SUSP_EXPL_OBFUSC_Dec21_1

Rule Info

Name
SUSP_EXPL_OBFUSC_Dec21_1
Minimum Yara
1.7
Date
2021-12-11
Description
Detects obfuscation methods used to evade detection in log4j exploitation attempt of CVE-2021-44228
Author
Florian Roth
Rule Hash
724a4ee987adc7983a920783f6e6ca13
Tags
['CVE_2021_44228', 'FILE', 'OBFUS', 'SUSP', 'EXPLOIT', 'T1027']
Score
60
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
4
Suspicious (< 10 engines)
41
Clean (0 engines)
75

Rule Matches

Hash
Timestamp
Total
Positives
VT
c599af64dd18dea936fac5fe9992ff0fbaacb9b10c45a74ef4433f4ddb97fe12
2023-05-19 19:12:17
59
0
a7e98f3ca0a8e665e3b69cba51af9235ec1cd5462931af18471c333868481d33
2023-05-02 03:07:43
42
0
9e560bb8d7296a70092eb5f34fbc5e5ecab7fa400c5ab3a0ae4626a174d4fadd
2023-04-25 13:13:56
59
0
9ac6968b1bc2f9d3f072f9bacd9e414d4c027e313e737c44aea3efb0d4ec2802
2023-04-10 19:08:56
58
9
17e4e366cf8966580c48842dff960c4fff2f28113cfef056f7db7d41e56aa7ba
2023-03-29 13:00:20
58
2
bfc75b554f993ffa4746465bcceb4ee01274a2e26d013e230a992b55762f0ea6
2023-03-19 18:01:40
59
1
9f79ff9908e2471531baea22d0886dd8b39c21fbd668a8e8146d71a2999ac5eb
2023-03-17 09:30:06
60
1
b2f5b47803b6b016ad37d7fa61f333991d186e1bf261f0566e2e26611e1a0b71
2023-03-15 18:05:03
58
0
fbe52200264043b2a2bbcb84879ba44374fa04a19bf7aa17266b7226b5fb70e8
2023-02-20 14:20:51
60
1
11334b118bf00da2239becbe8ff85c54078f172406d4038ddf8ccfd1258809e8
2023-02-09 21:09:55
60
8
d6a03544323b518c5966416ed80e00bef08018d4ec2475e88b97f82f78718195
2023-02-07 08:07:26
60
0
d4157866be762acfffee54a6417e940a6681cb7878394ea8d262709736591737
2023-02-07 04:36:53
60
0
6e78e5e5b1519f3f35ddc69ca40d648b6e98e584c635e3cd1f1f6a9cf7f00e4c
2023-01-12 17:02:19
60
0
07a4369908e569cd52ab79dca96c4766d51e401c7241ed2e9f7e54f5ecc9b6ae
2022-12-12 11:53:13
53
1
091d9790057cf9d955ce27c8f9697cd063ef26725a47e922ce911576cae68f56
2022-12-12 11:51:36
61
0
11f444b46f245918bfb5ec055a9eccd59654d37bdc1433d61b5ddb9aa8196ebd
2022-12-12 11:50:57
65
1
489033f1fad953820aee8714f889e17808eef9ec6267cac13f0f0d6d78f4c07c
2022-12-09 21:07:31
61
0
7df78c3fe9819f3af920337980e9d2d67753ccd9e8566db6c62d86074868d33f
2022-12-07 15:33:42
61
0
e376a6fc582eb80602d7e63061d850a41e63b0a0462b9f42cfac700b59080677
2022-12-05 16:14:23
60
11
dff808720bde69eaf8bc5f0576442038171db28821207a470c794ceac220272b
2022-12-02 20:31:23
61
0
1b1a1b532923cf69c197f16e08a2c86e9aa56ac430b1f79c75debc49bfbe22e6
2022-11-24 09:37:29
61
1
9b19ec862725a2e478863c41e4c033ca4c04596a324f25b0985d2bfb5fb5066c
2022-11-18 19:49:11
61
1
a5835ddc42188c594806165c5b110a3cd76db2a92af3d0cc9cad18f41b168a6b
2022-11-15 01:36:42
60
1
ee98da38fa1ebc7e429771d06aa276223c6b59b236de97d348d66e49826b0dae
2022-11-14 13:55:48
61
1
ff8e74bc651b29bd2dd3ca85750d5911433dc8e56707d19e770eb0342a44f9cb
2022-11-03 03:42:05
61
1
0a4503ea3bf09865848689e622ec314f73465ef9b5a0266feaae9f821a9be81e
2022-11-02 22:40:38
