SUSP_Shellcode_Keyword_Mar20

Rule Info

Rule Hash
489d3a1b77a82a3ea16454f50a93e037
Score
70
Tags
['SUSP', 'T1136']
Reference
Internal Research
Name
SUSP_Shellcode_Keyword_Mar20
Date
2020-03-04
Required Modules
[]
Author
Florian Roth
Description
Detects suspicious used of shellcode keyword
Minimum Yara
1.7
Av Ratio
9.58

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
36
Suspicious (< 10 engines)
58
Clean (0 engines)
48

Rule Matches

Hash
Total
Timestamp
Positives
VT
072429e32358c00515b01380fd7cc14dc4b5e48e463835f512e7fbdb7d8a7cdd
58
2020-08-03 10:10:16
0
56319c056a2f2abed99febac991b4fb371daab1f615303c778861870fe001133
58
2020-08-03 10:08:46
3
ee70530db763ba83fd152f8b7174f196a19eb8a08ce31826d4399f22f18726ef
57
2020-08-03 10:02:51
17
8a13589a4c1238c5da8aa7fda8a01dd990845ac1b65ae1e47684a378ab67d4c1
58
2020-08-01 16:50:38
1
8bc9dd2164cbaf49486a1d3f8fd7bbdd2c38fb086b9fc4485a32dc187cca69f5
58
2020-08-01 10:14:54
6
3c74d51ebefa216869c72118ea08706269652ea03720e116100e713557381069
60
2020-08-01 06:23:41
1
ce59ec207066e9372361d503d41e2788ec71d52646b4810e0bb29ecc9e81578d
59
2020-07-31 11:30:45
6
be1ca06ecb47cf5ac00612d89fe935374a81e0d767d1aa6f22b6668de84c674d
58
2020-07-31 10:53:50
6
b4b0240567746af685d8393b3b69d48a3ab72d171ddc56977c55e0c8e4d65f56
58
2020-07-31 10:50:01
3
bec9a271909a8ba008006485fb39750a061369f4090ce8614f5bc5c9570c7354
58
2020-07-31 10:42:39
4
cebb9ca937b7b7352400da98671113bcd15c6243e3bb7211b555c2d8c6aace5a
56
2020-07-31 08:44:22
3
b589dc71905f94880155bbdac7f9905e96f612b8e8681e57266f4d78e75dd001
58
2020-07-31 08:42:10
4
9f255c2595004c560416f3be2be23b0adbad64a8c2430db82ce6ab2c37d11dfe
59
2020-07-24 06:07:47
4
40af41b442af695f309a4c4a207b69c5de34c3178b7048dee9532b859b8fd3be
59
2020-07-20 14:15:45
0
0a5a4753e845ba0af0d423847cbca765d6c2af22d6e72a2a394f5852caad3a92
58
2020-07-19 16:12:40
0
732be165bff7b8488dfc1b042943ad4269b90f2ed99d5fef4f790e010eb1ee47
59
2020-07-19 14:26:45
0
9bfbb512ccb9fb6f182271f4cd7214716703cd1949333a2eeecf18a2c75ad781
59
2020-07-16 21:54:11
22
79284ed0fa544381a9a0af74e19cbbee449c1eff3322d756f0a268274ffb8a0c
59
2020-07-15 16:21:14
0
74419e278a75feca94b5b457a3a0b8bbe42c7b93174f401aa5e798160a53af60
57
2020-07-13 14:16:07
0
1a21564e87fd8fe056abdae806ca58cb4211d5394f06a8e0c9a0661d537f6365
59
2020-07-13 14:14:13
0
761f8eff1a81c45e005280c956f44cf7527374dea5fa08ad074b808663cf28a5
59
2020-07-13 10:44:42
1
b7cd1a4892ef5be032ae4079d849c4beb34949a0972744e1fbbd9cc9ffeecb6e
59
2020-07-09 16:36:33
0
016f9888605066c4020216c6d7e838cee12325998e86b8cd5361d92718a10ddd
59
2020-07-08 11:22:10
13
1dcd4943336e690ddf20087b1fd723d6d38b8f0bbd86d1cad41d1ed893479bb3
60
2020-07-06 19:56:25
0
