SUSP_RANSOM_ELF_Indicators_Feb23_1

Rule Info

Name
SUSP_RANSOM_ELF_Indicators_Feb23_1
Author
Florian Roth
Description
Detects suspicious characteristics found in ransomware malware for the Linux platform
Score
65
Date
2023-02-04
Modified
2023-12-06
Minimum Yara
3.2.0
Rule Hash
1c7d921e3736cd2de477e2a60b9dc110
Tags
['SUSP', 'FILE', 'LINUX', 'RANSOM', 'CRIME']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
59
Suspicious (< 10 engines)
14
Clean (0 engines)
38

Rule Matches

Timestamp
Positives
Total
Hash
VT
2024-10-22 09:05:20
38
66
a546ef13e8a71a8b5f0803075382eb0311d0d8dbae3f08bac0b2f4250af8add0
2024-10-02 22:46:39
37
65
abba655df92e99a15ddcde1d196ff4393a13dbff293e45f5375a2f61c84a2c7b
2024-09-21 19:48:11
27
66
a0625699c01bad9545d87764f267aea9e9893f3b3f7ce562e28b60e75a66a707
2024-08-31 01:45:21
31
66
43c5a487329f5d6b4a6d02e2f8ef62744b850312c5cb87c0a414f3830767be72
2024-08-31 01:25:30
31
67
8e9a33809b9062c5033928f82e8adacbef6cd7b40e73da9fcf13ec2493b4544c
2024-08-23 08:57:07
16
68
bcae978c17bcddc0bf6419ae978e3471197801c36f73cff2fc88cecbe3d88d1a
2024-08-17 09:52:36
34
68
1bc4c339b1c0773a649234d4b85dd1929c0b5d2d0cd9836c7ad1d7491372f9ec
2024-08-11 19:12:32
14
68
2e7e3d56fb6f11012eda10b23fee6a05fdfcc044658cfcb1260c43507230f52a
2024-08-11 13:27:31
32
68
b0ca003b5a9cad421fa6669b7365ad5bd8f4d78f356ef0e726cab40de1707386
2024-08-11 13:22:50
28
64
f5c79a4808cd4d445a620236b3ed3ebef7ef65993662ab299da2a871211be8fa
2024-08-09 01:26:01
10
68
f0a47eb439647506b9bcbea84a4811da5dc3838df6f585cf3cc362dc41919c67
2024-07-22 16:25:29
14
67
170022042bbf01a7e6553e75e1d4541931e4306f98a6947a82eb45b641f39366
2024-07-21 16:19:48
10
67
76b7d33401d60a564d8761c3b31a061ad3e8c64579cdcfb81cce92b55f491c3c
2024-07-21 16:19:48
9
67
176493de8de0284f0dc05ee75fb849ba27ee4a246666c508eaf003c2ea83a6e7
2024-06-28 14:24:45
25
67
3805f299d33ef43d17a5a1040149f0e5e2d5db57ec6f03c5687ac23db1f77a30
2024-06-27 15:38:16
13
64
e9b9f425fa818899070f69d09d3a35d7ccc88de6ac98b2c8b02116f1b314bc78
2024-06-13 16:55:17
15
67
6005dcbe15d60293c556f05e98ed9a46d398a82e5ca4d00c91ebec68a209ea84
2024-05-24 18:16:05
18
67
3999a25f8f0fd8252aa9250fa9bd70aae202f181812cc6c230c8ea2842340f18
2024-05-16 12:11:15
1
67
8eb32de1ec33ffaf2add6719d3bbc2576bc468086252c12efd8b5dcc5e44699f
2024-05-06 23:11:30
6
67
c6c317eee08c27224f27658a478f1dd41b0c0bd8d1fcb107c5c00954e71c4198
2024-05-06 23:11:27
7
67
dcf188fae307f274413df8a91e56e80a6b3bce5371b8d5958ea2005e3623b32f
2024-05-05 21:09:55
39
65
72a9357fae2047723668c118690104e1063dd52604662ad96cd20b16e694432c
2024-04-22 10:00:32
17
65
1f25abd7130064959ecf03f213c52221920954e4bf684355d35dc776c1bd33e4
2024-04-21 09:03:18
5
65