70
0
8faf467cc59b1eebaaa61457d4710f223c0ace0a9ff407318ce55a4c704cb8df
2022-11-02 20:53:54
55
1
c9297cb7656089c0e917e49e436ccd8b6a6314d935e5b6260eed8e6fd69e4eab
2022-11-02 20:49:39
45
1
ad9f3ddf8f9517f22a0cb84a8f9f457070059aaea5a35c6456207cd7c5be0f9d
2022-10-28 02:10:46
61
4
4acfb810326ca6f4499e26cee9ceb9b74dd599386b34078e955cb28fa7d7a090
2022-10-21 13:04:45
61
0
16d34a59faedf21a3ce9d7668a220ccede4eea2e9dc53c7faf9aac06e190d7d4
2022-10-21 13:04:45
61
0
44b9aa31b908165ba55a0165e843eeafd146b0e3cbbdc2c2874c74e740eda816
2022-10-11 09:17:25
60
0
40444b54c9e8932b74453d20ad3e6a83035e18af45b41546c05c68d87f386364
2022-10-06 16:48:33
61
6
e45173fa2dfac6bd460cb689f15781a2f4b45269446871e75dd9c43b56ff2b71
2022-09-17 16:01:11
59
0
1542d78013d8c8235ea4e3dd63dbe8c771c76eba86c1e6e794b18a6892e73eae
2022-09-10 02:34:22
59
4
9220e0110529d4fccf47d2fa5086658650d4f39eebb0bb5f8c982cceb2912dad
2022-09-08 01:37:23
59
1
6fb4dd4ae7b1b69433e99a11ce16cab56cf3cd308f0477299129c46b0f824736
2022-09-02 16:03:57
59
0
0770bae524451e38d3eccfcca963f3e2b3275860b64c468a076b117ed92ee787
2022-09-02 16:03:54
59
0
397ab1d688093f8bb4867b68222bef9d1f9a17c10918b725f512aa8153bb200a
2022-06-13 19:09:28
55
1
73d93ffab80eb4358268a1784dba66224fc96fa23b26a65f9201bf631e82c7fe
2022-04-21 16:10:51
57
0
c9478015f13863e57635fac5bf559cae3332e7024cfcc45d031eaad56c7b62a3
2022-03-28 18:16:03
57
0
d09222c19a6115b9a46adedf69ce4764904ca20de56acfc7fa10a92d75a45c8d
2022-03-08 21:30:36
56
10
da3e9e5f35f966c5cc3fef913384493ad514730055a0f4b5ac7dc45177dccaea
2022-03-07 22:24:04
56
0
f5739eea1ec7519fba60d1c9f559b7b52b1c7256bdb7235ba30fc22147b468cc
2022-02-24 06:36:02
58
1
5b8b39c2f3d026b30705d4bb9a7fc9fac41544899c17e941e021ab73fc25a588
2022-02-23 08:23:43
60
6
9809d340828f8016d9072f9f3696794fd0c24d5ce8a68f036cb4f406377a8e52
2022-02-21 22:13:00
66
20
8845a935b8fe3c921185076ad079b9f6de20d7e2ae7883bc3f2281b2c53e4128
2022-02-12 15:23:31
46
1
6017c3fd9018ac504880fd21fbe3da92b0637c4ce82fbb514780611929c4a53a
2022-02-06 13:04:49
55
1
89f176012dc40154b5f06532369bd4c5ffef67d13f5524add2227a37b0f4560b
2022-01-29 17:09:24
58
0
cd2419c5ea0e11e20f63aba4e2232a44ef35cc7a025b57974fac64b48be34e0b
2022-01-29 16:59:07
57
0
3d0e1ec7c7bbb53fa4245cabee6aa08b1e692c4bd372c0336edb98590938cb49
2022-01-29 16:46:08
57
0
8a03946b8605d375cb062d4ed4c02bd218b8094a55458842d69f3c9d88703563
2022-01-23 13:56:19
56
1
6e32e1cdeb9f01c039a8b6032663a2fcad040d2f2bf2950f8a46746d460e3277
2022-01-23 10:24:59
63
2
546e48de6932caf4c22dca427695afb0958b4e9ff3e0ebb7ae4ec50d643cedb8
2022-01-21 07:09:09
68
20
ff49760b49fdd7f235bad0fa6cc8dc1bcd34ee5c26d7585e92fd652a26962541
2022-01-17 07:43:38
55
0
2046c50543bae7e9ee03b4af98bfab56d2b0a17e976faa2e5fe0ee97a7c3fdec
2022-01-14 16:09:36
57
2
e5252cbc40ccbcda3834aa31500a5a2503928ad2de164f9bc94e85f3446b9cb2
2022-01-14 12:56:22
56
2
f307f3f33e01dd487c2ad55952a2b49acf6de2f2f0d990004eb6bdf23ebf2f2f
