WEBSHELL_ASP_Gen_Mar21_1

Rule Info

Name
WEBSHELL_ASP_Gen_Mar21_1
Author
Florian Roth
Description
Detects webshells used in Exchange exploitation
Score
75
Date
2021-03-29
Minimum Yara
1.7
Rule Hash
b2313be88279afa523de97e3d29d18d5
Tags
['T1505_003', 'GEN', 'WEBSHELL']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
111
Suspicious (< 10 engines)
20
Clean (0 engines)
3

Rule Matches

Timestamp
Positives
Total
Hash
VT
2024-04-23 11:04:35
27
61
85dd2ab218ba67cf7aadda3be32271da2d0b230960b1cd81f110ee28f1aae968
2024-04-09 05:08:50
2
60
528439f8b4c32622c1a66a42f931a1657d25f39f25d5866471205440763b8297
2024-04-09 04:14:49
2
60
754f53375397fbf068f3eb43d1e9f9f8d7666cb8779cf47e688e167af6305a42
2024-01-23 01:32:26
10
57
03f28e52c43b28696b85a57919e5ddb76b90d0276e5f2167e4a6167bd4a0f28b
2023-12-13 14:23:44
28
60
542d5ae6f1d08da775e0688ce1766c67f996490ba1623f4adf3994ed949ffcea
2023-12-08 05:10:47
11
59
e9743a4b9f5aea2c3d91508a7779122009bd7e102f63870009ee55660cbc7188
2023-12-03 15:18:02
17
60
31de5415fcc865fc9ca4b436160197af8b59460d5f0bca95ab96ef761f2857ac
2023-12-01 14:03:50
23
60
80d5940fce9fa80f19592a4ef6079ba0da0401096579c7dcf3e3f993161d03eb
2023-11-30 04:15:36
0
58
23ed377183caed785f24efa15a73c4ff8b479a7ebe1f2463837f7d489ef3f03d
2023-11-22 11:23:49
29
56
56652b718667fd239d42102d2c756ae3ac19c66c57120ee065052effd1ce1d6b
2023-11-20 05:15:04
19
60
0ab6d9b1b400a29b4a6e0874e7f815c4312b194856501f2f8bea7c5eaea169b4
2023-11-01 05:39:48
28
60
5001657a1c9cfd777d6a86edbbf119ec8013a0ad15710b101b5a8eaeec99de24
2023-09-21 10:13:36
28
59
0f6cb7b5984e129aa0ad6a6942af7fa7ab239934d27bbfa210e37ea3149f8576
2023-09-14 06:11:19
23
59
e8cbfe7427293aa9d5b76642842b29bf8459aa26d809a7fdb8dd28f1c72d0fff
2023-09-08 22:21:30
29
58
14dfc71c582c537da0526af5ef2c83f7adaab3b1e86da61eacd8d519094d2ff6
2023-08-30 14:50:18
9
59
8d387ce6215426f0b328b950f370072720acdd336e1e07d4c493a7770782fd95
2023-08-13 22:21:43
30
59
42390b7bd66b71d856825d664e5b44ebea2accea4a59592e03f74d79863bdbda
2023-07-05 22:38:15
33
59
156c5656c738149e7fc442f77b75e8d39abaabde527052fd16a480d78647f592
2023-06-26 05:44:59
12
59
baf3cce01bbac751683a131752b70019c6e98b81629fef5042fd9e2a9ea8a5b1
2023-06-14 12:04:39
28
59
5e8b63afd4804ef8499aeff70efb18c6c223032dfed79d132c08c07235a1322c
2023-05-23 11:13:41
29
59
2293816b6d242b4561c1b72a5c73cb1a22ec58c5212566820835ac8022bee16d
2023-05-21 15:13:32
29
59
1d47ea17c905c3c10a8df57b8245f8ab51a094f40271fefa322bdee76b4be020
2023-05-09 12:10:58
24
58
955acf56c5675a865c89cc7c4c9252cfa427554b7dd1bba7c3812ed66b28ac28
2023-04-07 11:16:27
