WEBSHELL_PHP_POST_CommandReplace_Gen_Oct20

Rule Info

Tags
['WEBSHELL', 'GEN', 'T1136', 'T1100']
Rule Hash
ce6a120de8418120f2c2e2d06f9a6c67
Av Ratio
39.74
Minimum Yara
2.2.0
Score
70
Author
Florian Roth
Description
Detects small webshell
Name
WEBSHELL_PHP_POST_CommandReplace_Gen_Oct20
Date
2020-10-17
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
49
Suspicious (< 10 engines)
13
Clean (0 engines)
0

Rule Matches

Positives
Total
Hash
Timestamp
VT
14
60
f41184b090eafd96fa9c112004518681e450ce0502f4c98fe6751f29a2002246
2021-01-21 07:57:49
26
60
4d87597e85209ef1fcbdc81750b2f41b796ae4fd1985f8158d837802c1c7abb0
2021-01-21 05:31:18
36
60
72de6c18d67e03a56a28155bc95995d2792ee7470f857d099f7e1e66c03df68a
2021-01-14 18:54:52
30
59
64bbe14aa82169e58f1076aff3a7bf94f3aae19ebefdedd5a61121383babb2f2
2021-01-14 10:53:08
17
61
8e2cb5f6fa6e53293401c4cf9c31cdf7798ab3dc9e165515bb0b547e7ac7d42c
2021-01-12 02:55:27
28
60
5093f860d9a52300c35e555e40ee801df39224dd24f03ed9d1ddda64f9d63599
2021-01-11 01:37:48
1
59
ce739d65c31b3c7ea94357a38f7bd0dc264da052d4fd93a1eabb257f6e3a97a6
2021-01-11 00:58:25
24
60
d62c2b2660800e74977ac69b01c0961b9c51fb84d666e1f041b500ab967c0975
2021-01-10 19:36:28
25
56
7c90cef46acd1d7dad40ea87be9746bf8bddc824ae691437f55018e51f5856c9
2021-01-08 21:23:18
28
61
3590cd9987bb1331134b318d6b4b9274d3f91a122ee9994886ef9f3afb6e9cbf
2021-01-08 19:14:57
40
60
e1a40136a67125bd79421aa819115c448d816a8ea1ac386ee9b3f990c556901a
2021-01-05 05:03:45
39
60
77dc5a161be40ee3e920167806f16df0ddbcfa115de86d5d8e525ab0e1f48868
2021-01-01 23:24:41
27
60
3e2f96a70251272b9ca4ba883cab6cb739336667529696c35830d60080427552
2021-01-01 20:40:58
13
60
20f1e0ef5630dff278b22581336765836640843913cf8398f6124a1689d40070
2021-01-01 03:23:11
26
60
b8bb2c47c4205b3c63f230b4c058cec1891557e71744e8a6401bd0196686cab6
2020-12-31 05:09:33
32
58
cdaea9dea9ce36ecc9f921299ee7f02651360278bffc7e9f23a242fd74dd1b1b
2020-12-30 06:10:35
26
53
5e700ae90d870f3feb2bf3b5de0ff705ca86572eb148d5255f280cbeaf8d8ed3
2020-12-30 05:07:04
20
60
6a08f7889985c93e3094202e8c0ad8385e6ff7870473640a2687a97473e254c6
2020-12-30 05:01:24
27
60
7590e048acddb50df02780be7d7dd981105166355a2a01ebd90164488ef992db
2020-12-30 04:52:07
26
59
c9bc71bc948d953d5d74c6d95e59ca50c2e94264823f4d85b6ec72f29fbc5675
2020-12-27 19:26:18
29
60
aa9a1f0d9dff125ca781fce5a5f92cb2e869109805f2c2aeae6bbf67bfcc7024
2020-12-27 06:47:11
29
59
61b736cd9b63a488fa9fde56d2085a93d7b228d1148c180603f3917a3bbe6f60
2020-12-24 08:31:53
40
59
8e0935948dac8865b0382a61346b2663d94e5ce6893720f84c0e3f8a41c8a444
2020-12-23 17:19:46
37
59
723278ad8369493c44ca8319bc6ebd2997aebad367e5d474c635a94d005c4343
2020-12-18 07:27:39
34
60
ff3821a7d66f02ae5e6b8598b3c23abffad47b5cee05ca1418ccc8626cd6144f
2020-12-17 06:04:41
27
59
3802e07c150b55ffa6fdd7a2fda49e1415316e10dca94aa81b7eab504e10f749
2020-12-14 11:58:12
5
49
71f7297aac12f888db16958827879c42330fe7082d471e241e8623f0dfa55593
2020-12-14 06:40:29
31
60
b4cddb088957f313a1effed5d4bfef44ce8ee6a9999f8eca4f325925497472c4
2020-12-11 20:41:28
26
59
254764244dfcac29bfefa2707b6384e7618dd2027715e6e48b10bf7ee4ae13ee
