WEBSHELL_NeoReGeorg_Mar22_1

Rule Info

Name
WEBSHELL_NeoReGeorg_Mar22_1
Author
Florian Roth
Description
Detects Neo-reGeorg webshell
Score
85
Date
2022-03-17
Minimum Yara
1.7
Rule Hash
79aedddac05febc32a857817db70ef3c
Tags
['WEBSHELL', 'T1505_003']
Required Modules
[]

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
86
Suspicious (< 10 engines)
39
Clean (0 engines)
2

Rule Matches

Timestamp
Positives
Total
Hash
VT
2024-02-20 09:02:41
16
60
7d191acdc07838bf07eaeed1e2e74dab8989c5f1368313d9dfb259c4720bf329
2023-12-26 12:02:21
0
60
fe2c36d70f82787020fb110101452f3410f4accdb6da0514c8ae80b800de6746
2023-12-12 16:03:06
16
60
592342a59087ccd32018c09f8b5a05c22b5bcdef85171f803ca19730d006c6f3
2023-11-21 11:09:54
16
60
1341be2dcdf1f3717e1886272843165d5d7523e3c78e88560d925442bdca6bf3
2023-10-07 19:40:45
14
60
08918cc3b9afe291d6455928752f836e578947dce07dde991d45d6e33fb4911b
2023-09-28 13:01:09
16
60
caf4b47576ba64a15d5c8a5e6f83834098bba7e5241ef17a285abe3237bfbb33
2023-09-18 03:47:23
15
59
1c15d5fd67829f273e637091efc6069dc734023719c049bb78fd9300b19674a8
2023-09-08 07:30:08
15
59
0941604b115c3def42f37b0daca14f5eee13f30d3c7cd52c374e9092c811b1d0
2023-08-08 10:08:22
20
59
d2a156a37f72ab34cb6719a9eb804f44cc7e230e9f8cb286690a43d870ff7223
2023-08-03 13:26:30
16
59
9e828ecec1587877ebd482c3d33a49f9c57bd456dd43ed10a94539b10a401036
2023-07-13 06:36:26
16
58
24639d13dff254f9112bc025a00ca74c1dbb1934e5fdb739683a1ebbb6051411
2023-07-04 12:01:13
16
59
1cda094967242e42df5f924c5a628474f3a7d685d7cc3c0545b6a88fde505354
2023-07-04 08:10:10
15
59
567e514c3bac1486528a0650cfac8e746b001d5575734718de3e2364f58fa5d6
2023-06-09 18:11:42
16
59
b27840ed665c843b60defba6259f6f376d93763012bec9a641c0d246c414158a
2023-05-29 05:03:38
15
59
629bc5ea3db6644a9f8e432ce11e5241bfd5aea2fc20322fc1601bec6554126c
2023-05-19 04:09:30
16
58
9438ef6b9c91b7d3f52d9fdfac9600cb58cd8def204359fd22e9e3ba8194bf16
2023-04-23 13:11:28
15
59
054b082f1f4a39220343ba0bfd6a45e6d0e37a2fdbde6fdf823de8888afc4479
2023-04-17 04:06:27
12
59
17299c3b755e7a149106e80b1329f0f02dd3bd13e74f493d5a62f136a292ca6a
2023-04-05 01:08:27
14
59
3bacc52b9edec3725f03a1b9cbcbb7b3ea33f96c977e17a141d1f364823ee192
2023-04-03 06:11:10
14
59
a8959a6a7df103ea6693092cbef11c434767bbebf4dc4c5a05c10e0e81f36260
2023-03-31 22:47:38
14
57
941f43fa6551831dc15ba4e75d378a91c492660ae47938b48decdf22e518b1fb
2023-03-23 03:07:35
15
59
