WEBSHELL_PHP_Apr20_2

Rule Info

Av Ratio
15.09
Minimum Yara
1.7
Date
2020-04-30
Name
WEBSHELL_PHP_Apr20_2
Author
Florian Roth
Required Modules
[]
Rule Hash
f4bbdddbe4d2356531d8add2a0d7540a
Reference
Internal Research
Tags
['WEBSHELL', 'T1100', 'T1136']
Score
75
Description
Detects PHP web shell

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
57
Suspicious (< 10 engines)
51
Clean (0 engines)
6

Rule Matches

Positives
Total
Hash
Timestamp
VT
15
60
65231616a72c88906f1813c82473cc434750167b9f082d19d1b8e855903179e7
2020-11-28 08:54:03
15
60
dcf6d37e2e55fba04f9144220eff3a86c91fa1d2b6de33e5f5fc678a6ed664e0
2020-11-28 08:38:56
16
59
05a4f607d6f8144c44a0acc628d622ccb49d480b6d65bdccf64a98705dab50d3
2020-11-23 14:12:05
17
61
5a2466ab080e241845fa0b9af1936a0fc7602669069df1cd2e77ac3108a2bfa7
2020-11-22 17:47:41
15
61
85e3e5dbf52f38be79b8ddf3f0de3ae1250584fde316728b96be26b697f36df0
2020-11-19 13:20:21
17
60
8d8659f7c439128c2409db15a0dfc975e0c3b3c913b934c76dd9c1b451eb55dd
2020-11-18 09:08:50
18
60
c6e4f2d3fba90f12d2c1834bf97e0e9af319bfbe475058b343432bc0f1a70fc8
2020-11-18 01:06:27
16
59
acd2bd7fc8591913d859eaa980d4c5c7ada7ea8e9b92d8eb8a6eeb082f8bd59e
2020-11-18 01:04:56
3
61
ed0fc5b4404a2e561907cef6141ff618bd4672bbc0761a484c69f7680b9fc7e7
2020-11-16 04:24:11
2
59
d152f19d584037c776b259dd92ab14de2457c9cb9cc0c9da60284eb37d83a128
2020-11-16 04:21:36
1
61
a5ef48cfbb798d940bcc2f57fd4c0e274dee5416f91cda17dcfff0b7f9ed3682
2020-11-16 04:20:29
0
61
2354afd6bd7a3398b285ee6234bc6ce1b0f65adca3aa633819d1067711dc7515
2020-11-16 04:18:52
0
61
851aeb6a4018d017f1e118084fad5f30572af37ce50a55cef078fd1875c85965
2020-11-16 04:18:22
0
61
d1a30c590dbbe69ad9b3000ff05779be88b4892b3f82a04632f8208e34df12f7
2020-11-16 04:18:05
0
61
d3b10733b550539e57277c385ad2c5bfba3bda08ce5aca98d9d92556dbe7721a
2020-11-16 04:17:29
17
61
12ba36a4fef0c04a3e6f486d4df97545ecafab84d5b4f715c669a53d1a4f70a5
2020-11-16 04:16:29
18
60
c53cb33d9e09fdc9efa096954bfe72d28b5dea7737e3b14d5a6f0a3327652f91
2020-11-16 03:45:45
17
60
47896b646dc454267da973567d51cff8bab305f40276449bbb6bca9c39ac2853
2020-11-15 11:23:43
17
61
1d04f89461e0d45f4a50764d52b80916b63c66983a56e7932b3c94c477f76d81
2020-11-15 11:22:27
17
61
f36e565ad583c25074d4ba86a9adbdf633a270c2a958e094118a6dfba18259ea
2020-11-15 11:22:16
17
61
8b3f514c130482d74d2afeb4ac2a44260791c06d41084d0bc948236357fe8b83
2020-11-15 00:38:15
14
61
300b51a9d2d9d19baa31f954a59a340fa119cb9e701fffd2f073c1c9868ee9b2
2020-11-14 00:13:29
16
61
8a584d209cda05ab328c0155d5d624486292f4307ce06fe207741c1b139890e9
2020-11-12 22:18:35
16
60
b6ed13b42229b16b0567776c85eb96ba5c6cc222993703858af9eefad840f554
2020-11-09 15:56:56
17
61
286fae91d3360dd6fd8bf1da64c63a5331fc6d127e2e4bb1f5be789fc6caf5aa