2020-12-11 15:56:59
27
60
c114cfb295d0d7addf7732d84bdf6de3630d3fbbad2f951aa782a7556c95151b
2020-12-10 19:34:22
17
60
21c2b89f5587a909ea089257ee4bc540cdf07f93a4373fa5a4da41cdd41a18e0
2020-12-10 00:16:56
27
60
37f8a0532fa2e352962b088cb0eb5dd9c7d6fc19870e0dfb896cf0e4be17429a
2020-12-10 00:15:31
5
58
8bb2d0e3fa36c3f48233a5b5568c2cb558beccbbfb532816a206dcccb3f4ca12
2020-12-08 04:34:48
22
60
af45994a35365c00c4c048fea854258a0f0bc9632341ef8888c988c3bf58c6ea
2020-12-06 22:19:01
33
59
2f708d67731902beb471890c1f5503fee0a2be7285a1601507d04351b5225abd
2020-12-05 23:11:00
18
59
4b44b5e0ccb52974ceb0738aaa05e5b2b2520dfad11b42433b02bfa5dd9720d5
2020-12-03 22:16:32
23
60
29e513c800904ca38d625770e78343ab18ab2f238fbe4b3df2aab4ef4c0b428f
2020-12-02 00:19:50
29
59
3c2b0c4faa78e9bb53b0f492a877f57f49227fe47417d857bced55035634e03c
2020-11-30 16:53:23
36
60
550bd4f6e189ed625763360b926625492ff73e5025fc0949d94bd57eec091ffa
2020-11-25 07:33:55
9
60
8e67a80a07a9bc97928def7c73f4c0ff728eb120288891a0749156b60f8fd8ba
2020-11-25 00:25:53
8
60
d52c449337c70f18203c34d9b057100c1859d9cc547d764ac083c0ad53bed6db
2020-11-24 23:52:13
8
60
86280a95defded50423f3944a0de05e3c52616b2526d5076c587a94fae21aa8b
2020-11-24 22:56:07
8
60
0bf7b0aa5eb8ee0bcfaa7d990b544dec229f29f8bed758bc0ba25ee518e40a65
2020-11-24 22:55:19
8
60
1c98287e16b8775423800cd1a804d277243fc06f8d724c952c1632b6e94f271f
2020-11-24 21:54:36
9
60
cf91b6fc2270d29a412d746d92667ce10d89ac6134a9172f44fa10948a19912b
2020-11-24 20:43:35
10
60
eab573e53691d996926abd727c607210ff0b12df738a5eca05b7ca33f0a27a09
2020-11-24 19:25:22
8
60
e62e3805737fa029d04448b279527f5c384c4deaacc82651a121dafe34c89b17
2020-11-24 18:54:44
8
60
b4a94af567cd067e9fa2bf84bc0504728472278e38416df53df50b05eff31dfc
2020-11-24 18:18:56
24
59
e0ffbd095ab47f8efc199be8c6750cbbd428fea248f22df5c7dfaf47c2d3fa9d
2020-11-19 21:38:53
41
60
4e78b5830804661723026e75a50e30462b486e6185797644aca2084cdb243232
2020-11-17 17:54:15
36
60
7f0a8979ae547786c91485d496f2f7b9ca99cbdf865ab5ffe5cc4f9ed65f3237
2020-11-17 13:22:17
23
61
22452c3ae279b3615dd80d337f179e1c1e72a99da30151d4e783f96de1982944
2020-11-17 04:38:10
26
56
30e4325c74353dc97bfa74e659a492ee05365955823bdf1ac3231bec92640391
2020-11-15 15:16:49
27
59
c8545b6e6e78ba3050b686c8e2abf70ce864b763b4e40adffbf6ded4a7306cde
2020-11-14 17:41:51
35
61
d20f5955e9f4e5ef7e010ae9ec5915e4ac8ce71ad4455d8f4f9783d46e908fc7
2020-11-14 16:07:52
40
61
43f42fd2beece912f63569d7aa55bd14b6bd7bfc49aa0a3d9d6806dc6753d1df
2020-11-10 22:38:49
40
60
ba05502c07ab7ec8e15b00edde794691d52d31f45885b9a3d3ba4442b1b3075c
2020-11-10 09:27:50
15
60
728570b5ed4ddd0ffacd6e52af82fdc672fab5ef592cc1ded76b4f03fc22126c
2020-11-08 17:40:27
5
59
9e2a2a5e257f9d53c6fd834ffd8001b6e5af5e74ef22ffd20aea865278767d44
2020-11-06 13:01:40
9
61
66b5a9f346db588d2fa5f9c2cad70d392e8dc8db1690a70c35a0174a728d0a57
2020-11-06 12:00:01
40
61
026f3a13956d00bd1714786222d94f86c7a444763bfde13ed018f751276d8af6
2020-11-05 08:47:57
29
60
42d1ac86f9391d36a8d02955f1bf430b7220833472c37edbfb0b119331ca6145
2020-10-26 11:41:44

Rule Matches per Month (last 24 months)