760f1e194b181b4bed8106a4fa88761a88c4b4788f6f3f3f5260545e7eb68ca3
59
2020-07-05 15:34:50
0
105e0be2bb96ecf455ccf5c48ba0436b32021014d8948aca75ba044a26e69b85
58
2020-07-02 11:56:51
1
e36a6256eec3c88e78c767b825215850875a4b6c337dc4bb4148410a585c2d29
59
2020-06-29 07:38:29
2
5ab19f6ff247d2b4623b72ba20f64a1a92676d3ff662e3ff688dc5dc1fae8ee2
57
2020-06-29 01:18:47
0
4325cd57ff7cf810dba28514866e34425dd8eb405cf12bb7d5e6b3a3799860e1
59
2020-06-29 00:59:40
2
e19a7b8fc6dbb57211c2be4e39ef437920369db5291ebfeb2d27bbe82584f348
59
2020-06-28 09:51:11
2
78b98ee33a3efe850b484cb1a964ec88f4d914156b9f945580961f42231a7df1
59
2020-06-28 07:49:22
2
4bf8ed5b11b4d87e96cefffd426b0bd25d3110893c4a59adc2e6be6dfafd6122
59
2020-06-27 23:53:46
2
23778c31027c62476f0708f06d4bd3297e0c1fbca7ea7837869dc36efd3e8cc8
56
2020-06-27 17:47:07
0
a8cc9f7a2d9f63e17b48d1f54f0d3bd0600955815ec3d394ddb3997a886e0296
59
2020-06-26 03:23:25
0
2ffe670b72475eef90546dcfa5d8bfccebf5dc556ee872189bfef20be45d3e9d
59
2020-06-26 02:48:36
0
3314eaa3cac60acb0f081e0437f7f4616a212546d3952e45f0e387679e2f036e
59
2020-06-25 22:12:49
0
92c9b45966957625a74e389b64cc4b994baf262ed4b30323cca5591cebc2df13
59
2020-06-25 20:42:12
0
8965c54e87e7bf100dc9ac8730e709fcd79084b1af7545d1c7895bbdd760c3c1
60
2020-06-22 03:07:49
0
0a3ff8b1190234ebba0fb5348a2531da2eee71ac4f6917b513eea0dd205a54d7
61
2020-06-21 09:20:35
14
9f286ccb21883db4bcb208bcb3b778306a0224f95c58dbc22ea53aab382d355f
60
2020-06-20 20:30:48
4
1bbd3ebbfd7d1a6428d255e3b7e39c7fdcafe26c2f34772945783f63371d2f01
60
2020-06-18 22:21:13
11
452b0cc615d1b129d7e4c52dbfd725df07d0f35d37fd183bb064fafeeb300d26
60
2020-06-12 11:14:23
1
b726cb2ff0aee8342ff319943fa684f02a25ec87286463fe3aa029f150c80e91
58
2020-06-09 13:32:29
4
1faaa3c313f3abe9f160b31953c973096af0ad1845c23fd6cd4fb4eda78fcdf9
58
2020-06-09 13:30:39
4
c1d7b34a60aa81f8b8201c291dd3aa79cd912f31576b62c29ddf0425b1df159c
54
2020-06-09 08:54:44
11
3d8b90913a3bf56b9c925a5be51edbdff97d6c4abfbe7f77b41a41d4743d74f5
61
2020-06-09 06:22:53
16
5deed646fba4df2dd33bb56a267cff253987cc9c2e7644630af82a65bca8c7e0
61
2020-06-09 05:49:18
17
ae071e99bb69d39f80b364ce75851ddcd67ebb02cdf23141700e45f9111360f5
60
2020-06-09 04:11:15
20
51ca828a058a9f795d82edc07b2dfaaa19fd4b2be1b2a26f21e213026d65b791
57
2020-06-08 20:20:59
0
456e16d261abb17792b368609f67620c50e09f022f3540cf32f8e0c761cd3f2b
60
2020-06-08 15:21:12
18
7387ac7e127ee1658cde0e7e2621ab5c83a8b6dc94702f553b06c6c4174aef1b
60
2020-06-08 14:46:50
15
9ec33c91e14dc226649ff37386bfaf185cdb6b48aecaf2f9ef4c54cee2b98f1d
59
2020-06-08 12:27:42
17
f33a77f33807e2fcb206fe081504a1cb8852121efcd53080431d425dc760df57
59
2020-06-08 12:09:49
17
c324bd65f3355ee8d7147a29b72b53e52d6fa4caabeaa3a382db39294999aa10
59
