Overview
overview
6Static
static
1corerulese...20.vbs
windows10-2004-x64
5corerulese...20.vbs
windows11-ltsc_2024-x64
5corerulese...60.vbs
windows10-2004-x64
5corerulese...60.vbs
windows11-ltsc_2024-x64
5corerulese...100.js
windows10-2004-x64
3corerulese...100.js
windows11-ltsc_2024-x64
3corerulese...390.js
windows10-2004-x64
3corerulese...390.js
windows11-ltsc_2024-x64
3corerulese...90.vbs
windows10-2004-x64
5corerulese...90.vbs
windows11-ltsc_2024-x64
5corerulese...100.js
windows10-2004-x64
3corerulese...100.js
windows11-ltsc_2024-x64
3corerulese...l1.ps1
windows10-2004-x64
6corerulese...l1.ps1
windows11-ltsc_2024-x64
6corerulese...ts.vbs
windows10-2004-x64
5corerulese...ts.vbs
windows11-ltsc_2024-x64
5corerulese...NS.ps1
windows10-2004-x64
6corerulese...NS.ps1
windows11-ltsc_2024-x64
6corerulese...RIC.js
windows10-2004-x64
3corerulese...RIC.js
windows11-ltsc_2024-x64
3corerulese...XSS.js
windows10-2004-x64
3corerulese...XSS.js
windows11-ltsc_2024-x64
3corerulese...LI.ps1
windows10-2004-x64
6corerulese...LI.ps1
windows11-ltsc_2024-x64
6corerulese...ns.vbs
windows10-2004-x64
5corerulese...ns.vbs
windows11-ltsc_2024-x64
5corerulese...ds.ps1
windows10-2004-x64
6corerulese...ds.ps1
windows11-ltsc_2024-x64
6corerulese...sts.py
windows10-2004-x64
3corerulese...sts.py
windows11-ltsc_2024-x64
3corerulese...est.py
windows10-2004-x64
3corerulese...est.py
windows11-ltsc_2024-x64
3General
- Target coreruleset-4.25.1.tar.gz
- Size 586KB
- Sample260731-m96trahc64
- SHA256 0539e66e7627fe71c160a644d8fb7ab6e450d53c9de208be5f95a35c70e1a154
- MD5 25e5a1d762b7caaa5713804213e71b2f
- SHA1 da78c81d51c56165e23b83eac294399c080020f6
- SHA512 40aaaee03419c74b3815730170e499e9552e75e4fa8e41f02c762b7b299248ce38fc7ba61b5264566633b2911c5dcd8288821f847812daa0bb2c49f0ced01a3d
- SSDEEP 12288:OeP1I33TfMJ2Dq9+U3m6TvPmufY5yZZYqk7lKb5ueoD:O3nAsDQVm6jPmufRZWqql
- TLSH T18AD4235CAE45707AAC8CC96BFE238B94F10ED0668121913359F7973BCE4455AFC02AB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
coreruleset-4.25.1/regex-assembly/921120.vbs
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
coreruleset-4.25.1/regex-assembly/921120.vbs
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
coreruleset-4.25.1/regex-assembly/921160.vbs
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
coreruleset-4.25.1/regex-assembly/921160.vbs
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
coreruleset-4.25.1/regex-assembly/934100.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
coreruleset-4.25.1/regex-assembly/934100.js
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
coreruleset-4.25.1/regex-assembly/941390.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
coreruleset-4.25.1/regex-assembly/941390.js
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
coreruleset-4.25.1/regex-assembly/942290.vbs
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
coreruleset-4.25.1/regex-assembly/942290.vbs
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
coreruleset-4.25.1/regex-assembly/943100.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
coreruleset-4.25.1/regex-assembly/943100.js
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
coreruleset-4.25.1/regex-assembly/exclude/unix-shell-fps-pl1.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
coreruleset-4.25.1/regex-assembly/exclude/unix-shell-fps-pl1.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
coreruleset-4.25.1/regex-assembly/include/unix-shell-noarguments.vbs
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
coreruleset-4.25.1/regex-assembly/include/unix-shell-noarguments.vbs
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral17
Sample
coreruleset-4.25.1/rules/REQUEST-905-COMMON-EXCEPTIONS.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
coreruleset-4.25.1/rules/REQUEST-905-COMMON-EXCEPTIONS.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
coreruleset-4.25.1/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
coreruleset-4.25.1/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.js
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
coreruleset-4.25.1/rules/REQUEST-941-APPLICATION-ATTACK-XSS.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
coreruleset-4.25.1/rules/REQUEST-941-APPLICATION-ATTACK-XSS.js
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
coreruleset-4.25.1/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
coreruleset-4.25.1/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.ps1
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral25
Sample
coreruleset-4.25.1/rules/unix-shell-builtins.vbs
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
coreruleset-4.25.1/rules/unix-shell-builtins.vbs
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
coreruleset-4.25.1/rules/windows-powershell-commands.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
coreruleset-4.25.1/rules/windows-powershell-commands.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
coreruleset-4.25.1/tests/regression/CRS_Tests.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
coreruleset-4.25.1/tests/regression/CRS_Tests.py
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
coreruleset-4.25.1/tests/regression/conftest.py
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
coreruleset-4.25.1/tests/regression/conftest.py
Resource
win11ltsc2024-20260709-en
Malware Config
Targets
-
- Target coreruleset-4.25.1/regex-assembly/921120.ra
- Size 472B
- SHA256 eec703120da25c92e77a52ad993923d97b646c6cdb44c071bd8ca4c6fcd9bacb
- MD5 c4536d023b7795f7efa250893bc53aa9
- SHA1 71a28784655fd01781407c6576d79d54ae83ece3
- SHA512 cdd895d85ae59e2b4b3f54d779ec9d3e398eebc69bd01698fc9005984c6a59dac850e3a31c45a9e98e420aaef9eb13d77e593c90d6ad9be2bfadf5cdff41baf9
- TLSH T114F027961440340D27036221A9C73C60D5BA661AE6C2904A96AE113DDCE0B1AC3972CF
- MD5 SHA1 SHA512 TLSH
Score5/10-
Executes a VBScript file via the Windows Script Host.
