Essential information

Value / Name

4cdb028d15f10fa6b37db1c90e2a1bda1797919d

Confidence

100/100

Revoked

Yes

Valid from

08/06/2023 00:41

Valid until

10/09/2024 00:41

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 00:50

Author / Source

AlienVault

Description

Pattern

rule M_Webshell_LEMURLOOT_DLL_1 {   
      
   			  meta:   
      
   			    disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"   
      
   			    description = "Detects the compiled DLLs generated from human2.aspx LEMURLOOT payloads."   
      
   			    sample = "c58c2c2ea608c83fad9326055a8271d47d8246dc9cb401e420c0971c67e19cbf"   
      
   			    date = "2023/06/01"   
      
   			    version = "1"   
      
   			  strings:   
      
   			    $net = "ASP.NET"   
      
   			    $human = "Create_ASP_human2_aspx"   
      
   			    $s1 = "X-siLock-Comment" wide   
      
   			    $s2 = "X-siLock-Step3" wide   
      
   			    $s3 = "X-siLock-Step2" wide   
      
   			    $s4 = "Health Check Service" wide   
      
   			    $s5 = "attachment; filename={0}" wide   
      
   			  condition:   
      
   			    uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and   
      
   			    filesize < 15KB and   
      
   			    $net and   
      
   			    (   
      
   			      ($human and 2 of ($s*)) or   
      
   			      (3 of ($s*))   
      
   			    )   
      
   			}

Labels / Tags

Labels: azure sql cl0p cobalt strike cryptomix moveit transfer powershell ransomware sdbot sql injection tinymet truebot vulnerability

Marking (TLP)

TLP:CLEAR