2020-11-07 12:27:18
17
61
311494cfc4cd717d7cc1cbdaa193867bcd8ddb7534164eca22c37607ee23a3cf
2020-11-04 00:49:15
13
61
03e03aff933bde2885ca05c122b1b772a9032a5b9e9df28c064bf609176bb372
2020-11-03 03:19:57
15
59
11d6a68315c9ab98653648b27a501fc01847b54266a632772756b8129c7f833a
2020-11-02 10:07:48
17
60
2b9aa1f823b50eb40c359e726f22659b4c31ea24113e458b059fd3b514f38489
2020-10-29 14:26:40
17
59
e6383b810da473bd40db7f373cc717a45ad195de0d104cfb7c5055f7a2e533e9
2020-10-23 16:26:36
17
60
e5f26745c325dd1f3bd6f50057bca06172bf83f379c729d5ee6c66dbf6163009
2020-10-22 05:08:56
17
59
78216a718510c396672fc32a6421079a536520a7ac3bbe2990a7cf2a4511a22f
2020-10-07 13:21:11
16
59
8daee7071daddb929bc07c86bf51865b34dbc517c3c173fe2bbc7eaf2425c88b
2020-10-05 14:17:41
16
59
d924a11e8f275641a6d1b29b4c916b37a531fda29a93823a8ace30ed442cdfb5
2020-10-03 19:16:04
16
59
91523f0233055c698e1c6dfb9e951bb6108104d428379bfcd48ddc032e029738
2020-10-02 15:40:11
18
59
4be4a4dd3ec85191bf5d93a4bcd0f1eac62ec9bcc252d097c870c5328bf6e62d
2020-09-28 18:22:58
16
59
3c461125ea6a8b0c85a8f2efc17890ead5e27f0a869ade9610ea3d348eae45e2
2020-09-28 00:36:05
16
56
3431c8011a2a72ffa161ad364b78628ef56d945aa3d5ee49a356261cbd87bfc2
2020-09-21 19:22:29
16
56
08884f5131807fa5f8f847b1654627df816fbe3e2c67b6bc23a2f5ccb5153e5b
2020-09-19 09:35:07
13
56
b75e2df5228a4dec6e79f43179fc65c002b4933a388c6de0368864f6ad9417c7
2020-09-17 08:17:02
16
56
0cc311f0d2498dc5effb0d625b8017862bfec4e28e7842e66729f4930b466ad8
2020-09-16 23:14:24
3
56
b61f70929d69d337ffd3674efaf5ac63798b98de7d3513c60179e37bb28d079b
2020-09-16 08:08:04
12
57
47ddfef894a08e0ad49696f6de0adb47539dc03df0b771a9602afff2eaec4b6c
2020-09-12 07:10:26
17
57
0096d60884aa28977a9fb094f3ecfed38cf9756a16e0340a12a31e019cd65169
2020-09-11 13:44:23
16
58
cfe137a9cd29107e98857f485ea295817aef941df107f8e129d352c6441a25e5
2020-09-10 08:17:32
13
57
908272424c1f946995000c9adf71d4438e5318595c31b112dc58767afabf2307
2020-09-09 06:58:04
15
57
7ae0b009bf04a292184fdfd910ebdefc22ff351f9b0f7943aca97a0b2e26ae7a
2020-09-08 07:03:19
14
56
aa35197f36c28d1911db5e44047bddfd435b958dfa63648d39aa1592104c0f6f
2020-09-07 13:28:50
13
57
b90637ea51afec9ebedf292d876fbaf80ed2eac0ec3ae049e7fa9c89d786abc3
2020-08-27 15:51:52
11
57
6f325c8025194130f13b1cda555ef6b5a8a7b8ab67e284cf79b2d3c431eeae33
2020-08-26 04:01:48
11
55
8f16a5a2ad3f7fcc2c41f68c809027c44c2ca0df3a9f194eaa5ac409bf60a253
2020-08-26 04:01:41
14
56
ff2fedb61eb0ee7e879654cd354d45119909e6e041306f3fd83788f86b409ea5
2020-08-23 10:15:27
14
57
d08ca2d1ea9fc76403230c5de739baa2e3cfbe7d6ded27a286138cf471844b2b
2020-08-22 18:13:13
13
56
dd09c9e0dc802a42ac343605586c606e16ab49b7d6dde1126649d84e56dadced
2020-08-13 14:36:18
13
57
298cd1d16c3fd359f27dedeb4ed6c80ca85f0e136c87b66043347bfc8d016148
