332e7024cfcc45d031eaad56c7b62a3
2022-03-28 18:16:03
0
57
d09222c19a6115b9a46adedf69ce4764904ca20de56acfc7fa10a92d75a45c8d
2022-03-08 21:30:36
10
56
da3e9e5f35f966c5cc3fef913384493ad514730055a0f4b5ac7dc45177dccaea
2022-03-07 22:24:04
0
56
f5739eea1ec7519fba60d1c9f559b7b52b1c7256bdb7235ba30fc22147b468cc
2022-02-24 06:36:02
1
58
5b8b39c2f3d026b30705d4bb9a7fc9fac41544899c17e941e021ab73fc25a588
2022-02-23 08:23:43
6
60
9809d340828f8016d9072f9f3696794fd0c24d5ce8a68f036cb4f406377a8e52
2022-02-21 22:13:00
20
66
8845a935b8fe3c921185076ad079b9f6de20d7e2ae7883bc3f2281b2c53e4128
2022-02-12 15:23:31
1
46
6017c3fd9018ac504880fd21fbe3da92b0637c4ce82fbb514780611929c4a53a
2022-02-06 13:04:49
1
55
89f176012dc40154b5f06532369bd4c5ffef67d13f5524add2227a37b0f4560b
2022-01-29 17:09:24
0
58
cd2419c5ea0e11e20f63aba4e2232a44ef35cc7a025b57974fac64b48be34e0b
2022-01-29 16:59:07
0
57
3d0e1ec7c7bbb53fa4245cabee6aa08b1e692c4bd372c0336edb98590938cb49
2022-01-29 16:46:08
0
57
8a03946b8605d375cb062d4ed4c02bd218b8094a55458842d69f3c9d88703563
2022-01-23 13:56:19
1
56
6e32e1cdeb9f01c039a8b6032663a2fcad040d2f2bf2950f8a46746d460e3277
2022-01-23 10:24:59
2
63
546e48de6932caf4c22dca427695afb0958b4e9ff3e0ebb7ae4ec50d643cedb8
2022-01-21 07:09:09
20
68
ff49760b49fdd7f235bad0fa6cc8dc1bcd34ee5c26d7585e92fd652a26962541
2022-01-17 07:43:38
0
55
2046c50543bae7e9ee03b4af98bfab56d2b0a17e976faa2e5fe0ee97a7c3fdec
2022-01-14 16:09:36
2
57
e5252cbc40ccbcda3834aa31500a5a2503928ad2de164f9bc94e85f3446b9cb2
2022-01-14 12:56:22
2
56
f307f3f33e01dd487c2ad55952a2b49acf6de2f2f0d990004eb6bdf23ebf2f2f
2022-01-11 19:04:20
0
61
a79409dc8dfb29350eb5331e15dc8c6607cd398dc4eccb78bcdb33defee9ced0
2022-01-11 19:04:19
1
68
89eb10301fd2da791f383591b8a9c4b2a7d85864d2fe93dcedd31b0a40c267a6
2022-01-09 14:39:06
1
57
35b1dc9c8c26c6762c9d163dd54e89427b19558249675d2040941c5fddd5848e
2022-01-09 12:16:29
2
58
6737a45eb67f2c6003b04a14c450be78b5dc4185e989cb384699ef48865c88a5
2022-01-06 23:26:10
0
57
83b1f868940a46ee17cbc47ec8461ecd9b85c1951403d5ae43c9ac46631eb2ec
2021-12-31 15:12:21
0
57
3f2972e7bc64908db29524a2a04c8456058ba28aba6e098104c45a0d6934e0ea
2021-12-31 15:12:18
0
57
eec28fc801f021adf5f56fe037c6d7d84ad002c0aeba4976d2a2a9b658ccd019
2021-12-31 15:12:04
0
52
64478431e36f15fbae8566f716d377d43b2a4fa1e2de8745934a9fca1b963abb
2021-12-29 19:07:04
1
53
c96f6c7308bc0a62f192afcd2b9d5206e6724216c407bd6a1cf4bfa51fce8e17
2021-12-28 19:05:47
0
56
