SUSP_LNX_SH_Cron_Wget_Apr21_1

Rule Info

Score
60
Reference
Internal Research
Name
SUSP_LNX_SH_Cron_Wget_Apr21_1
Description
Detects suspicious crontab entry invoking wget (often seen in malware and rarely used by admins - they usually do this (or at least should do it) in a proper script)
Av Ratio
16.53
Author
Florian Roth
Tags
['LINUX', 'SUSP', 'T1105']
Rule Hash
b26ef7640b0275ab0e87b312e37f7b23
Minimum Yara
1.7
Date
2021-04-19
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
35
Suspicious (< 10 engines)
31
Clean (0 engines)
20

Rule Matches

Positives
Hash
Total
Timestamp
VT
0
1b99bf39147d3f0046b59e27d669474caae56486ba8085e69c6d6d4672d92721
57
2022-01-18 00:37:32
1
b920576bad5e7f185b99a9952d7d1b8d0a8d8e0abee646c6707507cb8df633f5
55
2022-01-16 09:12:35
5
209d030469874516d2e9d00813b950b1574c7f4291ca4ee6809a9c432fde98e4
57
2022-01-13 10:00:35
2
37ac51acc32af5e17da021cf9d10e3d93a755d490a49a84ea867fa7b5d479477
57
2022-01-07 08:12:36
4
d1784b0ca9ae22fa28a58adafc387b3bef89a1fcbc8d0d32e1c6c168e43ed934
51
2022-01-06 06:06:32
2
257df9eb1a21b7d33ba27109688af133bd6738febefed5b3516db013a532d5f8
56
2022-01-02 20:12:33
7
d7e7f53b1e7c7875a8498a3c084d2f0fe9585538ed639bd40b332b22885cab63
57
2021-12-31 20:08:00
2
93971f8a91730baa99851db4a9b5f85b46bbac51cc2aa857f61d64ba96e10e9e
57
2021-12-30 05:47:20
1
85b2a5b9eced296c02149de03700a6f19dd8fa6c81e0e2dd73bb2e583eb63a42
52
2021-12-23 04:13:50
2
9da6bacf744d1c13156127167e4588580c9b72f3ebfd09ea0b3aa209cac63ff7
56
2021-12-15 06:21:58
2
3831b30a01d429f8a9a07385c100b3f602f7cfcae64ba8b6768b9ab9fe103ae5
57
2021-12-15 06:21:58
2
7cdf398f5398fa584cc66d6b792eba220184aae5a79540bbbab61677d3cf6917
57
2021-12-15 06:21:58
7
2b229093689856cf1e606fcfbcb8716e53dc96fffed2fb5f6e5247d088843f4c
56
2021-12-09 18:37:20
15
5c26f10e53285161d92146f398f5d00ed52d73c2caa8cc1d731887bc9c409ec5
57
2021-12-06 14:08:01
27
360d768957d92d36c4b9d715a606da4178fe17c74950862bd192b74bfbffc899
56
2021-11-24 01:46:26
10
915c8dc08a04b4e8df94dc213f81ab32c7ef1a64b43ea25b458bb965fcdaec0d
54
2021-11-23 16:41:00
18
404199777a6d1b0b1f02bd70299d374e5aec1649ae65a81320852b0698d47096
55
2021-11-23 11:47:56
0
607618a8ed77d1f8937f258007f6d80f9d49c5d5e43e637a302ee332a7ecc05e
54
2021-11-17 17:55:35
0
c1c5c496bf94e1fdb8439081feb447d7060a026bb1512910d3dfd6f99aeef8ca
55
2021-11-17 17:40:51
0
ddd150fec762193ca11b791a2d8a3ebcfc88c81e820512df4dacfdeccb2d9b1c
56
2021-11-17 17:39:44
2
64cd4d10b0e2e9b47d203a5e6ad25ad8453302210d5b1493b7f6a7af76a1c1f8
55
2021-11-16 11:07:46
0
a363ee962bdf9602a7f3abcadfc9a74df013b5215ed7616c18970050b6e76ab2
54
2021-11-12 13:58:43
20
cfdee84680d67d4203ccd1f32faf3f13e6e7185072968d5823c1200444fdd53e
56
2021-11-10 15:17:05
23
4bacbb6a20958b20a0f806b051ae6f6c84ff64fb3da98fb74a143517469bd162
56
2021-11-10 12:10:02
1
3e868941a992f108a36d31a8d07bb17798aa5083c2b828cde3f8dfd81b46c108