-
- Target coreruleset-4.25.1/regex-assembly/921160.ra
- Size 772B
- SHA256 76d5ff13ee0cb7d7cb3c6e5d15724a30dd7411db9c9588b97f79b54356e66d8c
- MD5 a1ffad2c05ca3c7be3a99cabca0c7409
- SHA1 803963a81814fb8eb775176870473b6778900621
- SHA512 84b80370120fd9ebb136ef12229ffdb2771009d0459a9aed976ca2e52384dd17f75cd6844c33b72e05fa0c7dfe45fc1befa264051b9f14b40f0b4c64808f0175
- TLSH T10B014562F443BC1D1B226226F6CA7DA2466F0A1F2090500A97DF012A79F5396D7F70EE
- MD5 SHA1 SHA512 TLSH
Score5/10-
Executes a VBScript file via the Windows Script Host.
-
- Target coreruleset-4.25.1/regex-assembly/934100.ra
- Size 3KB
- SHA256 215f308c672ce58162b9feb48f51484bdb08bead9dac078c69d7fa23e1aa80e1
- MD5 72e1c8a6f8644d60d666b853d98de1ca
- SHA1 3797f73cce4c00a65c5cc34fd7644656110c20fc
- SHA512 9d55e006134fc1bfc66b08306249b143db4b1d67a59be3e687b1d127ab4cd639ad63ed531ebd75d52a2559d46b182f63c58f94ee58be915d1354eaa22ac363b3
- TLSH T19C71A15AF144321D6772E264788B3126872BDE332281905DB2DED1AD6F71209E2C30FF
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target coreruleset-4.25.1/regex-assembly/941390.ra
- Size 246B
- SHA256 7f036f9927a5bc50deac1069e4a78e19e3a708624cc0e96adf29c4366747c47d
- MD5 ac8927dd2d509386bffe08f80d0821f1
- SHA1 07116d0d716f6aa9f89a7dd565365b03cb3c5c12
- SHA512 18d2502f94a9a1508996430e175559803a2944d38810ddc590c7f895a6b8c8fbd5c207f476aa7cc91491c99764e579e2230feaf0b780ae25c7773a8630a6f4dd
- TLSH T11BD0A773C8C1A531D6032621F96B60D84952779E77E7E497367E03ACA461974835B0CA
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target coreruleset-4.25.1/regex-assembly/942290.ra
- Size 2KB
- SHA256 3a2242d921bfa1d2229910c57c0652f675d4bc291987bbd9cb94d40c03fd4843
- MD5 82ba18b10d506ada01c6d77f046e3276
- SHA1 8c5c6ae3c2aef06517fa67617b7f2417fcf00366
- SHA512 9417ab64d6156c7912eca062d8714e4d4b1547ee23f15fec1b6e7a747c7c9928722f4ce071fd2636d06b9212aa387b3de0754d49cf4b16b049e199c4999be698
- TLSH T1A0516505F508D0F5274797D0BC546136C63390B8B85BA24873EC01A87339BE6575FAB7
- MD5 SHA1 SHA512 TLSH
Score5/10-
Executes a VBScript file via the Windows Script Host.