823c9476c72807267038c834d307c96266eb3e728b1b999bcec5d89cab74c0d4
2023-03-16 09:05:42
11
58
2409f39928bfa78ae61a7972015ac32b7623861346deea6e600ba55a463e55d5
2023-03-11 15:19:57
13
59
b93339f72277bd0f493e20694929cf1272d32abf74bdcc52232eb25f795c057b
2023-03-07 05:13:55
12
59
5c19071d9a306c9a1b55e053a4bdae46595b1276da7529ee670b82706506c859
2023-02-16 21:53:04
14
60
e33e698caa50bedc2eaec87ab6cc987760959b40001ced584ba217f053d30972
2023-01-10 04:53:50
15
60
39cf14868049821fb59effa4f73e8f89bdb23c81be4a440d2b425f56773f134e
2023-01-04 10:30:44
16
61
d1abc5d611e47b2fb475ddfebedb4acdbe163a6f38384f35f74eeb06fb3920b5
2023-01-04 10:20:22
17
61
b90df9a07bfaecdf1d4817e2ff30ddf95c90112a6d24e80536c3efa20f1a684e
2022-12-22 15:30:01
15
61
8ef3db78c778b1e38c56571d76c80ccbd3554c722d7c8ec16bb2d16c16111af4
2022-12-14 19:11:54
15
61
0d17dc6b60e18a644df4ee212331c5cee6afb561af97fb3f2fabb515e7dca25e
2022-12-12 09:28:06
15
61
bfbd92f0032ecbb22c02ca4154de2f20c544bbcca04208f0717a7f4964db5e52
2022-12-07 09:41:45
15
61
b8879836da2442ee55eab54da833fb78c34d7d0864221c60bbaab23fed5cb122
2022-12-05 00:35:44
15
61
a0c0e7a90cf95d601bc3de4b983941866e2fb0c962b72facd70f88bd014233fc
2022-11-21 15:50:16
15
59
e5ea5c7ce389d203a6a4ac64778cd74973fead4f2c16415556fdb1beb7fe2b7f
2022-11-09 10:33:35
15
61
f5833a180015696f33d41cb34f3b8e117f4cc3aa0d26f10dee531fe73224673b
2022-10-21 10:35:27
14
61
a6e7b556f06e2c9504e435816a9ce49f1a84b09811b84ae7935929ca3a8dd24d
2022-10-15 05:29:03
16
61
9a56fb8f2a15b324cfe83b1718f2421b5ecfc5b88537108974d1062019d5c669
2022-10-15 05:14:26
13
61
36972752ba55dc13cc57823512cc0f1be94885d5d61726622c886717d1354655
2022-10-15 05:14:26
14
61
b9a7c3f64576a3490039033b30fcefa47b26ba2c2b5b2d061d04661b7a444d1c
2022-10-15 05:13:18
15
61
de7c1bbc3b47bed021eec45b2ec87a8b23e1ed7e4b1502c184752d39d7241d57
2022-10-15 05:13:18
15
60
13167d3e1bd4025e0bfe5553a6c22447db692df6e84d7b3bfbcc39bce3595fb8
2022-10-15 05:13:18
16
61
bc3d059c289d19c189cdfaa40d26cf15ab1cca1a585b29fb5f8c3f13bbb38b7d
2022-10-09 17:32:49
15
61
c0840d68d1e2b4a3a9d97150d0e111957de593eaa165438fce831aabe883a700
2022-10-09 09:16:59
14
61
10ab97117e22e614c2ada00cc9b2efa736c69798077df879c4878e962d33dc6e
2022-10-04 11:12:02
14
59
3b06a32e468430270c002e9804bf02ebfa2b62294f8d5792764e116da7f675c3
2022-10-02 09:23:16
14
59
b231aba150d0c1dd39c24ff4899aa20fbcfa2db9974fb0744983f5a9d7c8fb53
2022-09-27 11:05:10
10
60
6a211760ba9f4eee27dc924ef20d6c39fe7897bbd6e189351aeca912b37b3f3e