2020-06-08 11:48:20
19
a564f29fc010bc2e010759ada5e2097dbbdedf1e80f14e0b937e5795f4841cda
61
2020-06-08 10:12:39
19
f8cea438293ec270c66339f68d0b47b6c1a1f75a40f6ecb1419aefc70444cd76
61
2020-06-08 08:44:26
20
e3b3b14d58b1efe67a655b1c866ba4a20444992e3278a558c86e40535307d45c
59
2020-06-06 13:13:44
1
e09b4890da27652d4f4e4d785de1559e51b49c99dcec27d2998511729c8212f3
60
2020-06-06 10:52:17
16
5f5da61514c36d93e8b684796b0aec07fa3120c8dd5560ab74768320bcf6b366
60
2020-06-06 06:06:54
17
4d0875d817db7f2c78df9d5b442c137c6b6dacdff0d02dbf62570b871c4624bd
60
2020-06-02 07:57:11
3
febf0179f4d5cbdeb74d444f84f97d76ef481705a37eb77f2f402d735ac4ed42
59
2020-05-31 11:10:45
13
03373376de5fce5ccdf21fb88d9122a641a8420edbde55ca12fc4f5954eeb53a
59
2020-05-30 23:40:23
0
fa9bb5c8cb5d81dc42fa4ff2b56c7caa20f0e9dd0bbbe8d0f205654ece437e8f
59
2020-05-30 23:07:08
0
8cea87bac32cb37c0efe6c2efb4a299029a668a712ea31570ea23ea8e38051dd
58
2020-05-29 11:09:58
0
95905c8b2813e3e5b7f6b9537630371e1a897ea29b190bed75d4b57e23d338eb
60
2020-05-28 14:58:58
0
454dfd3c89de9cc40beccf2ca42ca607cc0d7a33f8cffecdb1c8da2b42c665c4
59
2020-05-28 07:54:20
14
f73808fae69b2a7cdbf885ecfbcfee0f64cfba52bbde9be644e09a6f2e058a0d
60
2020-05-27 13:53:03
15
5feb30d0ee5907a6361405bcea7cf2e0d43594bac2d8514f505959fa933566a5
60
2020-05-26 20:50:13
18
2cc9e1e7d0b2cd1027a9c508920be9702a76127f54b66d58cfe791a93226eaef
60
2020-05-25 09:19:11
15
36c17c274043a243f53187b79cfb16bbef3f09d7e5228605e3302259c315aa33
59
2020-05-24 12:39:17
16
8d42f4451a5f12880e6e1ba99080e270a342778f8edf69bb801d4b473cb8688e
60
2020-05-24 07:03:31
3
793f7fce5ab32b93e1c91a9afa69c9b4537e213674aae013e5d85699a5639f6e
60
2020-05-24 04:59:16
17
c1ee144736d051e4db7bc35e8e9291de697092a303b6d7b7a174c835cade1788
59
2020-05-20 11:34:59
9
f8037b9ad15fdba5baa5893cace22297bfb7a7010e5e7b1ac8e4fd37759acfc2
59
2020-05-19 18:19:48
9
c0e7aa447b1ce0cbd0d0a4606b6aeca475e5c11424d424719f446bea7d5a0740
60
2020-05-18 06:23:06
15
b388bc422110cc23f0e630e307ca7a8eabb9742299aeaa1426c69ea4b5e582fa
56
2020-05-14 21:38:57
23
e67040e3695d0563a3fca5c71766a5803cb49b942df0e418de91356d4a593c0d
58
2020-05-14 13:32:07
13
91ccd504c8736655499a381e9650a3451bc3fdc51bfe9f7fd9f7b3c48f1015ba
59
2020-05-14 05:42:38
17
b7f28fa1f35013816a5c1ed5ff23120c900aadccb88774c7373ec33941747e42
59
2020-05-13 14:14:19
6
f4e50c05f94b6a73d07d4210cc11146608ee4334604a97f89e9cf16758162fe2
60
2020-05-13 13:13:33
4
bae28b5f2a5b428aef2818b7a51d42703d1422443de8f98f78bedbb6eeb20384
59
2020-05-13 13:11:58
3
34022a65a3eb93b109ed4c6e1233c6404197818a70f51ab654e2c7e474ee2539
58
2020-05-13 09:35:09
29
d0abeaada6a601a2ad1056290cceea0c0c9dbe945dfff5110e6db68435878f52
59
2020-05-13 07:47:50
4