-
- Target coreruleset-4.25.1/regex-assembly/943100.ra
- Size 587B
- SHA256 aa1313050fd716e84e414f8468b86cb0e8a37c0207f3c78402404fe60ce6c14d
- MD5 214ce29604e6d205d74ec75c2b429360
- SHA1 ed76c5e1d3cae1212555017e3a46966f2cbbc9f0
- SHA512 83a1b410309981c29f66e703fdd09d46a686f1fe1b9e1fb25879d26777b8e28f86c85fdd59e58f93e3aec9423a277778236a65cf27c0e41cce7a0ee4887653a9
- TLSH T137F0469BF840313E6317A72170E1A1B8A972922264D2A00DB06DE1756F30C1BCAF30BF
- MD5 SHA1 SHA512 TLSH
Score3/10 -
- Target coreruleset-4.25.1/regex-assembly/exclude/unix-shell-fps-pl1.ra
- Size 6KB
- SHA256 f3a4fee4c45ff6411ba9009e079a97693b41d662849e1e44271d98ee83d09efe
- MD5 c2903362fe18b59d773be3fa08957a09
- SHA1 67f9bb8716b3a0aaa0db23795e0a65b0daea05d6
- SHA512 1950a66c4386fa39715f1741714ad0e7be1f712a05c1c93b3a325b6c47d413bdf7070e9d394fb2b275e1a6e336ca9014c2696fe4c1433f6a61fa24151c842c6b
- SSDEEP 96:UHVRjsUYUhsA5p4EHnwh8dZI11AvR13FhgJv0l8qaShyQ7PbMpJV77kNk/alTRDN:nAsIwh2IrAvRP+ip7zCJd7kNNvTn6bW
- TLSH T119E118749CA8E9360BABFE5AFAC68268925021975D02DC1CF39D52D01334918E62FDDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10 -
- Target coreruleset-4.25.1/regex-assembly/include/unix-shell-noarguments.ra
- Size 364B
- SHA256 3edec7a750270097da98543859ef4f850e2225f2eab80a2aaadf38a5559cea79
- MD5 cf7c6360892d5f51d33aed4bfbbacffe
- SHA1 8dda0cc2f103cc037f4bd6fe227ab41366094580
- SHA512 90a3475c150357331400c3a3cb1663292415bd0c64fc9ea5e302766352b400665a6f69ea12ea30a326308b0b57fd0a119d0105569cfc936a1783d2fa33ccafe7
- TLSH T157E0C0FB801441E3C74328A0F52361DE1413EA299982D5AAB48C9538A91BE3583270CF
- MD5 SHA1 SHA512 TLSH
Score5/10-
Executes a VBScript file via the Windows Script Host.
-
- Target coreruleset-4.25.1/rules/REQUEST-905-COMMON-EXCEPTIONS.conf
- Size 1KB
- SHA256 8d713fcc9e6390f5aae145309ae24cb12fdcae744af0ab60586846f4a3fdd7a9
- MD5 3e6a157aa8bea1dd2e3d65497e7daa63
- SHA1 62ea9604495c7d7ac0acb1a062c7b7ce06e5bbff
- SHA512 25fdf1bcbbcccdf6d2dabd0cad7f121b62ba18c58b0de9d4818c41cbb064af480c15a4236a63d7c6b10bdc1e0184ab15d99eef64652e180f02d150aa5a8cab43
- TLSH T16431E0619C1226E14103D15814F37416F436836B8E35B85FF0BCAD23BF5695FB16E1AB
- MD5 SHA1 SHA512 TLSH
Score6/10 -
- Target coreruleset-4.25.1/rules/REQUEST-934-APPLICATION-ATTACK-GENERIC.conf
- Size 21KB
- SHA256 fe2ed54b65bfbff1cdb503a38839961eddbb6ac4b5b55870f6426801a34fda50
- MD5 36f5d3df7d1f0ca6f17648cc8d07f4dc
- SHA1 8a5c89f87fa26b6e72590e4ffee3441a9ed6101b
- SHA512 e463249f190846318be30420080690a1bdb4429faed272598dc4ee5c8823fdeeeaa8466d09d4eaaf6b028d01a39f3148cd90bce7c8cba54434c6fb61070f420a
- SSDEEP 384:/lYCgAb+RWY+4EpeR6l4+cpLciR6l4+cZYN4xn1rN4yYfv0c4Ez9l4y8CgZ4EHUR:aCgANY+kR6Xcp3R6XcZY+1rvYfv0Mz9p
- TLSH T18CA2E87A6F1AB2A18349E24C50CE6495D63B516B9EB8F60FFA7C8C077F4182D53290F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target coreruleset-4.25.1/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf
- Size 53KB
- SHA256 e86b8167000c51e6298a59ef6ee6ae07b5cd413d24d7c13785c4074199b73726
- MD5 6a4ef4f2737f8a59a4ff7b4a05baeb0d
- SHA1 524d476555880e7775bcd89472cd0e7ff112746a
- SHA512 950a0befe0ca6e8088596dd7589e8934f5cf06cec390fab5024196fa3be9fca082ee94f0f55d00b6622e50a49df18f0600a1760199a4b0e0a8daa9dc958a38b1
