SUSP_LNX_Reverse_Shell_Indicator_Jun21_2

Rule Info

Av Ratio
8.16
Required Modules
[]
Name
SUSP_LNX_Reverse_Shell_Indicator_Jun21_2
Score
70
Date
2021-06-05
Minimum Yara
1.7
Author
Florian Roth
Description
Detects reverse shell code as used in Linux hack tools or payloads
Tags
['LINUX', 'FILE', 'SUSP']
Rule Hash
c1f7906900603777144bd61f3e10c09a

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
7
Suspicious (< 10 engines)
31
Clean (0 engines)
19

Rule Matches

Total
Hash
Timestamp
Positives
VT
56
cfd9ecfb2f37b50a415efdfd53d3dfe6449aedb6a709be72bcac07b756135f71
2021-09-23 15:34:46
4
57
096fe6041a158af3e7c7fb17972303007cb89101bfae68c3e9da05eb8902b1a8
2021-09-19 15:07:14
0
58
c66b9cfcb748d498489d4e32f57173e22370442deae2e759c5025bf70948e84f
2021-09-18 16:20:55
4
62
b05b0cfad6d32f9a56865d1e24cf02b6642892f60ad5d972b2f291484d5c7b50
2021-09-16 22:35:35
37
58
6dc4da271606c683955d063449e394cf2a088b9bd6ac14b0bd0a09766a2d47a4
2021-09-10 21:56:34
3
61
3c9e4ba1278b751c24f03ba39cb317b1bc51d2dc5173b0a0b201bc62fdc2c6fd
2021-09-10 13:23:59
7
57
a5a9acdb93ddc88fa65bde2587d99d85c6218023b63f7d5282854ac843e19788
2021-09-08 15:21:11
0
57
2e3deed13f2b358ff10c1ef5096f88a1453c0a298a7ff66e9235aa198f346a90
2021-09-06 13:25:46
0
56
233df69b7d99b9d31228446e00d2d66c9d596b42312f0186f8ec725d7e4d1970
2021-09-06 13:22:07
0
56
b59dbf1af739e72e9bab98c6cd2f699bb6ff9045f8003d0d0c23c2974b4eb1b2
2021-09-05 22:28:37
8
56
f96758ffc2899624ca6ca371a5ef1a5f3d93a9edf8b66ae4f01ecc516d10e533
2021-09-04 05:44:34
0
56
03207c8670299d503957dda5b2a31912978c6dc9810548665a31fe6ef1cd56b8
2021-09-03 09:42:06
10
58
2b6e6b66692f78f1ae6bf93d3ea1831784cae3406490bd46ab36447b056069e3
2021-09-03 02:37:34
10
58
6a2224bb384547f03f0fec8779659b75722245e2a29e52a086069836faec2fc3
2021-09-02 17:53:28
8
60
47c4e2c71e5caa2e0aeb3ed7a3f0d2c482c6acc19e82bac5d7821aa6ef9e735a
2021-09-02 01:27:55
6
60
e31adf469212c946b3305eee067eaa40ec7e00e3fd5a4d170b79994da6404e9b
2021-08-30 15:13:21
1
60
d3d263537e41dfe3336485b052252e2803846068867bd39851079e2134bb3f35
2021-08-30 15:12:04
0
59
95ebe0e603dc9ac602b19a1f0633bc6df7026b8acc247e6189fe8b72404dafab
2021-08-30 15:10:44
0
56
de940e1c8e6cde5c4b88b2c93a6f622cbbef0f2d7a439072a826a1c3c1841cb1
2021-08-25 05:26:43
0
57
fab0c8214bb21cdc8fb8cf5fade8753f17313b7138c7c7c8e3e5819a72ddf13b
2021-08-24 21:12:25
5
56
68aff69fde4c0b00c6def94df313a66c2aa6447798e86dd1b57c77fd4177cf7e
2021-08-24 20:27:48
2
57
830d7ab7ff8fcc2eec486b544aab8d9b4bde70e9f220ce58be304bdda054d29f
2021-08-24 20:27:47
2
57
fdf26258bfda4d77881e7c85e71d38af25306c3b498fa4589d5d0afb04fb162c
2021-08-24 20:26:41
0
53
1c111d67d28e4449c40f8d83d42a1c740231725383121e2fe602b9d506de4622
2021-08-24 19:42:56
17
58
fffaed285195211948981d2ce8fe2db3cb758a6f2d3fe37fdb7142a7e6e43bd7
2021-08-24 17:09:40
5
57
0f76484eaa154332c75ec8f6721f688529ccad3b1859e297a8fc3fabc662a5fe
2021-08-24 10:48:32
