WEBSHELL_ASPX_MOVEit_Jun23_1

Rule Info

Name
WEBSHELL_ASPX_MOVEit_Jun23_1
Author
Florian Roth
Description
Detects ASPX web shells as being used in MOVEit Transfer exploitation
Score
85
Date
2023-06-01
Minimum Yara
1.7
Rule Hash
18b116dab1a9f97def0fabe6f78de32b
Tags
['WEBSHELL', 'T1505_003', 'DEMO']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
29
Suspicious (< 10 engines)
40
Clean (0 engines)
0

Rule Matches

Timestamp
Positives
Total
Hash
VT
2023-09-18 15:29:57
28
59
dbf3b006ddf01acc4a51ea084ab0813a3746ca46ab0728e1fb8c045f3a616a45
2023-08-10 07:07:14
29
59
559ac79916a6f2661f1239575c01687e014653b9bc924edd20469391bbc75435
2023-07-06 06:35:35
8
58
a0a4a80397a7d78e4996c4ad39f4649e8cd7ad321c0e34ddb129e101e905c18b
2023-07-05 22:34:42
27
59
4f9d69ffb39f07764279ef5893c23d4b70262c724b11cb2a8f968b3fc90697ef
2023-06-20 17:01:52
8
59
bff9988945b5f44b954aa3e83194d0b7a9e456206006b46258316b26f1eddfd4
2023-06-19 16:09:10
25
57
b8c0bca5e65bbf285548c824e6dbe87c3782509d8976129caf6519d95c236e52
2023-06-19 15:10:35
8
58
09dc6b34b5ebd44d73093e1fa3ea4c029ecae61f3297ab7b80d91a12676dfe3c
2023-06-19 14:35:35
8
59
b719485e1bbe20d0c7459caa821048e8a914da11fa2e2f9b1acdcfe1b4259a39
2023-06-18 12:35:37
8
59
96487a14bd922628e977cc61c8d617a880d99db0789d150950dbb3e8dfd1195a
2023-06-18 07:37:07
30
59
11ffbb3a58985348c5dbb2732d70b9c83d6d9b00eb0fca802ba2b1eb66636113
2023-06-16 17:07:19
8
59
8ecbd23e65239dbb0beb2e289d8a0e79de231c082e4a772ad22e12b93abae622
2023-06-16 15:12:15
27
59
3fef210b666292c620997a6bc7ba2ba452ba254047689375e4fb762cc5c1c01b
2023-06-16 15:04:07
8
58
af8c739746d3ccb6fc2fe13a62bbebce574a593e9683901777afefb984e29969
2023-06-13 09:23:10
5
59
f6720b2cfa21ae95724f38113fc5049861e7b179d33f0a7a74e6cc9659a68d99
2023-06-13 09:23:05
5
59
b71100a4bd9f9b5eb6c2bacca8258c8b627b22add0474ff669c3a1e7b7558be8
2023-06-13 09:13:15
5
58
f2718f79315bdd15c30fa994a5bcee042422513d3a8101baaf39c1d37bdb5ed0
2023-06-13 09:13:06
5
59
37780d8cc4883dba60398f40659c2b3aa6dfd6fe86222e02360f7c56bf5ccc7d
2023-06-13 09:13:04
5
59
d6d09b6d68b44130619418e4914e1f412b32b098ed2a712b030fb207a3bebaf1
2023-06-13 09:13:03
5
59
f1ce5417e4796b58f4d735fd4fac8ec4a4f00940b2b60554926b3e23dbd2b501
2023-06-13 09:11:09
5
59
6e92aa4e39c4e993f19451a1fae1e64c10c8ac613a01b57c958e912b1f227bec
2023-06-13 09:11:09
5
59
f1623997b75d1672f658e75745d87fea8c8e0acfdb72d412109c00131aed47b4
2023-06-13 09:11:09
5
58
759857dcada407e117e8b29fd4fba54053c655d5fa40647a35e54a8742c43e20
2023-06-13 09:11:05
5
58
790282858fbfb5e4a52d237663ff121d2e4efd7c63e5b3b06ee388443e6ea917
2023-06-13 09:11:02
5
58
d27e904bf2982b324adf48bf8d4db3b9a985c15dc85a9ba054985bc1c5e2bf8e
2023-06-13 09:11:02
5
59
b7084c5b54f9500bfa3908cbd64ee41d9b86a76573a148457fab87e0d4127a3d
2023-06-13 09:11:02
5
59
8a6ecc79c47936c66425dff8c46160f9289ccd9c2a633340a0d1d93ead0048de
2023-06-13 09:11:02
5
59
18c4ff0283caa598f12148f5d9607060a08341b8b43c89951bef3e13099cb542
2023-06-13 09:10:58
5
59
f0de74ce1796ed62e9596a5d2109756eac541d00e40624aa49a30dcb131ea114
2023-06-13 09:10:58
5
57
c3812bfb5b2c6a6a39f9bd560e9503ad4b5859bf0b7ba2af991d8af706b0018c
2023-06-13 09:10:53
5
57
5889850eb61432e58f5c4ebce7d7cf7e3ff59f84ab2945fe077f25a1fcc3a3f9
2023-06-13 09:10:53
5
59
fcf26fd33b597cb6f445bc627adc2f1fc1882cfe50ee26b336f61395e094d6d8
2023-06-13 09:10:51
5
58
af7d16ffb8f3c1366591b6fc61e15653a0dff07b9de265d6d399d080d0e821c0
2023-06-13 09:10:51