- SSDEEP 1536:aDR63rR63WR63qR63qR63bL22+rR63VR63ZRg7RonRogRo4RotRoCRo3+GRouRo0:ask5ttbL2jkCwWa5BEH3GbC6gPTxewkC
- TLSH T10C43FAA55E4BE3B08346C25A609FA4859A3A409BCE74F65FFEB84C4BAF1453F42344F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target coreruleset-4.25.1/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf
- Size 96KB
- SHA256 8c5c6502dd588f354ecb37dc178785892a827a8000a360b2e36a7825c80a0266
- MD5 4fe89c7883d223308314ca82bf92d770
- SHA1 9420f06719cb8f09fdff71964ecd1903164c0d02
- SHA512 74367760eaea60bbec9d0c9d32dde01013f664d7b98ed537602b392d509d2e666f9830df51d2672692877841f7d6869078e098b6dafe724927f00f3ccc64f9dc
- SSDEEP 3072:syJcMYaKO/hSky2nfm85y9oLtE29MbZZUJl3s6fdcFedBIpd/YcsvOHDrK6QYZnJ:wsPO
- TLSH T1FBA3C862DF47E670838AC14A60AF60C6993B816A5EB5F61BF97C8C0BAF5053D47340F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10 -
- Target coreruleset-4.25.1/rules/unix-shell-builtins.data
- Size 138B
- SHA256 7c7b600b457b06940a440095cf594f0e28de1891020de9840fc9ea7cf1e00e57
- MD5 719307dae95ea37f5aad64ad1c602532
- SHA1 303b5ff38081b55c6b622a6cfbc9809bf355477d
- SHA512 a520a0b164844b859ded4420a3c9c98e94ab94b45feba7cfd710eb283e910502414f12911ac447154a254b9e927c16c14683b2104b8a231f8467761431d323f2
- TLSH T12CC02B337075ED31848F0508DB5B0706E801C327773185E43B230268441141B8F0E818
- MD5 SHA1 SHA512 TLSH
Score5/10-
Executes a VBScript file via the Windows Script Host.
-
- Target coreruleset-4.25.1/rules/windows-powershell-commands.data
- Size 7KB
- SHA256 5055ffeb4ce22869dee0f611045991e64365e980bba68649f4468aea86476d93
- MD5 12bd689ca81db06c30f9339096129895
- SHA1 351ae9b232f3cc99a86f1433c0d39bc8d377f85f
- SHA512 ea1fafe78fd075e57803804ab7d516be0e168501fc0091fc98faf11d74b523a18f47d9460a0220be568a54912b831ed17b064aff6adb5cb135fbba61e008ffb3
- SSDEEP 192:lmodN90ph9hH4UEEQRXeQBE2v+l1OhY3qI6WWTz5zj7mwGvgkCwDSTs8nStlxsP9:M4UEXBP+ll3qnxTlfHYGCiP9
- TLSH T1B0E19722DA193DB5EAC6C19B9EA10CC34BD1D5C9F431D99497CCC4AD0283B6B65321EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10 -
- Target coreruleset-4.25.1/tests/regression/CRS_Tests.py
- Size 4KB
- SHA256 c497edc764cb6e2613724d34b1b61b2325b0acb77b7af436095884ec0cc60fe6
- MD5 1180b0c46dc832ea7aac76a07893e70e
- SHA1 a87185262f661fde468aa1a5ee406c81a813656f
- SHA512 1768084ca783a4e9c9ec41cf1ecb5c3867820c778ed53b91cc487c613abc5d09295dba5583334b449316ec65045e34136735f230f3e58387db408d67969c3e80
- SSDEEP 96:satwBW3J/nvS85HWAqbPH/sRWg1kM65ddBcBw0YhJ4UQqV4UQZBjbt5lQmVw:sa/3J/C8RQxPhJ7QqV7QZBjbt5lQmVw
- TLSH T1EEA17763956F556AE563C82FA90ABD03660B9D2B110C1434F5FCC1182F4DAB6D2F2DD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target coreruleset-4.25.1/tests/regression/conftest.py
- Size 447B
- SHA256 fc70d79bba162232ec58a7e788db22813c411768d14fd693f2e0fa681f081720
- MD5 c55a7bb91abee0e9d6d681b8ae331532
- SHA1 696c96d304c2b8c86567b43e17da00190bc1c163
- SHA512 70f142a3e94dd1043b852aa23219baec1470b5045b6dd0699e2470f1ee5c89deb63fa0bf5f857a7281bb594d2cf5f1ee5a9cdd45934b9c62dce621d114967662
- TLSH T11CF05547287A4C27C363EE48CC1B8A763E7A7BC23E03A0283CA1F3982F18501C92751D
- MD5 SHA1 SHA512 TLSH
Score3/10