2022-09-27 08:21:00
16
60
0a5947c5cc3dd85f05abc4ddc89350de01b3d82ca84d1ba51100d69512ae4f78
2022-09-27 07:09:02
16
60
388859939a84842d0db8629b95ff008040c3f3ef36ac304da6183721a06af25d
2022-09-23 04:09:27
15
60
a04f0887f450bd0c337b52ffa32b35fd559c9d8b6d3e4c699b8988d3558179de
2022-09-13 13:44:58
14
59
7cfd58411060477fdded6ad67948b0419cfcd73593bf70144be9e77f4dee0055
2022-09-12 12:51:26
13
59
e87169db0c23011319b1a1554cff51364e85f414d57b620293a37122b32399d7
2022-09-09 07:28:00
13
59
bdeb7d491243e5109427175551a966a76cf6da3d2184cd4f4a114f6b8eb48f6a
2022-09-09 07:09:27
14
59
b484f2cfe266b580cf8710755c27ad5ab655cef84641292b9f32c6aa30df736f
2022-09-07 12:11:07
14
59
c721fcaad250c2e792f027205b18a02ea815105303482e2fdc1e9114645f8f24
2022-08-27 16:14:11
13
59
e8135f8003aa0325c3b0cb04377fcd9a6a0b8b315b44a443f9353d07aa09419a
2022-08-26 04:43:37
17
59
27dbaafffe3c3b3140c9746fc6f788fda6ed8d6f9633a0296fd36bdecaa61965
2022-08-22 04:48:05
15
58
da406ddb6502c8f206e28b8fd8e2ef82acf33d99053d495e1583b7b717e0e69c
2022-08-21 19:41:56
0
59
d979dd1e4988c2cce2d1919a79fbecf4e978a78f598fce6a0e2cc0c7742f9041
2022-08-21 19:40:41
13
59
4eb5dda357c58c5490c9b3a35f374054deda8024869490f45a6502027ccf9e05
2022-08-21 06:41:51
14
59
acc6d7da78356cb41cee963fc810bfafa3f9335c0a313971592545cf60c49809
2022-08-19 22:21:31
13
59
aaeab5a07ae81cdb85e5c6af2a6165588d6659075e8af61bd56634dfe45de14a
2022-08-19 09:06:34
13
59
22f9e7ea7e115dc481107610ff049f4ada046691ddc955eaef6f8aeb5c5cf1ff
2022-08-19 04:08:55
14
59
0dc90a5c854699c786a9dfa7e20ecde6a4b7b6c138ed9e3091a951cec8512549
2022-08-14 08:40:41
14
59
fb6b32e0afd6d4c15ed4e941f92e6c93e7d276ff5b260b4ba67755e8ee0f6b44
2022-08-13 12:17:12
14
59
2b4eba68f1c933395265138fbddad1b56a55df53b977c8ed073a95ba7758e89a
2022-08-11 04:58:42
12
60
179ac1c8c75dcfbcb5a709829efc4ceba8281d17311ddb4a5e15a7ecf3368600
2022-08-08 11:14:50
13
59
37a841c66c688541268705521adadd05cec187b20542a0dc098765f761fadd3c
2022-08-08 10:20:49
12
59
c89c9717e22c8fdcd0fd40502caab148658eb8476f89728ec6bcef67c7233aa0
2022-08-05 09:07:31
12
59
f257832466e9c7a5f465deeaa241e42319d35cf95d27ce297203c2239c7a10fe
2022-08-04 14:03:18
13
59
ccd80ad2c1e08fbb6666723341c9040c19d9023d346da0a28b3a2d4c7b9d1e01
2022-08-03 10:34:05
12
58
01325456bf96774694f3a2df04122fe01f71744139eefb47a45fa3711b9259ba
2022-08-03 09:38:06
12
59
7ea901c5695157b2882066e6bdc6b34466e821d505c275d5a140545ddbb94541
2022-08-02 19:14:44