29
59
f509444cca68d45e77fb05d0915b44f4a32f0dfe025c653763399f3e8d10eb15
2023-03-23 10:38:29
28
59
ece29c80c9a52fef84544ee8a755c1b152166299a7aba67902b43c3ddc6bf163
2023-03-21 17:09:14
28
59
6b4c42f3395b9892ebd37789c8ce64069dbf2958a775c1638425f33fbf7449e6
2023-02-02 06:32:17
29
60
6c6ddb33764f2a040b9cb326fe4926ba9f92386c92df789ec7e794b0c6c597ea
2023-01-22 10:57:40
27
60
3f8399212e00f7b24e991d90da9b19c36e9b210eaad6b4bd783156e3643374ed
2022-12-02 04:15:13
30
61
e3d3553dfcba3077e071f9d21748208069ca762577220e5a81e4312d98fe352c
2022-11-15 11:07:01
28
61
13f3b768f32a9d41bdc30adbcb1b66d6c72a0881b66bc336f6942f87fbd60f61
2022-10-08 05:39:43
26
61
53c895cffba57dc91e9378c70777c86340263dd776f0ecdb0951c2debc9ead16
2022-10-01 20:08:10
29
60
85057c8b3461292aa722b9f27be50a4974d140d9f2a345281e7a2e31866ada5d
2022-10-01 11:24:19
31
60
810aa6466da8447515338fbe98755804c8af4571fa3aa5a0af601eea32503b72
2022-09-15 09:23:57
21
59
4bcc1081ff339b60f1f96484bbb949c86f70d796854cf1b176a176ba8736460f
2022-09-14 10:14:40
28
59
631daa42fb8f9252e4c1362ee0cf118e217ae04ed8d3504230b20f25a2d2f165
2022-09-10 08:06:33
29
59
735e3dec57f29eb7bffe1d81d4c3d350ac7a86074d6bb5d713313187c08d6a95
2022-09-09 18:19:07
29
59
92bb6d9b294afa47bb15ac52221db9533d3b04b378d09a78e23d41b26bb049c3
2022-08-29 21:17:37
27
57
22aeaaa33e50ecf28f5d1b15a224f7b76d3af3956396184f15a75ccdf1c59e16
2022-08-29 10:56:57
29
58
d899709bf6aa662bb078b578b27e9b244468bea90e91ad58f30c81a3418558c7
2022-08-22 16:32:23
8
59
e74bede2089b1cdae1f176e7eb5f7d0cd8ba374d6ab47dfa391046acbf5d96a3
2022-08-16 12:29:24
20
58
f6bee661586af4d8af6e4f209a1788a4b191ee35c2ee33dd894bb964e2156ac8
2022-07-25 23:23:39
19
59
b5ea36dd947cafa31c9aad16e35bb765e9386c2660f71505ecff2cb84c49b298
2022-07-25 17:56:10
28
59
999ff88a6231fafa6b99c7c4c1afe277d24dba97b0fbcc47c51c1b24585d75f1
2022-07-16 06:29:01
25
58
bb8eb46ec334e60ccc846eca4cb1f08656dbc0a701d40b162ae6781b55b1f3c3
2022-07-01 13:12:48
29
57
be0d74898e8df492c00600e7ad957d3ab477dce72902ce6ff5bf22acc8070f5a
2022-06-18 12:22:26
21
56
6cc8c9b5a8ab3f11e1488351ba75b9c7f6d7506f09acc34acb39d6ff421a1c73
2022-06-06 05:52:17
6
56
853dead67a0cd8c2c72b0aaf414aea1ca51d53145d958262f3a8d14e14f132f5
2022-05-28 10:30:19
28
57
ad16814434bef5bddeb2ffb902e48a3a8a90c5a7c7b0b8071ee949879e1493ba
2022-05-21 05:25:58
26
57
b30053c577a12386aea7de88a5f3104ff2a801f383fe5db761e7d317849272e9
2022-05-20 21:07:12
22
56
7c9a345bf722b391d6d09f0648046abbe4e56c398330bb09651e8474e7400c5a
2022-05-11 11:19:24
19
58
08f7da92ce20fb8facfb4ac29231fd5c2193bf5c737498ccbbd08d3986ccf5ee