9665dc77602f3e2c8fa33e58f04cfaf9c51aec40cc40045233dac109d92dbd8f
58
2020-05-08 04:42:24
14
d5d64ff275621d6c22f26c173ae343546ac0c45b81b1c2f106f34581002a72d3
58
2020-05-07 23:07:22
9
64b186140489f2200da21170a30aedb5f93f43fdbc0877296151987c4911662d
59
2020-05-07 21:32:16
0
e30d19d8c20375b069d61dda29d67fca789429bd59500eca42b0eb91175a2e6e
59
2020-05-07 21:10:48
0
a15c98bacab8dc51375cbe17e8eb45beab38ab71241d946d775fbef4a6608ec5
59
2020-05-07 05:39:38
0
7eab590dc0daad2a534e8569de40a68d58ff601cf904fa9e7faa1493327ee68a
58
2020-05-05 06:16:17
0
43fbf5d03f8d00f9cf4ca46e9947f52a2e8a74fb4f0fd6730cfeab381f38eff0
59
2020-05-05 05:57:32
0
5051b73c0a1ca18c7c3e85dae260c07f78a1919187fdf567caab15a376c9cc5e
59
2020-05-05 02:52:33
19
763b7f145e487df93a7d09af3194711a592d09ecba5c8d5055af50ab1363a0d2
58
2020-05-02 21:41:17
3
e174e98a8c9c3b6380422cfd577f4a05b9387e842a1717a4bf0e55d4ec04848f
59
2020-05-01 19:56:18
12
a545a712256100507284fc9bc253706348ad0ae95972f0940dad02cc16a5b73a
57
2020-05-01 19:49:51
8
51b12824c7f7cceadedd37d6641248abd0bc7011d56e530b9a49bfa884b236c5
58
2020-04-25 18:25:18
5
e43e1c9e21cccbcc27f31cb0d94eb807e0903709acf98204c38b297583336b21
57
2020-04-24 17:33:21
25
711d0a7abb0913ec20abf2111192e8055da3ceb65a1733f386c44d23369b68b2
58
2020-04-20 15:46:52
0
36fdbff0a4aca56a43efab55512d88f1054d754b08ec24ff835a890395a90720
59
2020-04-17 04:57:01
5
ae65a97fb76c6de7523fa8afa094f3128be74478648499b802f3dd28254968b4
58
2020-04-16 16:13:55
2
54e304db33dc808e74fa779eaedadb96c325cef7c16bab9ef85f7bf425215ae0
58
2020-04-16 16:12:26
3
89b3a7769f5021f42e4b399e9fc12cd6b5df308af47d51480b0dd9a2239b7cb4
58
2020-04-16 06:44:24
2
57a80446171885cfd62450b66a409ea27e20802220fb5ea0dc224d407f5a065b
58
2020-04-15 06:24:50
3
a2051f718a949ad946184cf9785f94ef125f05902fc2ae5d826e4137919ac470
58
2020-04-09 00:29:44
0
0f7c12474d01c540d88ae48431a7156c7068182b3b6e1f7f3c03e51e752f3686
59
2020-04-04 13:55:46
0
93d925a4a242b2b70b225c41dbc8ff41734b5da696bf9a59ad7a6f7dc1225217
57
2020-04-04 07:24:08
1
14c1670d8eef061cd3692407048385d1d20ce4dd3db0da7d648275ebae5e27c7
59
2020-04-02 01:55:05
0
329de53afb56ef9c172736d154cd16474bd0ca1e535c8a5c19fe769908871b98
59
2020-03-31 10:55:36
4
629e45dab3498cfeb5fd13319e5d094a2e1ad283cea1e71af05b0ad9f2bd003c
57
2020-03-30 15:03:11
3
9971570ed68e22a51c88e8222947c65e942d5ea229c26845c67a178ad048131f
59
2020-03-30 14:56:37
4
58d3c53083d113bfd32a77068e17fc324f9029604428fc116f5d76996b2569fc
60
2020-03-30 10:32:36
0
f5bc827e5bccd3923bacecafaca0615f29dfda02e00d05940a3e22cbdebdfcbe
60
2020-03-29 13:03:39
2
85679c03a8a4d4ebe7e53a8d76675c3adc978728fd472819232ca8ad750681ab
57
2020-03-29 05:41:10
3
8aa9d960eaa9470ace6ee2f0b1fe76c4ac182fc0638dbaa9eb0c04ccadd69886
59