d831d42d7122081df502e5c6f4eb32b37d9b4f3e20e348fe6dc27ba4795cfbfc
2024-04-21 09:03:12
7
65
c5d41ffccdf3b196f84bf601267b5c0623c2064071c871c2d37e5aa00ccc8102
2024-04-16 06:08:10
17
63
300bc2769c6d62ba9d228cc45e126cd458e1a23fd23092da258053afd82f2755
2024-03-28 14:04:26
6
64
e1321a4b2b104f31aceaf4b19c5559e40ba35b73a754d3ae13d8e90c53146c0f
2024-03-19 17:08:16
33
63
787178babebb95a42925a901facf6301633f6ebd56f796df87b56b2753a1237d
2024-03-19 17:08:07
33
64
198147adc4d58c82c445792d9df73c8e276705376635cb3f1010e9c67eae429e
2024-03-19 17:08:04
30
64
7608ac96b6d6e373534a301991121e151beda72de32253386613f3d965bf5895
2024-03-19 17:08:00
33
64
0196bd1cf4313168ae32452df9f6fd3c042973e93e22e80d9294c2f747cc2fdb
2024-03-19 17:07:29
32
64
abb5286ad1a8a38be3e1a78d5f0e53468eef4bcd4cd2a050d08eae0c47740887
2024-03-19 17:06:37
31
64
4bc187358d9c577d63ac81783f1c02daada5b9541c36226d9eabb09223123893
2024-03-10 13:05:43
33
62
e702a572b514984deacaa54408059c6eac28e46111cb6f0f4190a3a6a72dd41d
2024-03-05 13:03:13
14
62
8d735aaf3bad6fe95d6dc08b9d7626b2a293144f381ed4f143680580927de4a0
2024-02-24 13:33:18
31
63
9c30e20dcdf49891e0174f888e727281ce9ed420cd9655d22ffc7dcd3cce7db4
2024-02-24 04:07:43
31
63
74f497088b49b745e6377b32ed5d9dfaef3c84c7c0bb50fabf30363ad2e0bfb1
2024-02-22 14:10:24
8
63
a9976fc8480a2d9550a44ad0ad84076b0b431c8b8289252020c082a10db44f20
2024-02-19 23:01:16
9
63
13cda19a9bf493f168d0eb6e8b2300828017b0ef437f75548a6c50bfb4a42a09
2024-02-14 12:10:59
5
63
3d2b58ef6df743ce58669d7387ff94740ceb0122c4fc1c4ffd81af00e72e60a4
2023-12-22 12:12:38
37
62
a291e0921ab796dfe14cf84baf6198b46613862e9d17d17190ea517c4d2ed271
2023-12-21 16:01:03
36
62
60fa34a397bdf86f576462922629589263d2720e0b319f7cd7eb36576ff15e18
2023-12-21 15:15:15
34
63
0549ff653d507c1b81512015fc92dee8d75c27f1c98df35356b9a6f02cac0594
2023-12-21 15:12:28
37
63
f5a6a25ce5698c2a934a43ed2c54bc16175c02e736e3b9dd7f27cf1d82e12ff4
2023-12-21 15:10:46
38
65
f1fd9443a2174dd31cf5558561ba3a9214ff521297681e119d5182d59cf310db
2023-12-21 12:10:37
36
62
7adf1d7c63813f240d23b409095906b482d7707a50e4b4ee5ce5941924093cb5
2023-12-21 11:21:03
37
62
22ffc16da1ef07747d9001a45cba540eb8e33b312835c0cd96e140f8bc5aa3a2
2023-12-21 07:28:06
33
62
8b9adae58a76b346ea860ff043baeb31c193a067ff0a5924596eccc5a7e365b9
2023-12-21 07:28:03
32
62
a5b799c971f17d4a33a3ecaa3252edd13f0f95c86c91fe3ac838c0f77f943327
2023-12-21 07:20:00
30
63
1e0a6da8ffe7d85f9672018a994b50388b7716a7a0905019b698988681cbfd71
2023-12-21 07:10:35
32
62
a8b3bca1108c25ebe1ecee3f93c63873290133517f9c7afa205945e38f691687
2023-12-21 06:02:48
32
60
a634a6d66a5ec23ff7de699c232b1a3fb8bd757514b57d5726de3dadbde95328
2023-12-21 06:01:00
27
62
456aa8997f044b5fcc8675149568b5fa35fef360d86f023e04f80600ce0d5d91