12
58
bd4682c682ddbed04483c19d64df001aeb0fa08ed1fb8ac813d942ec320005e3
2022-08-02 08:24:50
14
59
90cc86c354e615b4bec20268f8530cb6efe2ce23edfeddbed9191ad5e52178ab
2022-08-02 04:19:15
12
59
8d8b1d4ec7013a2469a3d729ea43875fbb13301a75896ea301f1f3da3cf8da21
2022-07-31 11:35:46
14
59
cc28f35e46c017dd4a660df3272319cd79e90ea59d36992f8c79ab6332944096
2022-07-31 06:02:10
13
59
f0f10588b703299e6ea7eb6089d2ae076d853659a675208d9cce218152fce4e0
2022-07-30 09:01:11
14
59
cfd738a950fecddabd96078302a0f42c2e37275c179adda07cbe0934b3b058ec
2022-07-27 13:14:48
13
59
19f051c6133241d6fcf3b13d55459f9e8d2e7dbfd8f3b8a1db40cd1c132f31ee
2022-07-26 10:11:07
15
59
afbf91f417cf4e9fdc61103a3cc4305d41e69c337c1a0d3ff5416c98b75da012
2022-07-25 12:19:54
13
59
eceb5bff87d8c085e182765288abef50bbd902b17cb11417f52300981ff597b1
2022-07-18 09:58:15
15
58
a21adc000276a9316bd713dfcf4f236156c99e35581b53383e6a7569012a03b4
2022-07-13 10:36:09
15
58
c4ed3c3cf298469169a8b50df2ee42079632bdd1905f195174ae460b49575883
2022-07-13 06:36:08
13
58
df99e6bb6dcebc8d6dbdbb0d3c8157b9d37189118b2a7a09aadcb71757ebb354
2022-07-13 06:35:05
13
58
bfafabe743d54ea8228f6c03e9d6efe502a459d0e63787bfe401312657c48fc0
2022-07-04 05:01:02
13
57
8f687c60d579f835fc12a5d28308b982ff78fee2ab33c13a7c8508c0a1c53f75
2022-06-29 16:43:28
5
56
d477e46d7f552e931d61fed8981f83d488ce3611789d9e60a3b0bee38fd5d03b
2022-06-28 10:52:22
2
56
3674515545daf39f7f1cce992b23a31824a7384ab432e525766cdcb9eb314c4e
2022-06-28 06:51:41
7
55
b92d3efc515dfe2c32b854d89403e5169a5a7e08457e5a50e9390b208389ca5e
2022-06-26 09:25:07
2
54
c585251f0280182ac72a6a6bc81090f000a0786a7c5c125de4c43038686bc1d6
2022-06-26 05:40:52
1
55
9ffd121160b72517bdba0fd538b7fad1c9aa0619abd7cddb33fc7032ca6f532a
2022-06-26 05:35:35
1
55
4203f8d3f6a88f8440c841e9a7225be08aef60c341402c816d7435fbbf3dbe4b
2022-06-25 15:38:09
5
55
e4cfce5205b1a9f9dc12a6879157d8504cd8bfd74415ce3be1a5bdc1acf23c2f
2022-06-23 05:01:34
3
55
8c4108348b3ad3ae1878e709ab8d9c308045d6f51a6327703d457c45e0ac01d4
2022-06-22 13:56:03
4
53
e5f0480093b2b92b8a5c4fbccaf238db585c069f1a3268d927cf9c81b48bc8ae
2022-06-22 06:11:56
5
56
7f15c06f863df0f7fda805116fe0f91b2e47e71d4e8dd37fd17f538dea06ec55
2022-06-22 06:01:29
5
56
cfe2b12a500a51fd6099d3d8b82909ccb1465ca03b30efd1d11d6f1e786cfd6d
2022-06-21 15:39:36
4
45
6cc852bd81bbec226f21f56a0c52a403d362c53322ae3248e1722cbbd46dfdeb
2022-06-19 12:11:30
3
56
