SUSP_LNX_Indicators_Dec21_1

Rule Info

Av Ratio
24.19
Score
75
Name
SUSP_LNX_Indicators_Dec21_1
Minimum Yara
1.7
Required Modules
[]
Description
Detects code sequences and keyword combinations often found in malicious scripts on Linux platforms
Reference
Internal Research
Date
2021-12-30
Tags
['LINUX', 'SUSP']
Rule Hash
dbd17fc3c4eccd63c60459aa5da91177
Author
Florian Roth

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
61
Suspicious (< 10 engines)
31
Clean (0 engines)
14

Rule Matches

Positives
Hash
Total
Timestamp
VT
12
14d569533f32ae972c9cd4894e855526d74283871c3db15c23082f6e639afb17
57
2022-06-15 19:46:52
5
cff666f49e3bafb750c6aa91b46de805f265db5ab56f359b377f2b0a9d2de37c
57
2022-06-14 10:56:39
1
5c4fcf73a02fe7b40e82e2324493f414b24127d8c9042ed4e660ad4240649115
55
2022-06-13 20:15:44
2
e854edc3f4cbffa0e9f0041352770fd809b705d74f0a381dfaca28cff44defea
57
2022-06-11 19:57:35
0
44e1aaeea0eedeacb6808f5487a4a9fb1336958883bae711047f556225c1ffab
55
2022-06-10 18:26:37
1
efdbe98ee003c83caca6adfcca266420edac9c322c97e1ae12d69a59d4be7369
55
2022-06-10 18:24:18
1
692652847d4b9aca6f347b65941d4836f998ccb43a64eab6441de0654734d186
56
2022-06-10 18:23:16
0
888c203a63c164c430f4e54ffb23404fb28bfe877c672c2abe748b19642ffc29
56
2022-06-10 18:22:12
4
d754d7b3e4e3bf41e8779a6f568feaf7afbfc1586449e6165061034fce1241d4
56
2022-06-10 18:15:36
2
d86a1ff14acd216dd14ddfe0248a9c1eaa6eee6f8e007013babd07d1e02fb9f1
55
2022-06-10 17:27:48
1
11caab0f1f7e8c83c16ff27beaa8fb8ce48e3059636d906ea74014e8310a666a
56
2022-06-10 17:25:34
1
fdd9efeed2f5f17b6ea695c1cfd2ec7f12a0bb784e013d5c0edf5c17fb625446
56
2022-06-10 16:07:39
3
8347f18adc8100ce6ff4bf9ae59abbf24521967562df4618e6689d62d13daec5
57
2022-06-09 00:53:22
4
94b4711122e4bd55b369a4676799f7a702abfb2f757ae05d1609d875a2268ed1
58
2022-06-07 09:54:38
9
c2b5575020bd0e63641279e2c5da61c016b980a5376d6b712693771c6ddc3281
57
2022-06-06 21:35:40
47
d8ccc7b34c875d9bbbde99de2338b76aab46a87b777e3f010f205028d7bf9156
69
2022-05-28 20:07:52
5
69d27bbc851e7b549a2ef7c5004872d1db184f87824520fe88466b30a555f4dd
57
2022-05-25 01:34:19
12
21a8df5fdaebbccd12d34614d4d2922c91f235ac4db5af9ffc60fcb4801af43a
60
2022-05-24 17:13:12
5
59e47419090241f13f29b95928b22347f3649f90c33ca5c1549ec3d8ae9fe60c
58
2022-05-24 14:20:45
20
fef188fd277596285b60865f898206ef8536ec1e6ec2e3265652e54d336a8d43
59
2022-05-18 17:31:02
48
5c902be344f9e089e60c36bbe3345fb5bd9c3c0b4cec349a6bb18da7faef0908
69
2022-05-16 23:46:45
48
588b0838cc4c0fc64bfc1e5eeab2c9a59248e4e28a859ecbbac6bfe88bda703d
67
2022-05-16 23:45:34
35