0
57
90d5f5639b3c0a22281e5459c5138a2ef480694331b0c1b89ef4810bec62f24c
2021-08-23 18:07:47
0
56
ba2f307f93b831c759bae33e12b5253b4c9cf33543fccdcf2107681b124d8a3b
2021-08-23 17:19:50
0
57
d0908f1c276932b2700a9671b01124bcb050c18ff9e4958bb31c9e0277501ebe
2021-08-22 14:08:35
0
57
83f9e6daddad6804f59d7abb46c346c13f9ab05fe1be629a25fda1cc65be79f6
2021-08-17 13:09:47
0
58
4865a0482aef54e9db04bbd0ccc3888315d58d692d9c5589b8a23e5ef0816809
2021-08-16 11:28:42
4
58
a721131b213c3a8fb45eebdc1e2c36f289551efaa0ec2c065ba3be0c8dd3c688
2021-08-16 05:12:19
5
58
9c7c0df7e2a7e7d7939afd71394796d56a45ce22f4b17e4dadbfd788eadb1e30
2021-08-16 03:04:10
4
56
eb76e7d7dcbab02564306b055dc530e3156924b23aad2555cb049d7fa49f387a
2021-08-15 17:25:52
6
57
7ffcd7711cb28c71d866e9a436e1f1e16244b8dfb8bc421c1a424f136061c8eb
2021-08-13 08:03:56
5
57
323a4c4765a910aafd09db7d9945f0fdfc13a603e158b0e87ac87ff516928643
2021-08-13 08:03:56
5
62
293703318fab4ad56124d37e6c93d1aecbce4c656782c40fce5d67f3b4149558
2021-08-13 05:21:09
16
57
e25529ee8b21e7feaeca25db1acef643f10021f9305e97c63cc33e9b0d2a3544
2021-08-04 21:22:18
2
62
86b13a1058dd7f41742dfb192252ac9449724c5c0a675c031602bd9f36dd49b5
2021-08-04 19:46:10
24
58
2238e6b7ab3402ce2f15eca34d66bc251f545efca5674df9269aabcd0e60151e
2021-08-02 15:36:49
1
59
32dc9630a27c8ff68d0d6afab158690fdcf921c662e510a7a48db99ca9f4b5bf
2021-07-31 05:44:46
7
58
24e7ae8c031fb04f9c725e68999ff57ba3129f7772994a0fe4516468d3122d8d
2021-07-30 22:06:36
0
61
1087552642419f8f172ed85e2bf4f1ba0758032aa487288af762eadbb3c27182
2021-07-30 01:32:49
0
58
043f5344c87a7d1c78e71f81d9c4224f97e8523256d1791b63be0c88a7cb189a
2021-07-24 14:24:34
4
57
93384c7ef1f61cc8fea2416d6b5d23037ee98417f33d28b5cd3feddc4550f3aa
2021-07-17 14:20:33
0
58
ca9d0ad8017465f5b0eab424e418617e5d1167ff14b4e5ea3d36b1cd9cc462c5
2021-07-16 23:03:29
0
58
bce5b2f29ea49f965e007764d0e55de6739c0db12d7cd1e2657b4e7c14ae200a
2021-07-08 11:19:43
0
57
f86e8e1929aa4afbb65ab550c786212e757e1c4834dc530a8d5d444dcbeaaeab
2021-07-07 12:59:28
5
62
77a2466a89ed1d83c700d313395c4d10345d6d7f3e1fd294c6eb111b218422a3
2021-06-29 20:25:08
28
57
18ef844ef2d92976c2d7ae501f472096132f6bdc0db11cc9ce870b6efc24d02b
2021-06-23 21:44:15
3
58
48edd2cd9b09de0088c34020aea0bf40e226b22d629303ecee61a19d33ef3347
2021-06-22 15:21:31
6
58
a958cbecf7cd7d93708b363c40edf431dbea055ff964f85605547904ad9f410b
2021-06-21 19:55:27
1
69
c98e71340990df0ea47efc72a806ad7f274e00e131fccfe23cc09bde2c60df06
2021-06-21 14:28:25
6
58
4faa77f2f2d513164378a5032f7dbe1b5d9dce64ac404f336c6ac7ed429d35ed
2021-06-19 10:27:28
3
59
af9e1b242f73e477df4d1ba005002af79c739ab5b7b1cf631c7db3eb95e73c85
2021-06-18 20:34:50
4
58
4f399f1063840c585459d0deed5956fc47704b042bd888523f901522d7812323
2021-06-15 15:15:21
4
58
ef873a4a4a402d991d632f1f94c385dc13a3f2ef14e23736b89173eedab800ff
2021-06-08 02:25:03
3

Rule Matches per Month (last 24 months)