5
59
f011021e9e1bc2ba6a603dbeccf7b6c7a6c81faeb34581651c13b871d842c7e9
2023-06-13 09:10:51
5
59
a6242bd431c479f0b2aab37135df360b3b9f81168ccc534dec0b2f38b8472c4d
2023-06-13 09:10:50
5
59
fbe2f8344a910ed4ca13d150f2e184586ef69b7f12d8bb7c3eecfe65448a22e0
2023-06-13 09:10:47
5
59
c675be4c3778dbdf409e94597490539fb297a15208a6f4308ef159ce6c8983d9
2023-06-13 08:25:18
5
59
4a438025ac326c10bc50eb1d7cb13596f2bb209b56c0d7079e0f6be147284969
2023-06-13 02:04:23
5
59
e55c2b44aca94f736811ed0f7b1f023170b494578c07130431aa830bcf1aa43b
2023-06-12 16:04:24
5
59
bbf6545f40976f27fb906821aa116a8c191dc99147fd1e05003a3fc57d65480d
2023-06-07 21:06:28
27
59
5b566de1aa4b2f79f579cdac6283b33e98fdc8c1cfa6211a787f8156848d67ff
2023-06-06 21:08:28
18
59
8cfa7e214784150c0604689dc3c3d67704960bb107b4b0d2df7873711133e838
2023-06-06 05:06:29
15
58
929bf317a41b187cf17f6958c5364f9c5352003edca78a75ee33b43894876c62
2023-06-05 13:20:50
19
59
c77438e8657518221613fbce451c664a75f05beea2184a3ae67f30ea71d34f37
2023-06-05 13:20:11
20
59
f0d85b65b9f6942c75271209138ab24a73da29a06bc6cc4faeddcb825058c09d
2023-06-05 13:19:35
19
59
cf23ea0d63b4c4c348865cefd70c35727ea8c82ba86d56635e488d816e60ea45
2023-06-05 13:19:00
20
59
a1269294254e958e0e58fc0fe887ebbc4201d5c266557f09c3f37542bd6d53d7
2023-06-05 13:18:39
19
59
ea433739fb708f5d25c937925e499c8d2228bf245653ee89a6f3d26a5fd00b7a
2023-06-05 13:08:59
19
59
4359aead416b1b2df8ad9e53c497806403a2253b7e13c03317fc08ad3b0b95bf
2023-06-05 12:18:04
14
59
93137272f3654d56b9ce63bec2e40dd816c82fb6bad9985bed477f17999a47db
2023-06-05 11:01:47
19
59
0ea05169d111415903a1098110c34cdbbd390c23016cd4e179dd9ef507104495
2023-06-05 11:00:26
19
59
348e435196dd795e1ec31169bd111c7ec964e5a6ab525a562b17f10de0ab031d
2023-06-05 10:11:09
18
59
3a977446ed70b02864ef8cfa3135d8b134c93ef868a4cc0aa5d3c2a74545725b
2023-06-05 07:04:05
21
58
702421bcee1785d93271d311f0203da34cc936317e299575b06503945a6ea1e0
2023-06-05 07:03:47
21
58
fe5f8388ccea7c548d587d1e2843921c038a9f4ddad3cb03f3aa8a45c29c6a2f
2023-06-05 07:02:36
23
59
d49cf23d83b2743c573ba383bf6f3c28da41ac5f745cde41ef8cd1344528c195
2023-06-05 07:01:55
21
58
9e89d9f045664996067a05610ea2b0ad4f7f502f73d84321fb07861348fdc24a
2023-06-05 07:01:10
23
59
9d1723777de67bc7e11678db800d2a32de3bcd6c40a629cd165e3f7bbace8ead
2023-06-04 09:03:44
7
59
bdd4fa8e97e5e6eaaac8d6178f1cf4c324b9c59fc276fd6b368e811b327ccf8b
2023-06-03 14:06:03
19
59
b1c299a9fe6076f370178de7b808f36135df16c4e438ef6453a39565ff2ec272
2023-06-03 02:30:52
14
58
3ab73ea9aebf271e5f3ed701286701d0be688bf7ad4fb276cb4fbe35c8af8409
2023-06-03 00:02:57
15
58
2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5
2023-06-03 00:02:32
15
59
48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a
2023-06-02 22:06:50
11
59
c56bcb513248885673645ff1df44d3661a75cfacdce485535da898aa9ba320d4
2023-06-02 18:05:08
8
59
6015fed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec4011d
2023-06-02 16:13:34
8
59
387cee566aedbafa8c114ed1c6b98d8b9b65e9f178cf2f6ae2f5ac441082747a
2023-06-02 15:07:19
5
59
7c39499dd3b0b283b242f7b7996205a9b3cf8bd5c943ef6766992204d46ec5f1
2023-06-02 15:04:36
5
59
769f77aace5eed4717c7d3142989b53bd5bac9297a6e11b2c588c3989b397e6b
2023-06-02 14:08:13
8
59
e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e
2023-06-02 12:00:29
4
59
daaa102d82550f97642887514093c98ccd51735e025995c2cc14718330a856f4

Rule Matches per Month (last 24 months)