WEBSHELL_PHP_Obfuscation_Functions_Sep21

Rule Info

Required Modules
[]
Date
2021-09-13
Reference
Internal Research
Rule Hash
7b5c7de550171b2d9ccd4bc6edf9c734
Name
WEBSHELL_PHP_Obfuscation_Functions_Sep21
Author
Tobias Michalski
Tags
['T1027', 'WEBSHELL', 'OBFUS', 'T1100']
Minimum Yara
1.7
Score
70
Av Ratio
13.95
Description
Detects suspicious use of functions often used in obfuscated webshells

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
25
Suspicious (< 10 engines)
51
Clean (0 engines)
9

Rule Matches

Timestamp
Total
Positives
Hash
VT
2021-10-21 15:37:56
56
9
9df2770966e7002c0bdf1cbc60bb63fc0ee9e4b27a207a43114d955c59c3377d
2021-10-21 05:17:03
55
4
fa2fb0c9aa176ce1c046e719464070acb445c6420c5d6019f6879f9556da3616
2021-10-21 01:54:04
57
3
ea98368f6ecb5281654a6a9e4c649ef9b53860f1ee32340145b61e0e42e1072a
2021-10-21 01:51:59
55
2
1a3f2936b31fcab8372203b8dede10457e33da9899443460741c1c0ee4aa8a68
2021-10-20 23:19:53
59
22
fc2af02bc420b2641a1fc7aceda54713674db6b6494aa4872753eeca3887b32d
2021-10-20 19:29:19
58
21
4dce681bec9a8fc9e52d2234311fddae8e5e0e7b04b7af960f0309be7ed00ec4
2021-10-20 19:17:39
58
12
dc3972d86bfac67eb0560293499ecfc89f0b4236a6e83ab6611ca3efbc60f53a
2021-10-20 15:07:46
58
37
22b83d852592ca59057ef7ea4fb01ace13bdcfbe249d94d8a0918e66293e2d28
2021-10-20 11:13:21
58
16
6abf72f1261048fd0fea25cfdb2a4055beb911c18dd1127f8d16901c8e43b4a3
2021-10-20 10:41:57
56
4
8b7c731bf78f3cf4972a8197d3ae0d4b27041e4b52ff7e6451b826e2a77fb06f
2021-10-20 10:24:13
58
11
63cabf6844277205b8b75233493f4f990d2f0de660fcc0d619e663b5a27b5a32
2021-10-20 10:20:56
58
12
5101d953a3ca7711be1964b92384ea226754c03261f7f13139bdea851e2169e4
2021-10-20 10:19:28
58
19
dc9355a86b9ce16010934384d12e1721217b770aff0f8ee36d2b546d6063fd96
2021-10-20 09:58:18
57
25
f42662aa9fb2d7cb0c9a73d21efff24dbe1051497795776c9a37f47f978fc57f
2021-10-20 09:57:12
58
8
4c01e0da191b86b7849ae074d5f2c51e4cdc59e6a3ec865cc6f62dcf80ec735c
2021-10-20 09:56:02
57
9
01e8bb811c47334c4c0e1132eb190f95d9d8dd0486ee8c0fe382fe8f0de91f88
2021-10-20 09:52:55
57
26
e5070304bef6b8bf8f4b2347a956379f5d4834e9e4e927ba6a05c6dd5b4ac3af
2021-10-20 09:16:05
57
3
41bc864c8a3b902386276da9f626d7769aed3fa89fe8517fef1f4b01e24cd80f
2021-10-20 09:14:54
58
12
05e44cb354717131ec828a5f536743da7ef19e3baec2f3fbe9a9099f1b4eb737
2021-10-20 04:46:49
56
1
60b3bddc6f875d37bc09a46af3d307057599b9b66d57cf5578b878efdf4be115
2021-10-20 04:42:39
57
2
1e39c0000705a61c29815d2cc8ee156d979543b5e8d7352f04e081eec9c7677c
2021-10-18 20:37:10
56
1
ae95ecdc1e179fa07ee1b5c2102478cb5b3b26b7f62ac85c44803703efa719b0
2021-10-18 16:23:43
56
3
a0d94b2fdeb1691f492755d57d2d29ef2d0c0b639ccac6f5d4fb13c914e0b071
2021-10-18 09:24:48
57
19
9507cfcb16c1a7f91c2ec0b93393615e85fb7834c10c58c2f351f0c69bdee285
2021-10-18 09:23:44
57
23