2022-01-11 19:04:20
61
0
a79409dc8dfb29350eb5331e15dc8c6607cd398dc4eccb78bcdb33defee9ced0
2022-01-11 19:04:19
68
1
89eb10301fd2da791f383591b8a9c4b2a7d85864d2fe93dcedd31b0a40c267a6
2022-01-09 14:39:06
57
1
35b1dc9c8c26c6762c9d163dd54e89427b19558249675d2040941c5fddd5848e
2022-01-09 12:16:29
58
2
6737a45eb67f2c6003b04a14c450be78b5dc4185e989cb384699ef48865c88a5
2022-01-06 23:26:10
57
0
83b1f868940a46ee17cbc47ec8461ecd9b85c1951403d5ae43c9ac46631eb2ec
2021-12-31 15:12:21
57
0
3f2972e7bc64908db29524a2a04c8456058ba28aba6e098104c45a0d6934e0ea
2021-12-31 15:12:18
57
0
eec28fc801f021adf5f56fe037c6d7d84ad002c0aeba4976d2a2a9b658ccd019
2021-12-31 15:12:04
52
0
64478431e36f15fbae8566f716d377d43b2a4fa1e2de8745934a9fca1b963abb
2021-12-29 19:07:04
53
1
c96f6c7308bc0a62f192afcd2b9d5206e6724216c407bd6a1cf4bfa51fce8e17
2021-12-28 19:05:47
56
0
74a98efcbf5d79e99ffa2128a9c3f3d03fba423dd55f4e7624f9acc81ab62fe7
2021-12-27 22:06:46
58
0
f988f98fbd7055b3869e157d06eee01dcc25b998868acb81ba6536e449750738
2021-12-27 14:42:53
57
0
ac46725d732f453d039dba13f410be7016750621551d4e57a2d5b769aebe3191
2021-12-24 13:11:15
56
0
0edf44b87750ed00f511aa59ff05ea355d38c7e984ed59670adc880222b32fa5
2021-12-23 13:37:59
57
0
9f1b486ecb28b414f2be6703153baa03d1d2d63e09c0dadd6d15f638a8f349c9
2021-12-23 01:48:35
66
0
094da9fb31b753ed07a99720ee6b251f0d0034ae633f81bb21613f0f9f944d70
2021-12-21 09:48:17
57
3
abfd75f0652bb522a16508c6c291a7e1f3f6a2f9a170b44ecbf65d7330b71591
2021-12-21 09:13:05
57
0
658ecc998b489111789685ed8d410af59a2e696019de676944b964d4def801b1
2021-12-21 09:05:38
57
0
3b5a3fca8a057c76ca026f160a040cba235f23c12ef9a61fcee960e7ed2b774e
2021-12-21 08:57:00
57
0
c2d0cebc8c20afc3efa4a42b2be4c1acef1ff2cd580ffbfcd9e108759887bba9
2021-12-20 01:27:49
56
0
d3284cc8c41997cba356da574ebefad504b66b634178952a2ab37f9e7ec88e3d
2021-12-18 19:04:57
54
0
856cae875b1b7f1ea06e1ca94b942fc9dc702b9b23920013392716f1507797e3
2021-12-18 01:46:40
56
0
afab081b22369bf28d63f17b8f8bd31c8bf1f90b9d8a1b9d8b6cc3140d557bf3
2021-12-16 17:30:08
55
0
2ac8cbcf0e1d631712e1abd1b629d146172f1c1d33f3a96fb718a4b7f1d4db19
2021-12-16 08:56:46
57
0
3bbd3a87fe5403ab4d02378cc1ce2ac0d80e29e82a356e6912da272dd26df513
2021-12-16 07:30:09
54
2
8f808f3f636c486197e9c4e3243091d3cb52d86cbe81a2888c08d5755e121cd2
2021-12-16 04:44:46
57
0
8d280172ab18a45f52213ae4eaeaff6f86c0ff324afe6b1c54d01727fb396af1
2021-12-16 04:08:56
59
0
caee62557f914d5346fb358d61f29cf2c973f6e44c4fd9946a636875c85274a4
2021-12-15 18:31:35
58
2
38a432e6e16430ab03b7a345904b3ffbdf75fb48fa94d835211f83b5454ae0d1
2021-12-15 18:24:46
58
2
5afdd8f9b33aec097938ee15e77e01328c90892b5df2a12b57a395b04ec77883
2021-12-15 16:32:25
57
0
cacbcaaedc0d7fdf744970c741c84c03859eb4ab48dba7fbf22ed34cffba092a
2021-12-14 20:19:55
57
0
1b7d6def1dd599f61b7b0d225bafb911ca850805628e418dfd0c5193016911a7
2021-12-14 20:11:07
