WEBSHELL_PHP_B64_Decoder_Oct21_1

Rule Info

Description
Detects web shells found in an open directory in October 2021
Tags
['WEBSHELL', 'T1132', 'T1100']
Date
2021-10-14
Required Modules
[]
Rule Hash
b0e5f21fad486a8c6d4c3571b898ce2f
Score
75
Av Ratio
8.27
Name
WEBSHELL_PHP_B64_Decoder_Oct21_1
Author
Florian Roth
Minimum Yara
1.7

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
19
Suspicious (< 10 engines)
98
Clean (0 engines)
21

Rule Matches

Total
Timestamp
Hash
Positives
VT
56
2022-05-20 16:18:54
0afc38bddcc834ec6eddd453c028243b9b0036666cb88e6c7ef64f41b450e34d
1
57
2022-05-20 13:55:19
649d5008b72cee4f52c389c62fe8b51c5013a5b9c00c189f492803424f0a3049
10
57
2022-05-19 10:20:42
756934f30ca23757fc348cbb0080c8846ae6004a509a2be8125851f7f042a9cd
23
58
2022-05-18 04:54:35
e757e36b2db30248a0033cf586d069b914eaf0793a87635c0595799aebb65002
0
59
2022-05-18 02:52:26
ff35af065d96ceed05592c327de85b3b7963d6ca8fa781eb2fdc3af4f75970a9
22
58
2022-05-17 18:34:58
4a8d28a6ae629026d0a8c9f5de26769b4841fe5a5974c62df1a8c11c8ba4c01f
0
58
2022-05-17 17:26:23
d0a1b9c8ee524352d899746bceea0d0eb783716eb7e6bd1968b98cab1d1a4871
1
57
2022-05-17 16:51:54
2f93fa065065b23eb45c40cc151d8bfb995e64bb3e5a4c8e979d8dce3ba99de8
5
57
2022-05-17 09:19:37
c40398e921b51a2e609d856b372bf8559d581ec92a6c9a4ae936fb0a59a4d20b
4
58
2022-05-17 07:34:16
4e9dd4f48159e7d8fd62d77f57d34e73851b3c55fe9d3871008c68219f6c8505
5
58
2022-05-17 07:17:56
3c9b9fbbde880e0a54d9406f0481aa54a02b5fe5c103bc346d5f77faaa51fa69
4
59
2022-05-17 06:22:33
54841504d88f2c177305816e5649cfb59af1852556173935db0d43f25dd59a66
19
59
2022-05-16 21:58:07
b280d64a5cb6bc27e5b4f1e3f9e6598feefefa024244dfc7dab43d566e9df492
12
57
2022-05-16 10:48:29
851fec96ab985c1c38e0c127557e79580fd361ec9293ff18ced96caf354656dd
11
58
2022-05-16 10:14:55
609a3da2e258cf333b54bf696552430cd08857488e7188782510545e01edf063
1
59
2022-05-15 14:11:48
7a0a6b82aa013a34bf7176144a0a72dac59009e5fafcd2e83f737a0ccbabe883
11
57
2022-05-15 13:48:16
b090c68410cd5e7a1a0a6e887f5fbbad35b0f022a29fac78d49d566c3d0998ef
7
57
2022-05-14 11:54:39
fe9f01d26ecdcf8f2cd7189ea700c70f866b8cfb23ccb7b2d7fae7fac901b336
0
59
2022-05-14 11:27:32
890c5a4f3a5015c3b85c90fd98ad666f462a5f88eeca39e271af00ec8122bdb0
11
58
2022-05-13 19:51:54
1a1d0d9789bbd9af13fb1ad45e415f48e1f4d218375359fa02f29de1b8fb58b6
4
56
2022-05-12 17:08:16
9ecb0866b84522eab298c40e610d6387bce5250be55da9ae5310f0158eecec4e
1
58
2022-05-12 17:07:35
f6e2fdaf737dfbcc572c7002a0ad3ef5ffbae6d500438f395478d58371df7e09
0
57
2022-05-12 16:59:27
4b4914ba1440a473f011ed8636f06e19e0552114ce352bb0a8987894a7bd7292
5
59
2022-05-12 16:56:57