f2345b6b6877b9b470c7964d0aa364a904b6ea35f4363d22c20ea8b6577811ff
2021-10-16 13:17:06
56
3
cd3132eccb14b5e9ef0e56a87a012c199a98a0bc9e392a2321d59801bbc354c2
2021-10-16 11:26:31
58
14
3ad4341ab1ad38724831c8143113cddf5311f1f8088750c98f782da6269d9f90
2021-10-16 11:21:52
58
28
dd2f6af1e551552c54b117cc09b3f9ba78170e9c1e9c0225c4888d378268c8b2
2021-10-16 11:18:14
55
4
a3932624c84e641510b97e083bd64b29f592218b421f47c284ad38469b94805a
2021-10-16 07:58:04
65
29
a130f67d17b3f65a9da86137774e3aac2b5e8faaa7db912ab4c711e9ec5928d0
2021-10-15 18:04:46
56
0
1edbc3240ec82775decf1d1bb4d5381a7a72a2dcba56fd9f2f8b18ffe5412d85
2021-10-15 10:55:18
56
0
c8731cdf64f737c6aaad4edc6527b1c1ea9d100922a0ad17b288ec9d0946f4cc
2021-10-13 10:52:06
58
8
e3bfefd54a6f6425585088ac8a292cadee49f3d911c8515d4549536a09fcdca3
2021-10-13 10:49:40
58
9
5bafcd2ba8614a189c8774d3ea424c8452dc4c7ecc997e803bcd6ac63bdf22c2
2021-10-13 00:38:01
57
2
9471aacd7f30ea9cd2e14cfd9a581983316602dbd99b106a517fe0bf93f225df
2021-10-12 21:07:04
57
6
fde1e121beb58f8e21b565201ed2a858ed15b1991065c5a4577ea84d3fdd78b9
2021-10-12 17:44:15
57
1
654c4a51f8caa0535b04c692114f2f096a4b6b87bd6f9e1bcce216a2158b518d
2021-10-11 09:58:03
58
1
82b68bcb0f781b7e47179e87913fc499cf07ee1f988887025810c2166a2a78a6
2021-10-11 09:58:02
54
0
15e90b7d6c9d9e09e62e9dd624b90df84d13f23b06a188b1787017586debee7c
2021-10-11 09:58:02
57
1
b6f39348f7fb12a972b10ec2cdcdc6dec6329915afcecc1a18a57edf88bbf205
2021-10-11 09:58:02
57
1
437bb2a874d5826e88a0aa2e6ecabbcf45d298a53cec14bb6907a146e1905af0
2021-10-10 16:47:06
68
37
e5b97287cdd5214d66465d85015a6f80e7033348c9c4f074420310a97e95f73a
2021-10-10 15:42:44
48
0
20bb11bd09f29136607145a7e538e29b0d950acccf13f6c600378d370a1714f9
2021-10-09 13:25:38
56
0
bb139a09dfd1de35d9344ee1d3b9900db00de672716ec591ebbef84dae225ef4
2021-10-08 21:27:00
57
2
2c34c704a8d923b32b18491f32d03a39f732594c3109d812e8793873bf26d87d
2021-10-07 10:15:41
56
0
73a23084e362d82f3a767409b5767bbe9b2de39010e7019b89dea8ffb4dba0fb
2021-10-04 18:51:40
57
2
c871619ca0d5f4b6f95b838daf1233e65411cb3d9cdc28749742427ea53dba72
2021-10-04 12:03:18
57
1
0ccac59d1591a99287c15fc0b110c887be45125f4c27c83c277ce85230319e3e
2021-10-04 11:56:47
57
15
dfd388275c915668e9ac8e63e1e34e183f5deca14b49d89393e7bd50e4b7404d
2021-10-03 20:28:31
58
13
4ca4c71f6328262e397a62498c90c8a0a4b371b6e80951791d342cc8adb385d4
2021-10-03 14:33:49
57
5
449963f57a7ae394c82c377d5a438d265d914f2c145b37c3a587c64d1dcda771
2021-10-03 12:56:41
57
2
7aca6154cbef7af4de2170336d763269a05751bc09995681b1f0dee19c564e60
2021-10-02 18:29:18
57
0
ddb1dc9951ff2bb295ec8f604231b0a0cb346bc044fbf9fa222d8dbda1e0a293
2021-10-02 18:29:16
57
1
f08a509bdbd2b05d73d4b244a77cba1a2bf7d1b03218eadae9566abca6a2a8be
2021-10-02 18:29:16
57
0
a17de6a184d51dd9da1b3fd327f0fea035dde3855ae8e853bf1b86b0315e32bf
