Essential information

Value / Name

7d5f59ae3cfcb744572ab2242e3da49640113aaf

Confidence

100/100

Revoked

Yes

Valid from

08/06/2023 00:41

Valid until

10/09/2024 00:41

Pattern type

yara

Published

20/12/2025 19:40

Modified

21/12/2025 00:50

Author / Source

AlienVault

Description

Pattern

rule M_Webshell_LEMURLOOT_1 {   
      
   			  meta:   
      
   			    disclaimer = "This rule is meant for hunting and is not tested to run in a production environment"   
      
   			    description = "Detects the LEMURLOOT ASP.NET scripts"   
      
   			    md5 = "b69e23cd45c8ac71652737ef44e15a34"   
      
   			    sample = "cf23ea0d63b4c4c348865cefd70c35727ea8c82ba86d56635e488d816e60ea45x"   
      
   			    date = "2023/06/01"   
      
   			    version = "1"   
      
   			  strings:   
      
   			    $head = "<%@ Page"   
      
   			    $s1 = "X-siLock-Comment"   
      
   			    $s2 = "X-siLock-Step"   
      
   			    $s3 = "Health Check Service"   
      
   			    $s4 = /pass, \"[a-z0-9]{8}-[a-z0-9]{4}/   
      
   			    $s5 = "attachment;filename={0}"   
      
   			  condition:   
      
   			    filesize > 5KB and filesize < 10KB and   
      
   			    (   
      
   			      ($head in (0..50) and 2 of ($s*)) or   
      
   			      (3 of ($s*))   
      
   			    )   
      
   			}

Labels / Tags

Labels: azure sql cl0p cobalt strike cryptomix moveit transfer powershell ransomware sdbot sql injection tinymet truebot vulnerability

Marking (TLP)

TLP:CLEAR