2022-05-07 18:48:39
23
57
a632723e946d5b5d0cc47d1d6b2dac714ed00da0f0cac79bbcc82e98b2eebad5
2022-05-06 08:45:44
5
57
a76ef8ce63b42be5edac374ed8078dfb3bf65fce76f2b861dbb25b55ae19c9d3
2022-05-06 07:10:24
10
57
23982d19691e2fe8861294a958ddcdd9398a9301b2b0282a029484b042648c26
2022-05-05 12:04:23
1
58
ac65afe4b4737a51e9d52e3037c9ff16d36eda8711f8a71f3aed1f77c552535c
2022-05-05 12:04:21
1
56
82f6f3abe3c07dfd7c05d742d7de268809ba29a1c190de4066bcc254107e9291
2022-05-05 12:03:19
1
58
3ad769ed7b91b5f99fd7ae3383c74e24d070d36fc5dd5465fe3931e0f53c2464
2022-05-05 12:02:12
3
57
155dcd4c5ebc5d22aeda99364c42a47a2fc9c2081547751130db0c2277f6fa55
2022-05-05 12:01:10
3
58
5bdeadd12af810e653f7c85dc7a85e36321492c4d04b93ac1cd558947e7a6227
2022-04-30 18:14:20
26
58
b84f6d22eb9c459e97215523065763f1e108c1a5a7ee310f5ad35f004d460b8b
2022-04-12 21:52:51
5
58
9c05aad25f7a018450874f2643ee1e8129433599910965b6cfff68895c0a6197
2022-04-12 04:04:17
25
58
4f8802710fbce8e16230c79511791a19f935e8262bc7d8cbc7f969a6012c8ef2
2022-04-12 03:10:01
27
58
50b023ab2ed2934b916d802a23a7f6834eba3a203ddd214426b176f533c63f0e
2022-03-21 09:45:47
26
56
6ce67f37344681b9a945041bf90c16ecc4f482d36510b57aea9df1f040318827
2022-03-14 14:50:43
20
54
ddccfc7c995e525c22b2dc422c226c533f06a37140964d83969a7d1ecee5e083
2022-03-01 21:27:44
2
58
123babe71790cf26a4ec8f131352f73b99b58af096d13c1da84ee102282a1ee9
2022-03-01 08:21:18
27
58
27be077b8ccb268fc18978c5966f13b788bff898e43ea15727d6e505381f324e
2022-02-10 11:12:11
28
57
3a5d6d5f951bf5917bf415fc65f927b6bf1b2c56fbb04322b1ae59e7f6489caf
2022-02-04 22:13:13
25
55
4258717e076a31dbf013b2e103ff7e9a9c3dd657f335c746ed274b8b8f082d21
2022-01-27 02:15:10
25
56
ed3e8d5256c3aa5a1a825b90f159778526fe2a85fd37360c7d7f54fa617cc7a8
2022-01-21 10:36:08
20
56
f82848147fcd72a20aff6244e4ce82482463a9a2a2d3e7b8b4a02df9aa211e74
2021-12-15 09:37:06
9
57
ebc07e7e90a006c6092fc7e4c3cb9fd7804e287379c6dc5e4780b653e21d60c6
2021-12-09 16:49:47
1
51
44641890a812271c1fd95aa9e72d796b7dda0695c606cb0f887e83eaa9f7e02a
2021-12-09 11:51:00
22
56
11032e9edacb9b23f92d0230e073f91c34dd45b60b773419305c0acdbcbe6ef7
2021-12-02 09:54:13
16
52
73ca54d2eec802ecda2727d730edbcd17d601e8a0e5fbd26c5c89fe6241c0eb8
2021-12-02 09:52:47
25
55
b451ddd121a9e90291d4eb0418393b892bb69cfb9e9e6b60b4ec24081e507817
2021-11-20 17:42:25
25
51
f66b9546e31c15a5facb756d94dcfdbe8b2c2b2902125562a786d9197c58e066
2021-11-16 10:07:14
26
55
82e0a57eab2ffd11d45cc57d7000119cb43eff24c3c3b84b1e216dec58d65f4b
2021-11-07 10:06:02
6
56
874c16896a537cce3701bdab9906aa2a03156e9e94b9a041876ea74ac7141aa5