77a9f3d4f498c8a84e09c89fd75d98eea31954cc17d948b876c00c638c95a7b6
61
2022-05-16 23:26:31
30
e627aff93c1e095786b5a5248425ec62c1ea8b049d487cfa6e9cfdf2a0ddbd7b
61
2022-05-16 21:32:50
28
d50864f13378b333784f7469df98ef2ea438489ccf0649622897a7712a9c18f8
58
2022-05-16 12:47:31
0
81ff7c6a0b5674fee112f62aeef126da6254575d7d0f48e4e4ccb8988a513ded
58
2022-05-13 09:31:42
2
a696ee08a698994bb605474294d153a3f4af2b5209d4d0245167b55c0e1a11f8
57
2022-05-12 11:53:03
10
0d6d24afaa049bb6fd048bd1cea78ae2a14421f451ed1004e3493dfe8cc750db
59
2022-05-12 08:02:46
35
b6703bbc7b416cfcc1c7dbb3cc9a444dfa615e4a59e32b419d259fb7a20b9f12
62
2022-05-11 08:36:35
0
b76aa354f9957a0050c517cb6d628288869258a47308ecfd7ad72ddd6c5fce2a
58
2022-05-10 14:29:52
12
f8cd8f2284ac04d7e596ee96be1f7cf16bd4e23c07ef93a8a488ec7b5e4be78b
61
2022-05-06 18:19:17
8
da2429f143c1b7f110e0ed364d1699308a670bfab073e3ee00f2a159e6558692
59
2022-05-05 04:29:36
12
c3ffc99f5c146f0bce2a222adf73851b988fa38a6ac957df9b621f67e6372ed1
62
2022-04-30 12:33:36
29
5a05c3c00c4f08a22a14568178a1d12202ae93a9ba38f15843eb64a6fd6c061a
62
2022-04-28 12:28:00
5
66db8719714ebd4d8ea8dcd4e52377726363bb64af63eff5764ce139b75240bf
58
2022-04-27 15:30:08
0
6b510e4ce14609f5ef6a18628c55c3269731a261bf7a7c0d5bdbf624aa98c988
57
2022-04-27 12:05:30
0
d13d36e44c69b47488cef851142c428e813ac5dc6049b5d8fb93653bb1940229
58
2022-04-26 07:36:52
30
b98e404caa14a2f7ccfd9737a47f94812337c96358e60e03f0527774dda8c185
68
2022-04-26 05:30:03
13
cd784dc1f7bd95cac84dc696d63d8c807129ef47b3ce08cd08afb7b7456a8cd3
62
2022-04-14 15:08:37
9
a6f2b5b63c39b0830044799d9accf32b72ccad5421b3367c34fefcbfc0debaf6
59
2022-04-14 11:43:11
19
dc42670f716cde21f28b5d118f4b8103fa223bf91df596a76cc8a68e20fb1818
58
2022-04-11 20:12:08
0
bf83fd087cac494d5aae150d49e607896200df4bc33a3de5fb4c03e1612bc007
58
2022-04-11 14:18:21
0
a045dab146973316619abb05d9e9e909019092a72010cf059aab3f2258bea75a
57
2022-04-08 13:31:37
25
cc89d276b82c085fcb65bcbdb07f847465fe55fe539852cad3c2614b3d5b57e3
62
2022-04-08 13:25:26
28
80bc54d4ab67d93ef51730fae2db48112ddd01c1f41696bedbf3131695896d01
62
2022-04-08 13:25:14
36
3f09c30cbdcd024163b0e68433007a48c5fce0d282c29e518156e960368d331e
62
2022-04-08 12:18:36
31
f33c8c384deee5a3984d6803c29d313ee56d43e6f0b03877fb356eb101b4d3e1
62
2022-04-08 12:06:51
17
846bf1974bd7b8dcb76aab13f08eed05cf7e2eae7269b4c7e410637fc32dcaba
58
2022-04-06 18:31:49
18
d40f2d80c76bc01235c6e0e6616d0cb1d2c509034b74f85ef2466896cecd2954
58
2022-04-06 18:31:48
26
21f579ba681fb0f6c6ce5f816d60a8267943b87d451a50e04443dfaadbc3bdce
57
2022-04-06 13:24:05
49