57
2021-11-09 18:10:58
28
19c257223cc8dfee933d2ab8a647163683047e25e97f029a08d8fec7edb9a0b6
58
2021-11-09 12:12:18
23
615f70c80567aab97827f1a0690987061e105f004fbc6ed8db8ebee0cca59113
58
2021-11-09 12:10:19
17
1bca0088f84d9642002e8d403efb77f75596a9d9c50f171e587a66cc804fa971
58
2021-11-09 12:10:15
22
6ec8201ef8652f7a9833e216b5ece7ebbf70380ebd367e3385b1c0d4a43972fb
57
2021-11-09 11:31:02
1
188db0cb66f5432279acf9805aec4245ccfc167fd6075ab8fb9ea47c511eb4e8
57
2021-11-06 10:30:45
0
daf246cd985c5aebd6ea6fe81c87308275ca64991ccce594f96d2dd54ea403ec
57
2021-11-04 16:21:57
13
56d677ed192b5010aa780d09c23b8ee8fdff94d39b20a07c7de76705e5f8c51f
57
2021-11-04 14:53:12
0
0d42c49b00ce32fef0fc92a65451f1d55b19417c94bff1b469e88f567bb63265
57
2021-11-01 02:24:57
3
e6fd350986dbf0c852a7d8a11b6aef178c651f2f29c27f79dccdf7f57c47a82d
58
2021-10-27 19:04:17
1
0be9dd7ea8ac7dad67dc7aa0833c46fb288b0da7972739f9656a74fb6125129d
57
2021-10-26 14:36:11
10
ea3826c6991ebed51f2aea8368c22514ef0d3c87e7972229ba3c4d38712e961e
56
2021-10-21 20:36:25
17
6b900ff5ffd3ac1e8bc1fe7f921724f3e7f5dacca1dad98996011f70093b1a84
56
2021-10-18 12:20:02
3
35697d8239c471d1f4d1d9a8fb1e141983a0dff4bee99aaa41b5dcd1b01a580a
58
2021-10-08 15:20:39
0
c77f7e1eb0814297967faffb16b555de9b2c46f6d65a786d7a8db9521c30a120
57
2021-10-07 14:33:00
17
003bb67fe937e25877ee324113b4719b2da634150c3a5b93c6ac625e80312eab
57
2021-09-23 02:14:15
8
2172e719fa1c1b71c20028618b11016bc97b54febe883f62f80af581e914ee60
58
2021-09-10 10:23:27
0
8be3e63a9b04da1bf2b5171cdc0fb4e7edc45577c7b560a71e57dc371cd5432e
58
2021-08-05 10:24:39
14
e0d91447a3ba7302be2a04f0e814cf57336ff37459c558b679e08c485acb8b50
57
2021-08-01 01:47:26
6
64beb4ecbecbd427f04dfeb27193be2285ccafbf9f06afbbb4d4739410c52dd9
57
2021-07-27 08:11:39
18
4f02c53c6337dff074cb885e9fef5f80e08d7149c1136cd823ee963fc723212e
59
2021-07-27 00:39:51
3
d1f363aed2639339f88d20098656b1b89aae008253ef3cd606f03d0fafd1a57e
59
2021-07-24 20:33:57
11
650d253223d023c6f957f1a08885cff62ba252b47295763b8a5ebc59fe0404d4
59
2021-07-24 10:19:59
23
01b4ccc7be55485ff529ca1f92fd5dbefcce93e13720a8b4d5d3385e944fff8a
59
2021-07-20 15:45:13
6
b066ff0ede4e01a1eccebe873b4ca31fa36dad58d169f3cdd5e0ef429a857060
58
2021-07-20 00:44:41
22
d44cf300feb4c99918a14603a6da13b82ee840b5dcf2e54b81c87207806d5acb
59
2021-07-17 01:46:13
27
67f5f339c71c9c887dfece5cb6e2ab698b8c8a575d1ab9dd37ac32232be1aa04
59
2021-07-08 13:17:12
14
384e88fb401837e5bf18346516a5c37f5f293e189e3af6639a28d90d904fbfcb
59
2021-07-04 02:09:08
9
8fcb42ffe39060f2f15a0bd645c7a98fb270f435ff40a2c49f58d960660b5e7c
58
2021-06-29 14:04:35
7
0b6c5fd3a0d9027a9b43ca7a3ef64103a47eb722af120da8b962656d2d8ad104
59
2021-06-28 15:23:38
20
b6cbb40d41f521239457d9eb46c0ae6bd90f72a9670e76ccca2175056acb3231
59
2021-06-08 18:17:54
6
2b6d676730da20f31bfa41413a4118305fc94568eabbdf61f4496a283d17f295