74a98efcbf5d79e99ffa2128a9c3f3d03fba423dd55f4e7624f9acc81ab62fe7
2021-12-27 22:06:46
0
58
f988f98fbd7055b3869e157d06eee01dcc25b998868acb81ba6536e449750738
2021-12-27 14:42:53
0
57
ac46725d732f453d039dba13f410be7016750621551d4e57a2d5b769aebe3191
2021-12-24 13:11:15
0
56
0edf44b87750ed00f511aa59ff05ea355d38c7e984ed59670adc880222b32fa5
2021-12-23 13:37:59
0
57
9f1b486ecb28b414f2be6703153baa03d1d2d63e09c0dadd6d15f638a8f349c9
2021-12-23 01:48:35
0
66
094da9fb31b753ed07a99720ee6b251f0d0034ae633f81bb21613f0f9f944d70
2021-12-21 09:48:17
3
57
abfd75f0652bb522a16508c6c291a7e1f3f6a2f9a170b44ecbf65d7330b71591
2021-12-21 09:13:05
0
57
658ecc998b489111789685ed8d410af59a2e696019de676944b964d4def801b1
2021-12-21 09:05:38
0
57
3b5a3fca8a057c76ca026f160a040cba235f23c12ef9a61fcee960e7ed2b774e
2021-12-21 08:57:00
0
57
c2d0cebc8c20afc3efa4a42b2be4c1acef1ff2cd580ffbfcd9e108759887bba9
2021-12-20 01:27:49
0
56
d3284cc8c41997cba356da574ebefad504b66b634178952a2ab37f9e7ec88e3d
2021-12-18 19:04:57
0
54
856cae875b1b7f1ea06e1ca94b942fc9dc702b9b23920013392716f1507797e3
2021-12-18 01:46:40
0
56
afab081b22369bf28d63f17b8f8bd31c8bf1f90b9d8a1b9d8b6cc3140d557bf3
2021-12-16 17:30:08
0
55
2ac8cbcf0e1d631712e1abd1b629d146172f1c1d33f3a96fb718a4b7f1d4db19
2021-12-16 08:56:46
0
57
3bbd3a87fe5403ab4d02378cc1ce2ac0d80e29e82a356e6912da272dd26df513
2021-12-16 07:30:09
2
54
8f808f3f636c486197e9c4e3243091d3cb52d86cbe81a2888c08d5755e121cd2
2021-12-16 04:44:46
0
57
8d280172ab18a45f52213ae4eaeaff6f86c0ff324afe6b1c54d01727fb396af1
2021-12-16 04:08:56
0
59
caee62557f914d5346fb358d61f29cf2c973f6e44c4fd9946a636875c85274a4
2021-12-15 18:31:35
2
58
38a432e6e16430ab03b7a345904b3ffbdf75fb48fa94d835211f83b5454ae0d1
2021-12-15 18:24:46
2
58
5afdd8f9b33aec097938ee15e77e01328c90892b5df2a12b57a395b04ec77883
2021-12-15 16:32:25
0
57
cacbcaaedc0d7fdf744970c741c84c03859eb4ab48dba7fbf22ed34cffba092a
2021-12-14 20:19:55
0
57
1b7d6def1dd599f61b7b0d225bafb911ca850805628e418dfd0c5193016911a7
2021-12-14 20:11:07
2
56
3d138afd0676f62db6b30010f1f7abcca20b7d3d1323654c7aa864b49ebbb98b
2021-12-14 19:25:29
2
58
2abf4856594569dddc9cc1405758d0fe67dd3e62249476a3ac5311afb65a823d
2021-12-14 19:24:17
2
58
2b78008491f788d173191d0532ac6d441654318740c0a75b5eb51b8c5fb029b6
2021-12-14 18:32:07
0
56
69b824b3b2e094e97e0aa46c9b11d843064e616077ac1afced50ae66ac8395c4
2021-12-14 11:30:19
3
58
0a0663e32f9a9c5e1bb7d4bc75bd50325fedfb5786d41fb2ca3cbe362c77b321