753bd771887771c091a73a953ff5dbcd66b231c0d3ff32e727cbd1faee92abc5
10
58
2022-05-09 23:02:14
4627ff99dc04fd93b665298c62afed1ad0e9c46e6a36c14489e7ffc49efdce32
13
57
2022-05-09 22:23:24
783f7ab8e94c605066179ef3ff9403a34b57f46e0b858a4a5670641027c212d0
1
57
2022-05-09 22:15:43
fd8b5ae14a77982e77d2c10d672f34269a46e2f49599029f525c50389610970f
1
57
2022-05-09 21:57:13
120a253ace8a0250b9152f10158b0f07340af2a49d72db6e49a76fe1ee107255
1
58
2022-05-09 21:49:32
9d21fde48cfdbc4c47890d76f64edf211c379ac0cbbc18b2d39be1e6d83ab56c
1
55
2022-05-09 17:26:27
993450fefc0d521123a10868106da5375553863d354e6209dfa70315e497ff9e
9
59
2022-05-09 05:23:52
1e277eda1c55e53a999e80d1f9ec6ff0221c04e9b15c78a2f0ee7921fc3ab737
5
59
2022-05-09 05:18:38
b8c785a85264a2b8611a3585eb82a9955124b4cf9f563e4c4b060c3f7bd9a44c
5
59
2022-05-07 11:34:01
d30694af147d4c72dee9fbe6f8e214e2180fe379f93d029c60a1e664a95444d0
14
59
2022-05-06 08:32:54
a98a5542b419314533377d87615932f55d283119a44001155cadcc4e861cd51a
12
57
2022-05-05 12:15:12
5d8cff1ea9cd58409af0d7f86ca16b150da418791452c809d75ed543359e46cf
5
57
2022-05-05 12:04:23
cb837f9392e7a0ee4075c8a59f0187ea75b48111097d15813a697dbe503287e2
5
58
2022-05-03 17:26:24
001724c14d9405376aec15e8fea5e486903948b7f8fe12d22d42cf6a9376d937
1
58
2022-05-02 15:49:19
61c6b718e774ddadc78660e3176c6799ed7cf8e45e919d0b17ab16644256af37
1
58
2022-05-02 15:42:33
2416238fc41f27098138edecff4085d85606c5ae906505b7ec5f49e1c25922aa
1
58
2022-05-02 15:42:30
1259a5679d2005a94f4589bb9eed6ff1716e8b344d52b64f11f8e8004754496a
1
58
2022-05-02 15:38:59
1032c577add2394d5aee8743983aa64c0cb355311fc415803385bc412021457c
1
58
2022-05-02 15:37:49
ac8415473e3f6d8723ae4f1ebc326d957739b300fe2aef92f7f4004bfa3b9390
1
57
2022-05-02 15:35:29
d0f51313701248f567506f062561d66ca0581544afc093683c4f69172b21d2b6
1
58
2022-05-02 15:35:27
8e5b583f13cccf6babd69b39d942df2d8972a1188e1e12167d9c85adce0cc016
0
58
2022-05-02 15:34:23
2c4b815878faddc0fd08910bd9a8f863d3de0d0e6fb19c758e97232c8c5f9cd6
1
57
2022-05-02 13:15:36
2f25dad491b9a238a151a97c565610c11046e6ad97cf668a3c1b636fe273e07f
1
57
2022-04-30 12:00:08
dca7866fe77706ae880d8f6bbdf3a71b969d2fdde887343a77bea73c97a1ad8a
2
58
2022-04-30 11:50:58
8faeaf92aedd3db39d5969f67f2623db848bc77e308a3cd51307836dcef72bb7
1
58
2022-04-30 11:42:00
7e0b4342e00198628658e687ae10457eeb45fb1c8d8d75c8c7fc8062a278f810
2
58
2022-04-30 11:37:32
ce4b4e8a685337dbb455788ccc6071304324c2bd20125c3b3b3e1b1d192b0544
2
50
2022-04-29 11:46:31
ebf0b9a5dca23aa8ef1292bbab761fe639fbae026e0ea2d162c4ce6514158fd0
0
59
2022-04-27 19:00:04
d781b6222e6a5651d6d68c4d6ca8c2565b5c5541e2563a0a2a1dd30c38f1a27f
6
58