56
2
3d138afd0676f62db6b30010f1f7abcca20b7d3d1323654c7aa864b49ebbb98b
2021-12-14 19:25:29
58
2
2abf4856594569dddc9cc1405758d0fe67dd3e62249476a3ac5311afb65a823d
2021-12-14 19:24:17
58
2
2b78008491f788d173191d0532ac6d441654318740c0a75b5eb51b8c5fb029b6
2021-12-14 18:32:07
56
0
69b824b3b2e094e97e0aa46c9b11d843064e616077ac1afced50ae66ac8395c4
2021-12-14 11:30:19
58
3
0a0663e32f9a9c5e1bb7d4bc75bd50325fedfb5786d41fb2ca3cbe362c77b321
2021-12-14 10:54:55
56
0
9d40520da30d4d507ed2f100ef0627de2cafa58bfcda97eb1dc84dc3877a95ff
2021-12-14 01:47:02
57
0
b45ddf15ca7792e9cbc0e5390ad8a1bc5567d20e8d8dfb80e46e2073164de97e
2021-12-13 20:09:56
57
0
020628fd94530a28e53d715a4dd5b6e2ebee66694a52522568a99b5860b8b73c
2021-12-13 12:30:24
58
0
e12f5930db89845c86609a550fb8dec7ac206c1dd8d88baa6b8396497460b74d
2021-12-13 10:03:06
55
0
23c98c1278a7e4290187a4a927f1d627df99aa56781753a42d3fc25d11346e6d
2021-12-13 09:56:17
56
0
e1c46ec8b9f8c57d3d193379849d84fca73dcc4684bf1397ae129b6c8d811529
2021-12-13 07:26:07
57
7
a939b1db7a329a41dc80282f57a6f99d71a6086655ffdca25917a80a2f2bc9a2
2021-12-13 07:17:22
56
0
555c237debfa272cf7faf0b4cedcc53f2302702da72677d20d766fe60f067e56
2021-12-13 00:41:05
55
0
30c54cfcf088fdcc349dcc7f58b73794afb83b675dfde152617d2a121ec49ad8
2021-12-12 09:17:43
57
0
dd2eff8ee8d8a5e5cfb5adf9f575ccb92d6faa570ee6e0241dfb33ebd2343ea2
2021-12-12 07:26:49
56
0
b5808176e1f4d67f1ac4599f137035944c399df92e0cb5fcebc34287c99d03bb
2021-12-12 07:25:48
56
0
c85db5d0eb26979a95cd653e28d6fab134f5ce03574c21b74791de75e5a67de8
2021-12-12 07:21:36
56
0
633b0b7efede0053e4b4ab0aee3a511d459c0eb2f78a3389cbe2aebc12cd38a5
2021-12-12 07:20:32
57
0
6ddb9de34b860ccd16143e71d9a6f24baafe78c36c885499a991e6143c7981e4
2021-12-12 07:17:17
55
0
4fa7b29c5546c65fa743a68a1d93b79dca6ee1ee1d4ecdb90ff9bd13250716d9
2021-12-12 06:59:10
56
0
edad7ef9c005c757bf2ec6f51579df2b967b96598c8e31aa207f16aa71969609
2021-12-12 06:53:47
57
0
754d9ab8d25c82be2b5dc6d100f1461a70a21765f83a7d36e457f8203e89bbd2
2021-12-12 06:53:47
57
0
15535e00e8000b285fb7117586b186d60a10a00f0c1f89b1f96c089535bfad6a
2021-12-12 06:53:41
56
0
fac8b82a8d39d2849cbf43fba1034b13ef72479ece67f247bfc1f9b017bae391
2021-12-12 06:52:35
57
0
d4915c746032aebf735e9cb72af7ed455462825a8502596d91e034c2adca5926
2021-12-12 06:49:54
57
0
171cd4bb38157ca2a9c7e6457a1fecf4bc72196ad53b3c1299b50e1a1a5d7daa
2021-12-12 02:30:55
56
0
f2bd9ddcb8bbbd919bda0bf5ffcc35093554a0ab2bf75dd008429486720ff86a
2021-12-11 23:45:42
57
0
3b5fe8f8e010b1f5c604907f96e01f4d5fc47d413a2493d61185eeaa07e66bab
2021-12-11 23:12:47
57
0
e051327310ca35d4809ee21b723a4e7e44c2c70313a4d59e4677390c14201eae
2021-12-11 17:37:41
56
0
ac8b066d261ca6312c3b2986fe6a95e51528d4d995bad70ee13883709004cbfc
2021-12-11 17:33:21
57
0
d4a17eb8fadfa099686117fb3734072206f060942489cfc39df9a3e48fd81484
2021-12-11 09:15:37
57
0

Rule Matches per Month (last 24 months)