2023-12-15 13:05:20
23
63
bf9fc34ef4734520a1f65c1ec0a91b563bf002ac63982cbd2df10791493e9147
2023-12-15 13:04:57
21
62
55ee6bb3deb3385052d7f57e6a48c3c5bba0f558f0d17653908550ffe37e1bea
2023-12-07 21:14:16
0
63
6f8f404354f6e1c3fa701b579c6bcec76c0b4b3979e16b0ec816cd5f898ce8a2
2023-11-28 16:16:52
13
63
5f72bdb14e138f10c1658248fdaf10db2fd1e812240966e009bbcf8d463e099c
2023-11-17 20:20:10
12
63
6a5e547756ef1256f1eb9df0249245c35461affd009be8f046559bc007cafcf2
2023-11-13 14:35:08
9
63
7ca3e6b4dd4d98506faa92ab590108cacb2945b8c27dcf1ac75b0df4a206493a
2023-11-11 15:50:05
0
62
c72b82d0a17b2d9679c7361c752ebe135673125b4615e741bcfff6fd63b51cc8
2023-11-11 15:50:02
0
62
f23ecf0e360b0a64b9696c7102584a9af9393c2df6ee057c935d1aecd0a17712
2023-11-11 15:50:01
0
63
27f87f001fdb11cd344664bfca965bc85f1ce7b05d4311564da211a863e62a6c
2023-11-08 09:43:22
5
63
cd27a31e618fe93df37603e5ece3352a91f27671ee73bdc8ce9ad793cad72a0f
2023-11-01 10:24:49
38
62
1d0bad819001561c5cf1ddc47139b142c9babe9f850e3378e0f98819d5661f9e
2023-10-26 09:01:12
0
63
555964b2fed3cced4c75a383dd4b3cf02776dae224f4848dcc03510b1de4dbf4
2023-10-26 08:57:48
0
62
0629cd5e187174cb69f3489675f8c84cc0236f11f200be384ed6c1a9aa1ce7a1
2023-10-09 13:27:09
9
63
67f82a54ea49c6f286681d179cc7afc8b41b6b34284cc17bdd52916cc3656160
2023-10-06 09:13:21
13
63
3dc7d4023c7380ed740ac5ac7d82a4ba6f587f430b2b7b66f1d34a44f89c39cb
2023-10-05 10:12:23
0
63
7dd4973b953b6d2f1f087d86c950c782c8aa193a12b7a94776c3f546b0806fef
2023-10-05 09:32:31
0
63
4d28fe3a289f6941bd57524c312f118faca3ea8d4d26d4609c0d859918818a34
2023-10-05 01:38:41
0
63
7b050ba73769dbf9112c5ee24b5aea7492b05a940684d4b243ecdd549bdefc1e
2023-10-05 01:01:36
0
63
37c63e1e29651669a54a3d705a3ba848f084a92d99dccfba4c99ce89e99aa8c6
2023-10-04 19:41:03
0
63
67dae67cd9b78585e90d1a69ccef5692f2521fc6ccb12e3f944a29e4ccf50bdb
2023-10-04 16:39:34
0
63
99409e1eb360b92748c727e79776d5e22993e4e261a98a04461bbd022d19575e
2023-10-04 14:12:19
37
63
a31b2b949d9b5854d7cc68de7e877e8624dd3c5c27a3c191ee2506ec0a59774c
2023-10-04 14:06:09
37
62
e4485ae570f2e12271161320a1102a1878e7549614ac37a6541297dd27645014
2023-10-03 22:58:39
0
62
f157f278c7446749f8036d18e465147bb223f4d1609293d8a29757eef7822996
2023-10-03 22:15:52
0
63
0b7682461dcd95490cb78835cbbe9bec30ba78564bd79f5339b41e09199664ac
2023-10-03 20:11:24
0
62
ca8537e5289f98e4b6f9258cb1d7f23393b060414a4d22db12a365fbe08b5ca2
2023-10-03 20:08:04
0
62
8d4d53abd722e6572c44bc6552f9c653e2e25beeb0d31dc9621b786161614799
2023-10-03 15:49:36
0
63
621eb6ff196c9cd3262c3a13f8c9f2821f65083db53957bc993ae51bd3616865
2023-10-03 14:23:01
0
63
da7130972ea4222ed6196198dcff12e74caa138b9e4c2b9224d960793b37a18b
