WEBSHELL_O0_obfuscation_Feb20

Rule Info

Av Ratio
5.28
Minimum Yara
2.2.0
Date
2020-02-28
Name
WEBSHELL_O0_obfuscation_Feb20
Author
Tobias Michalski
Required Modules
[]
Rule Hash
fecf00e9c08309ef4ae02dc3aeb7d2a9
Tags
['OBFUS', 'WEBSHELL', 'T1136', 'T1100', 'T1027']
Score
75
Description
Detects webshells that try to obfuscate by using variables only consiting of 0 and O

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
2
Suspicious (< 10 engines)
36
Clean (0 engines)
40

Rule Matches

Positives
Total
Hash
Timestamp
VT
13
60
d5e301c8467f9f44587386a13944a13409ec071a678abde87e93dd436098b552
2020-11-27 14:35:19
0
60
14b5c682688280b3d2c8d5a75841d102e1e7f5ab84f4192370e07e0be52b7586
2020-11-27 12:28:46
0
60
55b489f84b943569d74f3121a82e1261c4a22cbfda9547a731634069ab813a55
2020-11-27 12:27:37
0
60
2c4e3db6eb469e95859b1a3db0306f2b9b306762457bdb1f9bcc8ff5e6b93f32
2020-11-27 12:26:37
0
60
7cb3a8be03992bffdc76ee265cbaaaca0b7c54345201a3537cfc74c426c59cce
2020-11-27 12:25:51
0
60
b50ed1493814add30239c18d51e62e0b2933de52494ccf63651c4159db679a3e
2020-11-27 12:25:50
0
60
ce84b7d78f46aa6ae50e5550bb640e7efdbc09fe9b8372bf5acfa27d2db4d63e
2020-11-27 12:25:50
0
60
da9288cbdf4edb3d24ce1d85ab0d82d6c25a5f79dae636b8443f4bb63a0b900a
2020-11-27 12:25:50
0
60
2421508a1c2050005b3c1c80ec1c9e8a96d68cf97a5b6b35906b7006d0ccf687
2020-11-27 12:25:50
0
60
369543fced6235530de3e718f7610291663bade3b80bc6292fc0d4eb44fe3cc4
2020-11-27 12:25:43
1
59
171a9830d08c1edf367628ab2420ec0607c75de3b60b905c43d2b036b37b915e
2020-11-27 12:25:43
0
60
d8fb2b91c33725c58dc31cc34fc49f242b646425fd5184a5d2928133fd4d0f29
2020-11-27 12:25:42
0
57
b3124bbb7adc4b65914adc572611c63f9077d278b246993b0381bd3c0174330e
2020-11-27 12:25:42
0
59
19898d214d19c135e4090f2d01f7ab7a6b905e65fbf5956d8485e577f64226b6
2020-11-27 12:25:34
0
59
aa32dd8d5b03828f3e243f027ac7b99affd4e331350e33e08815498b0b43bb69
2020-11-27 12:24:13
1
60
188df082e874cdff6b0e38a90c2d5eb4db79a6ef3195d8de5dc807c6951a0073
2020-11-27 09:52:40
0
59
4265ad85ac1a29a5f7173023a2ad67a5eb6cac0e48d2357e57b8970fd6fdd1ed
2020-11-27 09:52:40
1
60
e9b2ce7258cc270809a57529fca7d891a98be0f0490824b3755bbc1dcff2a634
2020-11-27 09:52:36
0
59
8a1ac0e4112936dc51b4ef7f622b57656871ff7ccfb24624594cecec7a3cf5b1
2020-11-27 09:52:31
1
60
25772cf3865eda2565b5662d5ef8c0d662792a728979364886f0e20cf9feb686
2020-11-27 09:52:31
0
59
aad1d9db62b67caf6b45df69a5c1ed5a7f94a06170cf289442b28a4576c628c6
2020-11-27 09:52:30
0
59
7e8cd394708edaf4e7b68f7a019503a5acbdcc5bb8ba090ddc929c890e828873
2020-11-27 09:52:29
0
59