59
2021-05-28 21:40:31
8
7877fcf34a1644c4e238e15e0054da42df51e6f2216adcdd1afe5a9c7497d328
58
2021-05-22 04:31:51
17
d646f450ec5b2e1e04c962350fa430b9651fbcb33a8c39571126e49d6edb5cf1
56
2021-05-21 21:46:32
19
36563d927261c459f53e3272769047624775b556dfd2993ec808fbd2c6ff1fae
59
2021-05-21 06:14:06
0
44a6b7435d27e55aee25464b2ca0e1575177b1728695632cd21edd843e59ebfa
56
2021-05-19 19:24:13
0
92ce32131abd40ad324f214a47cc2d1f88db27ee1ab43830985f8572f85d4879
54
2021-05-19 19:24:13
0
268771c2979c35fbfb0b3a3ba19166bd49debad18ac7d3552b9090135e2c8cb6
57
2021-05-19 19:24:13
0
8914696bbeaae8409c960e8e8158b17ca7daf9ab328c1d6cd16568882b23a109
55
2021-05-15 00:53:51
0
f4e77728b3628c470370421b1021a768e2ded02c674a70b5bc0a1b94a1123b27
58
2021-05-15 00:53:51
0
152dfcb23d7c827730a2e45130afd62bb072f897978c382aa5432ec8d2866634
58
2021-05-15 00:53:51
0
b7f3a88647e9459063e2c585f32bb3ebf590684592d3a183701fd6c5052f5241
58
2021-05-15 00:53:50
0
7d82bba2ed1cb2139b26b8fd586e01d330418b6ec5024549dddd78cf8bdbbe00
58
2021-05-15 00:53:50
0
110a44749db51815184463cdfa5590b1bfd0ec3a5968cfcda4e4475ef1ec26b9
58
2021-05-15 00:53:50
0
d3124a0b68f6f31522b859d01d0c4a452be53b389fa81da0da5e418ca61551e7
58
2021-05-15 00:53:50
0
da9bf1a05e1d132d7ed993590c2a2e63fcbaa8bb104dcd1f07a644d5c3f9d9ac
58
2021-05-15 00:53:50
2
9537ff8af37c7e3ddb3bfe2c7d85b50878b3957e62b0291d4735cef0b8fb714b
59
2021-05-11 11:53:07
3
884058cb6a19172c90b0e408749ce8dd81c9638de53e286c0ceaebcd7bcd6aa7
57
2021-05-08 11:19:51
4
6870fcd23449235071c09891019d82c71b46d2eb50d5aff731bc3b930b6842d5
56
2021-05-08 10:54:31
19
7bbb1506e5b53630c3515bc085b884a6be2a55447a5c6e467b53d424956f87fd
58
2021-05-05 21:16:46
19
a94e0517a81ae4a69f853ea223680b9c7310336633bb0c45b6b9115d09cdd860
59
2021-05-05 17:54:52
29
e604a730154af21ede38f155dbee7ceeb218abd02362c0eba0ad0db9c5dfad33
59
2021-05-04 20:30:09
31
9883cfed524ad4bb2ed53b9887b20e1fb0909f77e55ac34c07c91c9fe9d536c6
57
2021-05-02 22:46:04
23
ea458759b2004412f759346c7f4c6f9a57fe80b0a475f752ade9c09763ab0969
58
2021-05-02 16:40:57
27
dc8f318732a3639d48b0404b0a14f4702936d1bbce4e87d69b69011b5bcce7f1
57
2021-05-02 12:15:52
16
f0ba26ddd7b5a2a917b17f61f0d813390f68ac9b2f6fad0fa217dba7c550fe59
42
2021-05-02 10:09:46
13
50bf83e927a778f0212029e726d7fb7216ce4fa3b1a7b5d705bda0ec5db9ab5c
56
2021-05-02 05:09:23
18
0d6fcf9adee209d710d03ed0a05056663c3114678c79ad8d985286c806a61f3e
57
2021-05-02 01:48:52
29
11d3606cde511e00f4ddb6314cb46c1ed15588ada3e9f908248dadf690e4671f
56
2021-05-01 22:04:02
17
5fa2dc686a4e4b492b5159948d0bb8157819836ca9ebe590faa88df327ff40ed
42
2021-04-28 09:51:52
4
3b0ab312a1537b3050af0a4ed8d7af477fb7e57393bef213d32cb9e759b07abb
59
2021-04-23 05:40:06
4
4a50d3b76d929217364cef13638aee76e437ef2de091887041c7e1e71b074371
59
2021-04-21 18:54:36

Rule Matches per Month (last 24 months)