be8d067e762c5da8e616f62e882881b82c8627943bdf006e304fd9a4f784763f
70
2022-04-03 04:42:56
35
1791d85aeede157bee1fb5d2bb6da5337355e7b82e7d4ecbc6976abea7a48eac
70
2022-03-31 10:09:38
20
2c3edef5811696537c22cde79acb38dd7f623a0a56438516d37beef42a7224a8
57
2022-03-30 18:22:24
27
f176d69f18cde008f1998841c343c3e5d4337b495132232507a712902a0aec5e
57
2022-03-30 09:08:29
0
becb830244233136fb924b98385f65ab341b7d58bac1a60af081d24455c1dd07
57
2022-03-30 05:14:43
32
f2f596a3ef31348a6bccf84bc0c1a49972bca5c3944d0316c230664b82432b0e
61
2022-03-25 12:59:16
7
f4b112f964d2661130f8de37317ae4942e3f2b21e0a12f35e2051de4b741d6a9
55
2022-03-24 20:20:20
32
8f05f5c9233a834556130e226fa38f164c1a4141a34ac56125a17ed9815c41b8
56
2022-03-23 06:49:58
8
8da927116dc9273b6d64ad8b007e257f0ecd4a6c51420c601a63d58784c8436f
57
2022-03-22 18:55:39
19
e6324198484698f663232b2b863e8a80c2a0f7b20d2e8c3b7cf91188356b5d2a
67
2022-03-14 16:05:31
33
60659a04b923b7864ac74435b511e7a875c677b7ab9bd1fdd82dd16e7f527635
60
2022-03-11 11:14:32
23
93b995bc8abc4f3e3c6d64a416a4d5ee60dc46b869662cf4da57e931ac381dc4
59
2022-03-11 09:26:26
11
ad62ccb9d82376000ab8538973969b778817e7e9017eba7d61873596fe1e0a03
55
2022-03-11 09:18:44
5
8ee3d825859ead1500a338cfd65e6fdf4aff3f0b278e55d478bff6f8385d2ac4
55
2022-03-09 08:07:39
7
b8591ea6cd969e5a4f3459390e2a2112e82f00e8e42f38df9c036a7fe97b490d
56
2022-03-06 00:32:38
21
90e9312eeacf47d9b081904c8b6a41391751cc2fd0aa9decfb9117ef427c0e44
61
2022-03-05 01:43:36
21
9b8c31a9bb2764b8cad7a9e868140c9686b5a27f53e911ff696cbabaff2ec01d
57
2022-03-03 20:52:56
26
7b09767e5a6317cbea14ff3b59d65938f69fc53e2f21fae3bcc239a672ef50e9
58
2022-02-28 05:26:28
0
06b2a05211b07abb3af86ef681e47e6034bc94becf2f8fd9a6734cc9d23faa46
57
2022-02-22 13:18:49
5
2099f8672faff96dd1b268c9121e8b61b68df3ddf5d72f7929edcf9e583b4daf
58
2022-02-19 07:47:08
3
b1950a3ded58df3966434c123ea20e4155a956e48ffa0e4b8ab6476760203dec
58
2022-02-15 19:36:56
27
3016222e1dadd91229abf6bba6f5c47f48dc88503876df91be19817124296c1c
70
2022-02-15 09:44:26
0
98a115cc97885b2c0c882b10353dc76949384090878264b4b3a0a136747d8a83
58
2022-02-11 11:27:17
16
d2f1c7de7c04cd677e0cd45a1efe5a1097fa49cdc12bed06b8f81a8e091578a4
58
2022-02-09 09:10:58
15
cad00713779e476d891d080bd2eb661a373c4422fe4a4b808bb0679a9896c74f
58
2022-01-28 12:44:07
0
ed6db19cd6ce4c5e0007175f9795f17c9816b7da0f47625051125d66841319a5
62
2022-01-28 12:35:10
0
4b3d36b20425da9ec6cbf1a446c47450685d43d6b545029d5411fa2f6beae472
59
2022-01-28 04:59:41
0
c9348b14d5fa44a76d65969f10b2f3ad1708a5807d92f750f1ed5a27ccc161da
58
2022-01-26 22:46:10
20
d6c961c409209b81dc8bd9cc6a8a823041823b8b0fe9033548c5ab0a498d3976