4e81dec96c9a1610b0eb4ce909b923ec78837bc370aaa8fe5bef40b622bba2f9
2020-11-27 09:52:29
0
60
55943a481701962f92dc0b2daafb19483af5117599bbccb119592af50eca069d
2020-11-27 09:52:20
0
58
251cc5706dc00a9fb6c772385eceb5d85c4204695e1a15e664f086a4d681ea5c
2020-11-27 09:52:20
1
60
eaa933c0f5c8288a2141d0ae8210a67200b49d3f238fe75bd8c1d0f5764b7616
2020-11-27 09:52:14
0
60
5c6eb208051d0359fb4d7114710d9f6a719b439cfe3a7910d3fe1b5059a68be3
2020-11-27 09:52:13
0
59
f12d9420a9cb11eaf3d18a4ab30f9d92ba0befa096fe5f684074d91f1448d17c
2020-11-27 09:52:13
0
60
81962e1c3b6729517acf481e4a7f627019e81d98a1a9dd64bca5402b503ca855
2020-11-27 09:52:08
1
60
5c47d06abbf9d5f7b8384633dbc7b8bd9d58f142ccf9bd40ac97419939bb6c6b
2020-11-27 09:51:58
1
60
137a5655342101eac7817c46ec256bbfc4eb50953f1a55d653d10b8dca74e47c
2020-11-27 09:51:58
0
60
a289ec61ed2c7c78492972300be59b36189c54e386335ed24a1252c0b6b11950
2020-11-27 09:51:57
0
60
daecca57335fd9a4487c4151b4dbb0d8cfe19870e896291d9e21f3f51fbf7b8f
2020-11-27 09:51:54
0
60
a55fd65ec98001c7253bfad9a7eb535c396feae54a23157fdddcc98b45c978f0
2020-11-27 09:51:54
0
60
b81ef208a63b9f8055ae0eb733b94902c8272294a02b9587b37d1bb3e9076ede
2020-11-27 09:51:45
0
60
e4574c3b6336007afc693f9c5c517c745414a0258eb8c4addbd8408dcdaa69b8
2020-11-27 09:51:42
0
60
38eb50397a2d8a11136f853d946753d722a354dd22c8bf3f91f9a0a247049d3f
2020-11-27 09:51:37
1
60
2bc527569dfe6b5c57ef344f677c39b51d01ec91e10f4770322896791ca1d9a0
2020-11-27 09:51:34
0
59
304b32a95846b5f79b3e81b58d3aae00b4595736a87d3b675bdd66a1d74e6c5c
2020-11-27 09:51:34
1
60
870a9fcdaf66ecce731fd80e5f478965b95c9bf4807ffbbcb2b6b21c0b1de60f
2020-11-27 09:51:15
0
60
f8b7560aee99e7724dc8321df76794eb5b14070955f48f09f160eaee7adf1f77
2020-11-27 09:51:10
0
60
6e41920330aeba80087f562f85ee2dbe10430b76b04a8738b7f02567286442ff
2020-11-27 09:51:10
0
60
2088280e159e59347a57742547457557eb1a9c4fd163bc8727bd7fa28e9942c7
2020-11-27 09:51:04
0
60
bd86b192ec8253c54c1c9290771e1afbe70b14310521784ec76a6f7334f154c6
2020-11-27 09:51:03
0
60
f5ea0d13fae49380ce2c286425d6e6da16cca96b44dd9f79610bb98f3d713aca
2020-11-27 09:51:00
0
60
62260c7743cab8daa30fb9376b759cb5b6b062c11b14f2633af8b17a8600071d
2020-11-27 09:51:00
0
60
e87dfda7cd81af7f0793e6e3505db2729e350ee05d5bb57f6e307981bf3351fa
2020-11-27 09:50:57
0
60
d2cfe5ca83c36d28139217d4588938e596e4971576a08b11cd820488150e76ae
2020-11-27 09:50:41
2
61
18e6d86e886a834a5d3fd19c41024c5d246d5e3fa84bd84f094651673e24d612
2020-11-19 12:35:15
0
60
df261e1988445655af7aa81e1e6bf83d49dec88b8aa98ef412642220d51ff2c9
2020-11-17 14:33:42
8
61