2021-12-14 10:54:55
0
56
9d40520da30d4d507ed2f100ef0627de2cafa58bfcda97eb1dc84dc3877a95ff
2021-12-14 01:47:02
0
57
b45ddf15ca7792e9cbc0e5390ad8a1bc5567d20e8d8dfb80e46e2073164de97e
2021-12-13 20:09:56
0
57
020628fd94530a28e53d715a4dd5b6e2ebee66694a52522568a99b5860b8b73c
2021-12-13 12:30:24
0
58
e12f5930db89845c86609a550fb8dec7ac206c1dd8d88baa6b8396497460b74d
2021-12-13 10:03:06
0
55
23c98c1278a7e4290187a4a927f1d627df99aa56781753a42d3fc25d11346e6d
2021-12-13 09:56:17
0
56
e1c46ec8b9f8c57d3d193379849d84fca73dcc4684bf1397ae129b6c8d811529
2021-12-13 07:26:07
7
57
a939b1db7a329a41dc80282f57a6f99d71a6086655ffdca25917a80a2f2bc9a2
2021-12-13 07:17:22
0
56
555c237debfa272cf7faf0b4cedcc53f2302702da72677d20d766fe60f067e56
2021-12-13 00:41:05
0
55
30c54cfcf088fdcc349dcc7f58b73794afb83b675dfde152617d2a121ec49ad8
2021-12-12 09:17:43
0
57
dd2eff8ee8d8a5e5cfb5adf9f575ccb92d6faa570ee6e0241dfb33ebd2343ea2
2021-12-12 07:26:49
0
56
b5808176e1f4d67f1ac4599f137035944c399df92e0cb5fcebc34287c99d03bb
2021-12-12 07:25:48
0
56
c85db5d0eb26979a95cd653e28d6fab134f5ce03574c21b74791de75e5a67de8
2021-12-12 07:21:36
0
56
633b0b7efede0053e4b4ab0aee3a511d459c0eb2f78a3389cbe2aebc12cd38a5
2021-12-12 07:20:32
0
57
6ddb9de34b860ccd16143e71d9a6f24baafe78c36c885499a991e6143c7981e4
2021-12-12 07:17:17
0
55
4fa7b29c5546c65fa743a68a1d93b79dca6ee1ee1d4ecdb90ff9bd13250716d9
2021-12-12 06:59:10
0
56
edad7ef9c005c757bf2ec6f51579df2b967b96598c8e31aa207f16aa71969609
2021-12-12 06:53:47
0
57
754d9ab8d25c82be2b5dc6d100f1461a70a21765f83a7d36e457f8203e89bbd2
2021-12-12 06:53:47
0
57
15535e00e8000b285fb7117586b186d60a10a00f0c1f89b1f96c089535bfad6a
2021-12-12 06:53:41
0
56
fac8b82a8d39d2849cbf43fba1034b13ef72479ece67f247bfc1f9b017bae391
2021-12-12 06:52:35
0
57
d4915c746032aebf735e9cb72af7ed455462825a8502596d91e034c2adca5926
2021-12-12 06:49:54
0
57
171cd4bb38157ca2a9c7e6457a1fecf4bc72196ad53b3c1299b50e1a1a5d7daa
2021-12-12 02:30:55
0
56
f2bd9ddcb8bbbd919bda0bf5ffcc35093554a0ab2bf75dd008429486720ff86a
2021-12-11 23:45:42
0
57
3b5fe8f8e010b1f5c604907f96e01f4d5fc47d413a2493d61185eeaa07e66bab
2021-12-11 23:12:47
0
57
e051327310ca35d4809ee21b723a4e7e44c2c70313a4d59e4677390c14201eae
2021-12-11 17:37:41
0
56
ac8b066d261ca6312c3b2986fe6a95e51528d4d995bad70ee13883709004cbfc
2021-12-11 17:33:21
0
57
d4a17eb8fadfa099686117fb3734072206f060942489cfc39df9a3e48fd81484
2021-12-11 09:15:37
0
57

Rule Matches per Month (last 24 months)