2020-08-01 17:29:09
11
57
4fc54a3efaf3e0648a634850d69928465c5fec4c153a11ab8f0a0450ad92d26b
2020-08-01 17:21:15
11
58
a334f9c1865efdda3eb17a13fff1c138eb8dfbbfc2c7698303b2fa73d5cf0ca8
2020-08-01 17:20:42
13
58
1ceb5131ab0318143f46f8d1d14d531a1c126bd9f77b910e775e02496741d52f
2020-08-01 17:20:12
15
57
29614acb10f5a4f8c73c46de7beb71152610b3dcafc938f3d087c2722e23c92d
2020-07-30 16:26:56
2
59
66753ffd482181e9ca21a5f5ed1d8ad43ffa182552c4774361c6c5e1bcccaeb0
2020-07-26 14:06:16
12
60
2b6a5054b48e8547573cc9128f85a7e586812f30dac908e44ced38f4bfcb2b0f
2020-07-20 13:13:08
11
59
532a7adeed117390d66eca2ef1929a02a6cb92bd20a7836dd3b10b1249361cc8
2020-07-19 14:28:05
12
59
c1f86c5dc9d809dfd2f88654ba3712dca93e467e857dd87eff115241e0834214
2020-07-18 11:10:38
0
59
fdaa7b8ea57f393cb87f5b99a3a5de029dbfb462210b8c53fa794c0e7321c0f7
2020-07-17 10:54:51
12
59
a96f50ac4c7a44004b2b6a6cb7a7180607f75e39305e2e7c7b340cf7302b232c
2020-07-15 16:56:01
5
58
8455d05576c8a080b89b0f1f4fddec17eb3c3652c367923958b45de7f1219049
2020-07-12 23:51:15
3
59
942e27051db16788c0757ba6ddb0ee5a0cbf91d129bad0f89b76ab64a838597b
2020-07-08 18:49:06
3
59
87af209a7abc2cba61aff21360ae6cf57fdfef881c8883d504803d05b703c6f7
2020-07-08 17:48:25
3
59
aceba0d91d058a4863cbab52ac46c467d533573fcdec9233454d2444d4507633
2020-07-05 22:21:20
1
60
490a45243c4b0219874731d79fd14ab4527f2279b27ae39d811cba6f9a1d53ca
2020-07-05 21:40:22
3
58
2873b789f3022f1fe418c2f23546ebefa05548b8e2d678327148f49b17124084
2020-07-05 15:07:23
3
57
e15b7456ad3f7382d265bcb10b9f96044588fb75a13d8941afed0c2a41f6b3ee
2020-07-01 16:48:26
2
59
3ca533b3aa195f4661cd85307804ed44649a98024b7285b885a7c05da5d28e2f
2020-06-25 22:09:01
3
60
aa453fe43e627ec91045c3584a99d95c75592aea50a7113656248489c57addd6
2020-06-22 21:03:26
2
42
dc6d39477ea9fd0fac72065b0f06660b40535eab761d4f6341baa48a7d3b6457
2020-06-20 01:12:18
3
59
7dfe3db1661cbb950e83fcbe0504f5a2913769b75e2893dfb9a9ded4a36c90b3
2020-06-19 21:11:46
3
59
fd32c6a1c7f8c5b333e25b7506856d60f5cb3c11821b77e204772e1d356e8012
2020-06-11 09:27:15
2
58
402542a9a6cfb8c236a2d6808d0d3f234d2ef17c771184ffc45d1ca15b7e9a75
2020-06-09 08:53:20
2
58
e3892d7d2110f4b4c24606b6fd4da5b901c8ab040d7acbf80a34607a9c405bc0
2020-06-09 08:51:50
4
57
fffd2228c2fe152375fa2afb6b8003706494cf2b3a3bfb4ff6c1eee81f368749
2020-06-09 05:25:44
2
58
e3bc8f61a7f66659e361271df025b206855bdd66d6b2655ad573e6992b696c67
2020-06-09 04:07:54
2
57
bb2d078528ec2628be40c2732d7aafeac75a30e7c14eb3e05417a109bad746e4
2020-06-09 04:07:31
2
58
175d75a365b3ea3e7d4f4db8bbfa6555eee0803e19a9a6b070d79e3570dad364
2020-06-09 04:04:11
2
58
d6e12a768a4f3f9cd56332098073423dfd464eb86e991c037bdd47e381998628
2020-06-09 04:01:12
3
59
df81be133c6d20db39f62b67dc884183ef9c788bb7254f0e62928537308afa92