2021-10-02 01:34:07
52
9
4b1c0099dde841d63f0077d0659b92082cd7abc96461f787a66326a43853604b
2021-10-02 01:34:07
56
9
d546eeb8548a1ce77d4369e79d8de0cc23f642aaf0dac6966227155aff8a793a
2021-10-01 20:39:31
57
0
dcafd18da231e6530fc1cd2ef29cc7c74e93d24e6938db5db6bde34eb3db532c
2021-09-30 09:23:10
57
2
2ba424cda9da33c76372880f6860bd2bdbd089a47a521530c14d713768338f19
2021-09-29 22:47:13
57
2
7057711a6df3373d83e17b08179843d697a76036cfa4d1e642630b22c57d820f
2021-09-29 15:36:09
58
8
9d3fdc28485f5bad58561db8682e8b1863489e5ffac6f69801c2dfc4be861673
2021-09-29 15:29:30
67
40
7ddaf85cdc37a28a7a1537a9f46978b81af056e89584615d025992d1be1086c1
2021-09-29 15:16:21
58
12
a954055bbce7548cc1a815a2291a89812a9061cd5a3596421e0e38683283e190
2021-09-29 15:15:16
58
12
2ecd96faa347192d61c2be6b5967616024caa0adff6fafca1e39b80a0cd55483
2021-09-29 15:09:31
57
5
f9abaaf38916bad2ff551beef8fed29823a9c32baee155df300f7a8b759441f7
2021-09-28 21:12:54
57
2
a0b364f9e648ad57a6e37633c612d78c50b795cae81aca7708bd6c08032e035d
2021-09-28 21:10:48
57
2
cb7832d3f19f95733ca643cb2b5718e0d386f89547ab6dcbd4209439491aec41
2021-09-28 21:08:41
57
2
4a4be857a9af1ddfb8e374da1de1ec34a864f901050d488ec1752065b9a8eab8
2021-09-28 08:00:00
56
2
e5233ffc6a362dfaf924f19a37edd207f898b65d3ace117bd6e4f8029bbabf51
2021-09-28 04:23:19
66
6
dffbe6821a4f87fc968620d33425adadb8b9440e45ec86c01e5f9102becaa755
2021-09-28 03:53:05
57
24
6c01747aaa995795d76125b0a2a961081bcbffd86288f305188aff0855448811
2021-09-27 14:44:23
57
1
cff6f15f79caec934dc7e8b0926544ad7cf38d217529bd61f7b6611990c6575d
2021-09-27 14:44:23
57
1
2cb7ad0338d2d368e8fb331359d5bf9294d34a460b9d65d2265ae74334ca5648
2021-09-27 14:44:22
57
1
f83d820d6701a941c504c493023fce571ada5891656868e828ef37a525f93c56
2021-09-27 13:17:20
57
2
1b7f254d6c65b9deadbd7a6bf26317da55038e12fdcacdaadf9c7941c97d31fd
2021-09-27 11:32:20
57
4
c053431feb2c950ab33e6fa1a2f0afed4d75891f242abafcfba2f62343ef78cf
2021-09-27 06:29:04
57
1
aa62aa78c0c838b7a6e2fc7c2f55ddf8d6fc99890cb4e6cb8a3572778df3fdd2
2021-09-27 06:06:49
57
14
cc58830a26a95a56f5bcbf9cf6a5ee2210574e7a46b5c4a95e0445c20cb8f563
2021-09-26 22:52:48
57
2
e3e97c57c75b02cf9f0898ea97f1d76e62d4814f9497dbbdf5b55a91ee402222
2021-09-26 00:19:13
57
2
1213d6203b7d0c649172b57039cd385f25079f5eef1a4ff8b937f504519401d1
2021-09-25 23:58:29
56
1
d3cb96716e60082c1897e015c965918abf992910ba50856a9374d47800172fc4
2021-09-25 19:41:35
58
2
9baeea556439ab1b9e3c6b03659f15c1d5339155751048734eccb4e1a9c8c49e
2021-09-25 19:41:33
58
1
a4ce46803b80ae03c3d4d34740b6178dbafc26df0d951500d9d495a58134fff4
2021-09-24 05:00:56
67
37
d6d8cb11adb1bc2e1e5e2cd09faaccc988766da485d3f4905d007bc669f9bafd
2021-09-23 09:44:32
57
6
3082918d01f778a6b75039461e6a9e16d04c2d24b77c6d97d7b2e102a98d2387

Rule Matches per Month (last 24 months)