2022-04-27 10:36:49
a6f997a1e3f2fa130e086275d29bf001788fa55bb5d519f4f3e93ce7ec2c1b23
0
58
2022-04-27 10:20:33
855d797cb4835cf6dac495a7d6fd79e46eee1a2bdd54e4028442b006647f9652
1
56
2022-04-25 11:29:27
d39bafed5f63e8e85c4bbcf171e3a7bb4f8542dc4237cd94d0e0ff7c08e5c685
8
58
2022-04-22 06:54:08
6414fa45289e7b28a94042bcb4e36acf2b68cb8d74fb1400af7f23586772d51a
6
58
2022-04-21 11:05:26
1a9950ab74076d94d9df8a0ac49f07732bef44227d6343a5370c0ece87af95d4
7
57
2022-04-21 09:08:58
aaffc42f87e31a2bb9696760a27f9e71eeb9b34ebd76f7f209de2e31cf7bbd85
9
57
2022-04-21 08:44:51
5082b204a231ac70a851dd033bffff23e387f5b5f3ac3b727430eefc05e96d6d
3
58
2022-04-20 11:07:21
22938f4e1768f0b49bfd2cacab0b0f7280334f056812b0139faf56e6a31d93fb
7
57
2022-04-20 11:03:41
140323cf30bc12b467e141ddc83f1cc7b79d3e1dd72669f9814786b23373cc59
5
58
2022-04-19 09:24:55
3ef5243ade30763beed179a365f7676b829a418b7b8dd7a8f92cd9dab0860c85
1
57
2022-04-19 09:07:18
34845a0c043a2d9d33599c57aac37839e0ba09163cccdb03dc8818b8f7ccfb86
3
59
2022-04-19 04:02:44
9a94483a4563228cb698173c1991c7cf90726c2c126a3ce74c66ba226040f760
16
58
2022-04-17 12:58:13
61731d43c1f2c209ae741280a2e547a8329959da7578a7dfed10ec731b2b5dec
1
59
2022-04-17 12:08:40
ba66832e0905b3bbbf0bf9ab81884727d4abc150d101beb9a0d066395fa2801a
9
56
2022-04-13 11:11:21
cfb99ce3c3e55439dc52367f750f7e9d730b4a32e46390b6df45e41ccb2938f6
32
58
2022-04-13 09:22:28
137d3553bfe50d53e0344d66c073f60e120e4e4fe5fe941d84062e731476b941
5
58
2022-04-13 02:28:34
d087876f78e8dd3c7326a91ad5aa0a4588a00586b49bdddb04dc306cf8c167bd
7
58
2022-04-12 12:11:57
e5c2f84d5d990254db1b6999f976461fdb774beec2ccdec8790493a3e6cc1a33
8
57
2022-04-11 10:42:15
66bf02ae56c1b9d4df64ed62a13340cc0d31e3f4d452b2824d3e13e250b2975c
0
56
2022-04-11 06:04:34
ec4a2f7dcde015546fc64f9f37b51be7d2d9e496c22c4a8c6ef106cb54fa380e
6
58
2022-04-09 05:48:10
f1590e61f42c791360016441d10248d3e8fb9ca7318e9262840c466bdc4f4325
9
59
2022-04-07 00:02:41
31d9a1eb600af76c92277dccc032509a0fd420bb161d4f789cf2b584835a400a
11
58
2022-04-03 04:01:31
106f7f2eb95a0f221ec7daa0c89d641ae52ab6d99f40c29e06deee572350e598
6
56
2022-04-01 06:29:15
5979c8631d62a71ac619b9a4d9d290d688699abe1f13ae5c23c2fb9cca2f0be2
0
56
2022-03-31 16:04:47
4da84bbc35c82ba7da4e06bc3404e5680dcb3585218b08f7b6a9733c0a0a3035
9
55
2022-03-24 11:51:56
897faa532987d84f3969706408a7711d6933a052bb76192ff0be8f939e442ed8
0
56
2022-03-23 11:59:42
a0eb138e8efcf2871fc05b65164e5c0c8ce44d4c5b0b513662ba4b9aead485eb
1
55
2022-03-23 10:32:36
a0943172862efbf00f8edd8e7e56405d028e9d030d3e89e42463eb93227291ed
3
56
2022-03-23 08:58:09
34b2d15c28a28f64ef38665e7f24e5111ee7afdb087d26dc97a81b2d5fc46063