2021-11-07 06:54:52
12
50
95032d345c32f46389041260b6f0e47055b4017cd3e767515635ce2404f41593
2021-11-07 05:06:55
16
57
2c47a9e6cc6613becacd9b8a9316c576028ccb9bfa5be4408afd7f0e1980c7f2
2021-11-02 08:04:03
26
56
a660632eb2c0ef42272e387e156d27f721ca05c3c152483d6f6562c721aa9068
2021-10-26 18:39:04
25
56
450ae0487655f041a0e80af2eda089a8e01461a3391c6c1f0ed29bc601bf0818
2021-10-20 12:04:32
25
57
0f565d8a3d67f0a8972907229d9c7410c97862e88de4fa623bae9fcfae6b85c7
2021-10-20 10:04:49
26
56
cd2c08b9816cc6d4500583c897516d777e4da8c76f63c4a417e7f5a0343dc906
2021-10-11 09:54:51
5
57
0f52bb37d160b8f97aaec084d2d00de3084ade2ea5ad603a5cfb40f445b5abc8
2021-10-03 08:18:09
25
57
7be827158c8794f2b69c6c6d3d334227cda88dd1fd99890f0875b38ec2508c6c
2021-09-25 04:39:08
16
57
63364ea8b0052080ad95cfa497e9640f274d5fdca9ca5ccb614a628aeabaae5f
2021-09-13 11:29:43
27
57
6c7d480380ad0b2081875c7eec4ce4e369a804ada9385c7e969ea0b1574e8d72
2021-09-09 16:31:40
4
57
fd051abcb71c273768e59513b20ff0e6e89200a118a7e5d0d754de74b200fda0
2021-09-09 16:02:58
4
56
23dac4a9717d69eecd9f01d9a05573a4928663a3410371f5923a74db23927019
2021-09-09 12:13:47
21
57
f620120203ffdc15d5888c53d530110593d5f27719d3dad6ebe87cb6cb5e8d6e
2021-09-09 06:04:29
22
57
8ae132d5132723d7a90c2e73b33d6d69b89f2ba6a44c7491a0ca073e169be561
2021-08-29 19:24:45
16
57
f2f58cbe49ab42e4cda744b8484a7f7356f6994f96e5717c48e36a98ef106940
2021-08-29 09:49:28
20
58
3f311af746336a3cb9b82eed809aeb697de2083c5c74d9a627b86c306bc9c59b
2021-08-24 10:50:50
26
57
c2a0df7f9401e4833144b63fa3f4d75ad377f5b87412cf20a7e7c4779a2bd987
2021-08-20 18:01:03
21
57
a76cd813764ff21b5662dddb1aa67ccd4254e22435f017caa8e524c344e8375f
2021-08-20 13:28:32
23
57
19e9c9137463abb9c30e249abae77201b0931fd1f8a2021ec2ef1afcaceb0845
2021-08-20 06:39:30
15
58
3db9249927a0c7f60c9f3ba99f955b88ea8bf8cfa65b33afa643675acd36c1ff
2021-08-19 20:53:12
23
57
357fa6dcee62134f851134ced82f446203cb88e5d0ae457be9464c5cc3e19c9d
2021-08-19 11:37:32
23
58
e2de0571a071f0651ff51e6e222e986d8092c3722553601544be74e35e427081
2021-08-19 10:29:39
14
56
f3094c51abdbf337ba980df22c357ee622e127b93ff18b87b06b02f1867e295c
2021-08-10 05:03:42
25
58
231e48eccb5787bf4a772725d0f40b2d6ac2d42ce6a6641e975edf300777cd77
2021-08-09 09:55:17
24
58
79e128f0eb06308209365e8394250d6d0c1d9b06bf2aaa3f1f7058e73c189a8d
2021-08-03 15:03:27
24
58
583b10ab0ff4dae130fbc672d0b211e60879478e8dac43cfad09e825b5cc96b6
2021-08-03 15:01:15
26
58
b2ba0997efbde82d9109aed7ab1d8905ae9c14bb37be1e07351d20ae91242356
2021-07-23 12:33:20
13
38