d654d65599478fbb6beffc697b99a93f7b3d5c41e49a04467cdc33de01bf5574
2020-11-13 17:54:16
8
61
e82b784b48897371b8dcf351c14b0e9de333871b747188d1a570f666c37464f5
2020-11-13 17:54:09
7
59
f4d02b8b26b664a8b5c375f18e20c304dd210ec1e3af15d772a64505b5a3ed94
2020-11-13 17:53:55
8
58
91a2cca851420066b7ae89bfd72783294f9b26775565c42fd74580574e9d87bc
2020-11-13 17:53:32
9
61
f06d510324bfc21436481a7ed64d926d778ef1fb4d98eb07a86282b693a8960f
2020-11-13 17:53:32
9
61
0be0ffaa0e41ddff87acc08cccca50bd4cfa074339e54bf16da30c9b5acdc9b7
2020-11-13 17:53:31
8
61
e676b3581f2ab8218b9acbe1b9aa4d004891ff34ff44849e6842e8ab487637a9
2020-11-13 17:53:31
8
60
8e50cdb41dc9a428343fe9397d6f27b51aedbfbbb1c61e7b159b61834dc1ec38
2020-11-13 17:53:23
9
61
55bf1d76ed0a164efaf66aeba3011e8d14976c43bb16e19166a57fc49271e3f2
2020-11-13 17:53:15
8
60
e04ea2422cf43a0384c76e0625431ae0af2b901bf51d96d6a4f6cb0b7fe815a4
2020-11-13 17:53:15
8
61
ca304cbfd4dd8434a5d255a7bcc4ac478014bd977154b2d096d0eddd60b0fbcd
2020-11-13 17:52:34
7
60
85ddc0683849d1af5717dbf33e21662d64373432b318236297335facbf931fca
2020-11-13 17:52:33
7
61
aed37c1c8f7c7791650c09f973660112ad970d482e7958b6e63860fa22db2b1a
2020-11-13 17:52:33
6
60
aa158d10348c3ff73ebbbd8a12b986154a0906dd04b4a4127043921a3057918c
2020-11-13 17:51:21
8
61
6c11576d0121c821a8a8872906119aacfafca40c5da8cbd5574eefa379e77531
2020-11-13 17:51:13
8
59
7547030e299ff59dbfb140f9998b97c7a31b40445c89ea40ae2bedc9ea485988
2020-11-13 17:50:49
8
61
5a55fa1ce56cc0b05faef4724a9109f4978925d03b2867dd366b96cefdf311b2
2020-11-13 17:50:34
8
61
443d110284debdaa2db5bb0099430cc0f13ff9d9c523ec08646fb8c0860b826c
2020-11-13 17:50:04
7
61
2e3408cb0f3823c70a14203c1342f21b34890377888b893f5d1d227b4ef370b7
2020-11-13 17:50:03
6
61
c74c2fb6e5fecf5e748db8bd7645545255d372951e4eaa279d78eaddc4f78641
2020-11-06 23:27:30
47
67
71c0f5ce5b2048776df9f0c4d36d372229690c2dc9a0a22b79ac75e0ff510f53
2020-10-30 13:59:59
2
57
ea82f30a45907bd22935d705aea0c2a714cc795a2745ec80cda22a5861ac8969
2020-10-23 16:52:32
0
59
355b16290fefd1a07bfc2e62a6c974224808231ff7f6c4abfcb1bbb0e64a873c
2020-10-22 09:46:13
6
59
a2fcec8954112db08838f57ed2850e43aa690ac0b0a39fbed4bfc9b5b3adcd19
2020-10-20 09:14:49
1
59
8562ad07ec486ef14275d14c823ba8c45f3fff662df3285e47f8be644176ba00
2020-10-14 08:49:13
5
53
477cdd19f01b4fe941ad60e43dd4a6c93c052da1e68594eb6916ec67b8fe4eba
2020-10-11 13:14:10
7
59
7dab6cf66b267c6774f648fdac234e0b990f4d8fa73cf3c78dc511da37369be8
2020-10-11 13:13:26
4
48
9d9e2fa7d90834985ad3f54e2d2b4088bd5bded785c4bf54667640b4c1a1edaa
2020-10-10 17:05:18

Rule Matches per Month (last 24 months)