2020-06-06 13:22:57
3
59
d8e5232016d24a8e34f42dd482165b8cd38e3733c8919beedbb3a77e6c02221c
2020-06-05 10:09:58
3
58
8669c2970907a9def9688661d06e38f2c94cb3786f86eff6a7b5d924e6df606f
2020-06-04 08:41:12
6
58
8fa823bd0d08692230ff80bf1f4ec82a0bcd19c3d10ac440d5eb5bc8a560325f
2020-06-04 03:12:49
3
59
1bc4743e5a8c2407d1c87520016841725099e718ee164750407f8e18e364e379
2020-05-30 18:36:22
4
60
b95301f1320c2b4e3a29538bc3158ff3512a2cbf16bc3a3819f502928a9ab551
2020-05-30 11:57:19
3
59
40ebd3a2b93cdf1341d70e625b8ca02c8cbe341a9e06a9934e45ab6a13c8b6b6
2020-05-29 02:19:16
15
59
c85066faab663ab13c9882ff77ee4ce280c2183dce984843ec048e2269dc6570
2020-05-28 18:54:57
5
60
15290f64a552a51e4f452efa6630b10a7b9846aef56d766ebe98ed48770adf76
2020-05-28 10:36:12
3
59
ddd43454d58d96bd99838bfab5dda6254578b20c3ae57f856b31ea294cf033f3
2020-05-28 04:58:03
4
59
fff123e28e12272b4560ba2b1df981fd486a7e5c46ea2bfffaa39c958f7a55d2
2020-05-26 17:34:46
15
58
4ebe11fa85af828cb7dd22b56bec367cb6fbc3ff74c8d7377c8f3fd13eff0bd1
2020-05-22 14:57:43
3
58
a18a604c22e9070d66c860b36c5dfb3d23640e8fa9fb9ea4c8701e48b3037637
2020-05-22 03:57:59
4
59
b9aaff07f193866e0375d35045c98461fafce9d8c25ec684fd9ffc6b9e04378e
2020-05-20 13:53:25
5
59
9c507351402c393b34433d4b1b603be66d5516d7347ce0c1b459ed8608e2b987
2020-05-19 12:37:17
4
60
275d1b57ca944e37523a883e0459db211e78f4db72ae4894149189f80b597750
2020-05-19 09:51:04
5
60
034da908ed1635ff0c474cb96dfa27972837e569836daad02170e9ad5c4cba69
2020-05-18 13:09:01
5
59
486cfa1e3a2c1afcfaf294109cbd6ae3eba85db3c2f8d083261ce4dfe5ab7647
2020-05-18 09:09:12
3
59
300b0272f928e66651b9cd2d027989c5d17897a3397b15c5d4602b9bbd96fa74
2020-05-17 10:09:24
3
60
7f29fc94c84f64ccd73ad8d4fe273c2350df5a5b971b15d9cf9f2889f93c4c02
2020-05-13 15:13:10
5
60
49cfc61fea9ac86a630102c1c26f797e72c04a8eb4a72cd9c6933ab571e6c9ad
2020-05-13 04:12:02
6
59
ef44628e7c28b3d76b7ee52b54b3a632dbea96d0c892d3b8808597318440c517
2020-05-12 10:26:38
2
59
045766170e275756aa4fa2ba0b6aaee33ee586964ad4c8a473c8e8bc1f47f60e
2020-05-09 22:20:00
2
58
ca68e7d6c5db2252e302cf89d1f559c66d73976821c7a8fc1091a5af0b3a79c4
2020-05-09 22:17:32
2
59
de676d4ced27bdb53721db327ec9bbd16d2fd2f0adf026b613ffe148b89a9a37
2020-05-09 00:33:34
2
59
52842ccbf6b65a2b7dcf91169e11853d6c2a942b18ca4fcbbebe9a7c9d578735
2020-05-09 00:30:34
2
59
9abe446470e41c11516774d314ec51e5655ce1c7c5c6c5ad3db6b00ebf8476f2
2020-05-09 00:27:53
2
59
30d7500dc290d328863cecea4f7406405f944cd8cff23bf3dc42c5361739b065
2020-05-08 14:58:52
0
44
48be48f6b78268b7edd4302dd876b3138496d567cc525a48f0061141e790f4d0
2020-05-07 20:28:13
3
59
2a2c8cf113faf4d978ebcf4cc4fe46747423bf2220bc9bb8ecfc8845d26724b0
2020-05-07 18:51:25

Rule Matches per Month (last 24 months)