5f09bfe25c18b54e7df5ace3ee616696f457ee760702136b0ef00a3ae11bea03
2021-07-16 12:11:12
12
58
aeaa9cba7394a857a084665d18586d8fee763598050ef3d7b615c25872f48b0f
2021-07-06 11:59:37
14
58
6becaaf25b372050120cfe90cf5d620935df5f591fd473c53e0397f56643e222
2021-06-07 11:07:41
16
58
a38041f820a0206f2d5dd0b109418d313c0eca96d17315e881e5e36a29958a85
2021-06-07 11:04:21
12
58
0039f8a7ebc7510879d085e1cb2919212802c89c0c2a05694e0ee42d906ff223
2021-06-07 10:58:58
12
58
6b159f39edfc3914e4bef583c5fdf86cc6ac745e17e353e2767b47ffa954a2bc
2021-06-07 10:49:34
18
58
6eaf54852c625b20ea221583e306ce82c8c90764e30716e442df3e63606fdd9d
2021-06-07 10:43:12
23
58
623590bf3aa34a352506b6331c92b6a5b28a9d37d657bc98577f87f0d84fd1ee
2021-05-23 21:27:34
12
57
80ecf11eca40a59f152b050da2a97f4b6b2837dea92c3393297313767e5b7806
2021-05-11 15:25:10
12
58
9a3a4752a344a684e8d1e7e0a1e428a892affacd7a122079b2ba79a1739dc32f
2021-04-28 10:27:02
21
58
66020ae7465da858cf07ff2f3ef960bba8ae976dc73ec3acbac952db6a4294a0
2021-04-28 04:22:27
0
58
8cccd2a6d60e862ccdbf49fe4e95d8bd62a20066e3008009596de653e423da41
2021-04-28 04:21:28
23
58
2970143690b27b78e25ddc613a1a917daa26d9e3edcc64ed71cccf251eab51c0
2021-04-27 05:35:54
22
58
b6dcbc1d7eb9267e94cf6fd72d6423237f5078493184d8d32dcddd5c5d724aad
2021-04-20 14:30:53
0
58
8a515a42aa50469619eecf44f82150a963d4d6084546379e7eca7fad8988defa
2021-04-15 04:48:07
15
58
eb6c37d7967d6acf2cd49b4d34c13cbeeb52b5c80b9e3e85c6953a92fd5ca464
2021-04-15 04:09:16
2
58
5f151bd43bd7e7b45dc1b7737869a97752dc965a7aae01a38db4e34e16fba67e
2021-04-15 03:43:37
15
58
99b6f000533254737859376d1193409dea32c8be5ce09cbbb98aea9a7b3093bc
2021-04-15 03:42:56
14
58
f2815c3a6edca186768581c9b02ddb5f0d442ebfdc089e8d55efed9eaa06265a
2021-04-15 03:38:51
15
58
e6978501663a98918a85ab4bd87305dd66580edb2480795921f1070e73ea27c5
2021-04-14 14:43:01
33
59
511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1
2021-04-12 05:52:58
19
54
a92b42726363b3064f80621df9b78aee7dfbe5d836e8ceeaa74ea02a6f0e101e
2021-04-07 13:34:20
19
58
0f5ab19bcf297d20f8c13aca39e4ffb561d045840639599721addc5f910b7a1a
2021-04-07 12:51:05
19
58
43aa126900c2b7f0d63e929897743110f775523bb7e2a558a1effec19e79f7b2
2021-04-07 12:27:27
18
58
654380e4e67e7719425eb25fb7b82d9626eab57352b6df5020999ccce090893d
2021-04-07 12:10:41
18
58
09dbc51d9c8463c7067da503ed5d7a6accdabfd045e0719f45b88c1a1c1983ab
2021-04-07 09:17:01
19
58
fb6e7e848449397853dd77b7d2548a1d815743022ec0fc7770c3871bfff3537e
2021-03-30 16:21:14
30
60
a291305f181e24fe7194154b4cd355ccb039d5765709c80999e392efec69c90a

Rule Matches per Month (last 24 months)