2020-03-28 16:02:05
0
2f91da948a82fa1a59c0566194a0ea9bbd62772b8acf5de6aeec01a295177fff
60
2020-03-28 15:01:36
3
6a3477080e5c88373f91766b9b14068c638f1889e6feb61ab88c429fc443bd1e
60
2020-03-28 08:10:05
0
e4076bf4ac273cb0d414bb20229b0ce8d69d64dae006d68601f28d95f5d6f0c8
59
2020-03-28 00:52:34
0
b5676c391bb0fabe587de029f392905635a8d5ddad7e1ad5b76dcbeda1cebf57
60
2020-03-27 17:42:07
4
b1596eb4deac663c22862ff81f915342e3f104277f6e516a3d6c645bf9b7ac6d
60
2020-03-27 00:19:39
0
9e70afcc22595d9f401d3ca78df23c06d6f0068c04770dbbab0db0b619fcf973
60
2020-03-26 20:50:06
0
61ad534a1260166e13addf99ac323859e76403471ad5a11be27ebc08ed3aab28
60
2020-03-26 17:49:38
1
7a9c6703969db6d2d156934632e2734b4944b30cb1d1fad433a02121388967e8
60
2020-03-25 22:28:18
0
8c8443df126e6aa7f2a7e77ee669b4dd86754a54f5d8e8baefeada0706b494f5
60
2020-03-25 20:05:14
0
56f5369854f4953e2069b089e3296df8a65e3df08358b08819f3a19466fa5c18
60
2020-03-25 15:29:05
0
2ba9136c9421f7f24adce28744d8a6de82aa5bf6a0ca09b2d7cf0ff63ef26344
60
2020-03-24 22:08:06
0
03ad9550f96e0265894b1248c1372af49e3b37b16996225b110c44f672f1296e
59
2020-03-23 17:30:08
4
05cf3f00569f190c714ae31c0a2703c49bb5008bc418aac97c8c559583c8c919
58
2020-03-23 16:51:37
4
c19d56f81f3567ceba3b1bc27c28ba6302b16c0eeb6b3a5bf472c6d4f21002f1
59
2020-03-21 10:34:09
1
8b754f6ae7c891c06cec0f2a8a5f14311bee1b167bc0ba74640f14ac4b691557
58
2020-03-16 05:41:35
2
3bd5e83f98f826821358ea87a7bf9d2b17829ad95246efdaf7abbfdbd48d5a65
58
2020-03-15 18:53:07
0
75ff75c75d92a4b7b57b4dbb4ceef638f486f9413efdb4b1a0dbc44257a749dc
58
2020-03-14 14:49:39
5
09d01bcba2bbaed5ec49b7f2fb3af7494a60a8bf0fa48ed4ced7b7ebb0ebcea1
59
2020-03-14 11:38:40
13
49a6d46292fb5b36864ad5422774b32730aacfdf611a3f1c7e864747ae0d8c6f
57
2020-03-13 15:54:38
0
0b7b5c1af6a753f6aad92b08c8639a6150587f66ee0d10c8d44f7b237cebb70d
59
2020-03-12 10:00:41
1
498488bc9dbb863095e39dd2fa37bbd66a8ba11d23779165650ecf1e9e8587c5
59
2020-03-12 02:14:40
2
782167a85598920f0ff66dd3c52a0c0c62471b1a43fa22e1f317aa6b547dd9b4
59
2020-03-09 04:09:38
0
f35e951a9c90d568772dc388b57111f16c07e93601590e82368bd989affb1064
56
2020-03-08 15:30:09
0
8165048f8e7959072ce5d18fe77ef78d23a884e0768e5cca4ff334b80487fb7c
59
2020-03-07 23:59:05
2
59ca72e7a7d53cb12e1dff68d32e64d595f76e3c040e956c45798576eafbda5d
60
2020-03-07 22:42:05
0
cf8f795c2e43b631086e63c64d83998fc475be00f9fa2d9038a138bd033191b7
59
2020-03-06 18:39:35
0
9f91caad756f3fb74abf78b4f6bef482889021e10c911512478872d9de6c18ff
54
2020-03-06 11:19:15
13
bc89b1aca17fe015945ead0c24a0c204a8ff2cf5a630a6067c1e400658dd0554
59
2020-03-05 20:43:38
0
ba9374681c1af4cb4cc4c6d94a14556e361ba1feb5bee994dc68b62249c5d2ff
59
2020-03-05 07:35:19
7

Rule Matches per Month (last 24 months)