2023-10-03 11:45:21
0
63
ee9fc4c5a891a29207c50d1cc4502d3cac3ee798c94e47a4a3acbcf3923688b1
2023-10-03 11:41:30
0
63
c5f5edbe1a56067bae4a2d2a84ecb5763c8f3d19cc828db4ef7f6e4504fd9d68
2023-10-03 11:41:20
0
63
c96f0a6eb7e4925c1186b69d5bec4390917098fde38adabfafafb2b87646571f
2023-10-03 11:34:38
0
63
79020e7a3920768396dbee6b7955fa677a0b3d4f86c5cd023b02314087a489eb
2023-10-03 10:06:40
0
63
69b2f482a877831438730961ab4ff483e26407ce0d997bd899421453ed7e43ae
2023-10-03 08:45:52
0
62
c99ca472fc39377241f1de92f667156d07dcced8767824ffbe21411e6e137815
2023-09-24 09:09:31
0
61
8d021d202a2baac34e9f89c7a6636e22eec68626e186762ec2008cf78583c2fd
2023-09-24 06:30:17
4
62
f7e3932fc8e8d0ec5ddfe5d362596cea22d533775db42e6b716bc0f70ad4525c
2023-09-18 08:56:24
10
62
82e25f32e01f1898ccce2b6d5292245759733c22a104443a8a9c7db1ebf05c57
2023-09-15 10:14:15
35
62
d7112a1e1c68c366c05bbede9dbe782bb434231f84e5a72a724cc8345d8d9d13
2023-09-13 15:06:56
0
59
60ca9f9e4f25480dd21cdc8ff4c06d5149b11cc7ccb3b5e6319ab697289212de
2023-08-03 07:45:21
37
62
e9a7b43acdddc3d2101995a2e2072381449054a7d8d381e6dc6ed64153c9c96a
2023-07-21 20:50:04
0
59
e44a126789cb5a6a4fef02391bb44564261f1cb2a470cfb62b934b2992d35940
2023-06-27 01:32:25
0
61
5dce2ce277ee1cdd6dd9683efaa502e3905baf41ed1d39aefb7f18dba3b442a4
2023-06-26 17:03:21
0
62
c2e89ce8cd30c3126a785eac6cea2659b44ae65c5f51e74a642b29e2bad96b2e
2023-06-23 01:06:25
0
61
1d3b5c650533d13c81e325972a912e3ff8776e36e18bca966dae50735f8ab296
2023-06-15 19:08:48
38
64
10ab76cd6d6b50d26fde5fe54e8d80fceeb744de8dbafddff470939fac6a98c4
2023-06-15 14:50:14
0
61
8dcd0886c59329ecd53f5b64b08964e21abfe61f492e29faefc7a0bbc135916a
2023-06-15 14:50:14
0
61
21f4e003b33e8b5ce15fec07b911b3ca04c481753fb24d24fcec1a20ee75f48e
2023-06-02 11:10:46
0
61
a0747d99460564e6264dc91d722c0e4165ae0e837f80ca793c6a49a0d7671fc2
2023-05-30 12:13:33
0
55
f876b9a14d9770212b2dea07d2f2f093be8825de4e13bacb68f49ab29bfd8ca6
2023-05-23 15:07:56
0
58
4915de5ca86f4a25a04963399ca2bed35cc3ebfaa781ef830e7fb557cbedfdbf
2023-04-10 08:08:55
38
62
7c935dcd672c4854495f41008120288e8e1c144089f1f06a23bd0a0f52a544b1
2023-04-04 12:16:39
0
60
824d3695fda45a74bc850e574f0ce3a4b59609342afd7d96f1c469b6ed4d2dfd
2023-03-23 18:13:06
37
62
0cd7b6ea8857ce827180342a1c955e79c3336a6cf2000244e5cfd4279c5fc1b6
2023-03-23 02:56:28
28
58
cdca6936b880ab4559d3d96101e38f0cf58b87d07b0c7bf708d078c2bf209460
2023-03-13 13:17:45
0
61
0127d42a9f3091f6a7f05825aefa33575f099447af7b727372e325a60a4ead22
2023-02-10 01:22:05
0
62
d88ea3e5c1e2660eaa161629b6886fe821db00af77edf65130e1dd0ac7ec7c7e
2023-02-08 05:10:35
29
63
f0f0279eb38391e25a6cac9c903da0bd23d418ed8100194295ea69130acc5e3f

Rule Matches per Month (last 24 months)