1
57
2022-03-21 15:52:57
a30731047c889556772ff22400b2e1efe58b574f8b0030f1827ba93efe5775a1
8
55
2022-03-14 05:46:08
0d86533d342f636d78bdc4b4838d3a22122c5a8a0bf7d1274e1a228d1ea74386
2
57
2022-03-07 07:55:33
d6b822b939659de4d5fa590b0e9f2fc907da7b389ea0f5361946d3fe281a0e06
9
55
2022-03-07 07:46:37
cd65989ae94e2543b4e8bd93aa6ea246e776da7777bda455ef7ca476c2398017
0
56
2022-03-07 06:04:00
c72ec45f8bc7c6b120cc318a503032e23fb15d318650d5f13f179656ade0ec4c
1
56
2022-03-04 09:21:11
83884df45fa8554be490f8a3cdbb8cbb9f6e12f68ca82f6b66373c5f30a50881
0
58
2022-03-02 05:13:43
242c9df0fc23640ff0513ec80439b07d11dc04818b82973d5f28e79409ac15a6
0
56
2022-03-02 05:12:41
bf5c174a6bfd064c42beaca61b7fdcd14af209d4463ac7c2ad67f4b87ca80bbd
0
40
2022-03-02 05:10:35
a23fa08b1604df52ba9c1142d1244ee960779f64b1192c9fba3e9f9a3b35cf88
0
58
2022-03-02 05:07:21
337d33e3ecb468a6e0f6b4602765631aa2a6c5a4103a28b4464ec440ccba52ef
1
58
2022-03-02 05:06:16
a373598a87ffd78650a7c6714d4e28c3a74a0f8c041ba47e784de072c57b84ba
1
57
2022-03-02 05:06:13
65cd5ef32ec28b3d94b40b4a585d8fb0333b17e3219a7e95b4507a39fbca382a
1
58
2022-03-02 05:05:06
3788e78dc3da4d41f37a181ebd8fd7a281071457cad8e54658bf4671d41e077a
1
58
2022-03-02 05:03:50
e6f813ff481ef194d8c2c08f34bc301dbe5f143f0755b0048f849e718ae96127
1
58
2022-03-02 05:02:40
82e2b260a98a4cf9558810a520875e6739b0b55a714292cfbe7dd545df929901
1
57
2022-03-02 04:12:29
b8dc115d19eb51c504dca5235230f06c3258f22c204df9108f764d1084bcc280
0
58
2022-03-02 04:11:14
b01d09094fcf59db783b9a6c4a22594213ba3550271add27b3b5da846888a698
0
58
2022-03-01 13:17:18
3820edd504d533629ef2ecb4a66520cb66629a12c96f239e1f2f90ad8610cf4b
7
66
2022-02-28 12:00:41
a8c9ba471f8ea9ea6eec539b1735c491379e8a80037e29a5e7f460bcce05a428
18
58
2022-02-24 04:41:23
d78122e42dd3082ca8c8d05dee8a55519a613f29d2c885108dcb1d49ad6439ea
3
58
2022-02-12 02:08:13
14846a748e0c20d4e98108de303f2bb607b2baabd633370b8c30f584b2ca25be
0
58
2022-02-11 08:32:04
f4c099fe535d006fdc07e417a125f3b8e548661244a8f1fdb59142b2ec0db353
3
56
2022-02-05 00:21:22
3cf81eba189cdedde93a9f4fbbb85bed58dbfade1bc7a81656c205957a7de677
14
57
2022-02-02 12:56:02
e4b93be913af2aa0f3b51781953973362149409070c2acfc8d57f304a9fefbe6
3
57
2022-02-02 12:55:59
d886c03aec8dd5777103f80316d361f9b9289292eaed0b5a3f22ca11b6fe7968
1
57
2022-01-31 18:30:38
dcd0dc371da17ce6f0712f23b732696ecdf5b34fdfec0045ecf8ce7422d5fd8f
2
55
2022-01-25 02:57:59
60155b4e1d34685fee04bfbac0ac180b91f41f0926ec7172eced83ef339ead3c
2
56
2022-01-25 02:21:49
e50d3d97ad09d8a5b4f72b51855ea5e0d7520f2e776e38732a8f47f221583904
9
55
2022-01-23 09:19:18
90b75274aee9ff0bcfe95689047ce2d6f80d17dd188c8a1004ccdd4c72d80edc