59
2022-01-26 17:14:10
33
856cc0a510b5eb656bfbd33e0a5218f6df0e338fea090f66117e84578ead733c
59
2022-01-24 22:24:40
23
4614551cccb1c46c438c2365c0417aa5644afdb0a8d3b492547953a03e60b2df
61
2022-01-24 20:32:39
2
52a288fe90b70643b81a910962d8fad47796e24c2e8c2790c89a58574e989ed3
57
2022-01-22 08:19:22
13
1963b144e9c4d8fcacbe7b1ee5cb25011b1d496762620bb136a2601ea451e3e6
61
2022-01-20 23:15:17
32
b17829d758e8689143456240ebd79b420f963722707246f5dc9b085a411f7b5e
61
2022-01-20 12:06:30
2
479c73b6747e4c467c55c54e4dde547b47068223aeb17bcca6fa9de21d236a2a
57
2022-01-19 04:16:11
16
25718a4326ff825fa168810cab36fe46eca0573363a9bf5ed92198331327f79e
57
2022-01-17 15:42:37
27
a6b3938ded3e5cb06123b868359b996e3f451ecda38458cc838902cc3a6735ee
68
2022-01-16 22:52:56
16
61828e1f6b19b330229270c70f20347bebf44412709e99b95edc472728004b8a
61
2022-01-16 17:26:50
16
b04f1061808e890e5ec1301b0cde1f63370518584766fce495287442f14816c1
61
2022-01-16 17:26:48
16
75ce1c171e67ec576646a8b380bb4248753de5f60b8ce2cd089bb4e943dcef15
60
2022-01-16 17:25:41
16
d23b70e20fdb1fd95448ef1fda9e5bf56a9f85f8aefeaac459f6e6f1ec7697f6
62
2022-01-15 09:35:39
15
b46764c046e0db26e6f43f46364ac0acad173541e7134611cb64e091db7b7ced
56
2022-01-14 17:06:38
30
554073344a25b5c6f68b4c84dc54a6db75478bf9e876a1ce5cf12b76275b3968
57
2022-01-12 15:57:01
15
8b2ab3dbca38b455e9ed04640f7193409a37958e05f92a8e25e4a34bdd2dae99
56
2022-01-10 10:28:09
23
95c81deeffd6c6fdbafe75ed011c0a3df9e11f35d5b329da20becd7e1a17493e
60
2022-01-09 22:14:48
5
44cb9c1e139a06a86442c92b596a653659132fbc92986a2f5338630c90200af1
58
2022-01-09 17:02:14
14
47b79650c42c9be434b68a67758a2426566394954dc72f7f49281c7f5c2f572a
62
2022-01-08 11:22:03
13
93c63841fa373ce830b164ef408271b7d3a35a1c9ff2851a7a859a7dbf23173b
56
2022-01-04 20:22:26
2
f68d8e58f3e2991dc81d92a2739d17930949b6701602c76deec855c6c13807f3
57
2022-01-04 19:47:18
1
44451b52388d95aa59d83b881598dc31849a309077a8037776fd44b5a94e9af3
57
2022-01-04 15:10:16
15
8a18ca0921b5558d72724d09383d199beac46c4a99657417a4104458a821f38c
58
2022-01-03 15:40:12
3
04cfacf95a0f168353c28015c98bb01ecadb542a1894833519c0e05b475f0efd
57
2022-01-03 12:16:36
28
afea2d830d6e3f3df27ae1d66b573333f10c52f0ecbe3d16b28d938336e18d6c
68
2022-01-02 18:19:50
1
5c2ad5e6d61d5a8c94de2d19e50f33af744d15e4d9bdefb611b5ae684ea2bbca
57
2021-12-31 12:05:49
14
2151085f451e3f18c230929264740ca105625e9b2e675da7a201b8e201d5e920
57
2021-12-31 11:05:50
24
a3c5069e84a99e667f8e68708db9bea8bc23234e03d6047c1c078ef6db39331b
58
2021-12-30 20:34:30

Rule Matches per Month (last 24 months)