10
55
2022-01-22 05:45:05
abe047099702b14691fd21c5a44eeb5383843ad19a2bda1e11d487e5de989fcc
8
51
2022-01-19 09:49:11
6b39e99c9f1b2fdd94a0700240582bb831f416355dbe9ccc06d1cbc3bcdd0863
6
58
2022-01-19 07:59:17
09e2b9e7d5a2905fef70f826214c86dcd7b88f09168dac12486c55cfefe0175a
5
57
2022-01-17 03:14:39
466b264d1ced24a18fd45cbbe346e1f01997c5fdd020f56d8f3b941b592b5c7c
6
56
2022-01-16 04:35:59
abdba9b14c66143a9bb7f90815bbc3f314505b3f1f257b01091249520da03f46
2
55
2022-01-13 15:55:01
3977f867133ce07ecada91ce3bebfdd92da205db710084c6961a552a50bb6c44
6
57
2022-01-07 04:31:47
5e440b51b8cd94889c0dda95490839258f75ab739957d8373d5ede189650d86d
0
56
2021-12-28 03:45:32
cd128d90dc1871b47ba0f59734cc362c8649653169b73324b588fd6505f13844
4
50
2021-12-24 17:10:54
9d046ceed720471c4491fe86a88c75e9c155333d77d84540a8e03a851cf08ac2
5
58
2021-12-23 04:33:17
4b89babc69d1d401c1fea97d1a2a7ceb16cf3b3f855181cdde0025154642e94b
8
56
2021-12-21 11:07:07
4854a308d50975d533fbe2c8a5cb4903e7140a6ca2ae7ea381e32a325120f4dd
2
58
2021-12-21 11:06:11
fb37e81e022dfb70b314acdc6615bd4e14843c3c9e8309e5b84e3923503de43f
7
58
2021-12-21 10:44:24
3f14c8b32a74d472e6b6a84eba04d5aacbffe49505c8c44efcea7faeae1e355e
3
57
2021-12-20 03:54:09
6441a998fcaa74b9521f2b722c129cf82bd4e5702a9a66fe795fd58a5746e9e3
8
57
2021-12-16 10:58:19
35c60cdb618699a92ada861b493ab98ca47aa56ced1a197cd9289fa70c2ea520
0
56
2021-12-08 11:54:55
f778b2636b0874a1dd1974386c4bd57ba4314ab9fd3a25ecf1f5cd527e6a7bc0
0
57
2021-12-08 09:32:42
5af4788d1a61009361b37e8db65deecbfea595ef99c3cf920d33d9165b794972
7
56
2021-11-30 08:52:41
d411bbf7116a6047ee3d7b7e191ef4b30857d2cffd454158c84b1fa8c9b5e96a
3
54
2021-11-29 06:08:31
f15cc41c3ed95a868eabe758dacbe49fed71f33fc135ff1ed1ca136abb52c0e1
1
57
2021-11-27 08:59:04
ad417a6582b48941dbe5b84d3c540806a3f0d303e821abf10a628530949aa8a1
4
57
2021-11-26 06:26:01
88ce120544e90240c383272d46b43ead6a602ac45357b6cbf9c969d4e0e62760
10
56
2021-11-11 07:56:14
6bb35eb4750796afe3cd1d94929db67a826b8c99c39b155f4dcc6813a7c7987a
9
57
2021-10-21 05:47:41
4e289b2fafd29e62154a6901b92a56802cc4286edfe2d32877f764c92039369b
7
57
2021-10-20 16:09:09
2309aee5d6244b80e7b1f98d62c87d68e97e0acaf233688af07b6a8439f85b7d
2
57
2021-10-20 10:31:45
a702fc88c03195c6289bdd33306f75831c97556c2749f3a102e50c98460f4c84
1
55
2021-10-20 10:30:39
32f289b2abc6304dabf49f73f8c5b97c22cef10be3e4901a6bd2c04ad98bf6d9
6
57
2021-10-20 09:14:59
a9b1d358b072c89b85d9d83f024233afcb32a226fa25ce0c10828db705a10dcf
1
56
2021-10-16 11:27:50
4f050e27f770c59e8402d0faed061d0492b1d50d5aaed4f8c548b823dfa2dd09
2

Rule Matches per Month (last 24 months)