bd50945ea97a3219addd22313978e5ac04edfabbcb84ed54dbfbb82ad9c1785c
2022-06-16 08:14:28
3
55
6350212677cd4c49f5253afea9cb77254ed42a6a3cd3bff0bbe52bdec03091e2
2022-06-16 07:10:28
4
55
c773d955556d303243eba3dd9d15b3ba4c2c805df946177f808f1561f24ba249
2022-06-12 15:02:02
5
56
2e7cb986f1ddcd021bcba87a419ae23be4f01d0e65f935e34990fd236e3ba350
2022-06-07 11:33:21
4
56
54f38c4deb1188ddad0a4f5b7e006529adc3e874837ce7f30ab720d1c4b32533
2022-05-30 20:10:05
5
57
bec27c5ecef750839c76a45c699c157d6e3a5643ff1036b29ac068d946ffe043
2022-05-30 20:09:59
4
56
7d283859847c6a8b160862c3c8dd69617c5d00771668c2a850f094121ee2fb61
2022-05-29 14:33:00
4
57
76a853bbeb10bdcb1ae54c75b961b187185ffe04057828c0c5412acbae1c81a9
2022-05-27 10:06:57
4
56
974465a0586ec7bc2f57311761a2a290b83e89e0684646da7fb9e9c0907f22fb
2022-05-27 10:06:49
2
56
419526ebca5eea20ce4cf99f47f76485ff2bd230df121061ad10cd7378c8c5bd
2022-05-27 10:06:48
2
56
16fddfb5a2c86260c3da1c05792df9433663c8e9e5be3613596088249abc85bb
2022-05-27 10:06:46
2
56
79d2dcc0ffa2c68a5d4acf1adf38007b1913f8409091d1e9e49bfcac4164bad6
2022-05-27 10:06:45
1
57
c6d9adf42149c446a2ddc0918be7dcd952b4d21197a299fd686f5b3a3c919484
2022-05-27 10:06:43
2
56
8bdb4dc0227a3fa44fc0ba24343c7edfd74cc99bd976ef2c8fefa65689a1bdb4
2022-05-23 19:24:02
5
57
7cee3bf22b743a04c4386ca247294d53e304593debe0245f19ac42e77b4611dc
2022-05-18 03:48:57
3
57
242cdcd92ee3b5f116f99248c72e064957ce56e55975661580b686030386409f
2022-05-17 06:15:43
4
58
c1cd0ea71dea051cc16b7536321899ebdb5228f19f65d6d112e8158460795fa8
2022-05-15 11:38:38
4
58
931303ff9cbf776e70078a8ca1dc42f9a2b17c5359450ff167259b535915987d
2022-05-12 10:54:52
5
56
441cd283a7243f3087233dade348e9395ba0b1e9803e3305945c2ccd14cba4e9
2022-04-15 06:35:23
5
58
4657117f70ae585ddf323f2ad07ea15eeef4115cbbc83f1b8137153df4221b2d
2022-04-15 06:33:06
4
57
96d83d290f4d9c60068e5c6bdb18d99d0f5a61136b386efd411ab71a74463c46
2022-04-15 06:30:36
3
58
84df1233b2b7af059d3aaa8d508ffd2834022685d08b63d5c83f63c2efe1ef84
2022-04-13 19:45:29
4
58
6cebff141da5c097de8be3055290f22fcd5079b8fca89838ecbc632d27059f2c
2022-03-28 12:19:27
3
56
5dd45f76f676043854350139a8cac606dbfaa0cea140a5901832fb4d8b29ec45
2022-03-24 12:02:11
5
55
b5d62ffc6036e6ce4bc8813e6b1edfce5519423f2e6eda706fb6618af6883614
2022-03-24 03:08:38
3
56
76d36214a3a0bb58ca6c9e5d8c497d4a06e669784514e3f1ee464d8dda56a982
2022-03-18 18:49:53
4
56
e758445d787c165c579e2cf96dc1e874a7603ca69abff4471123f672fc09e740

Rule Matches per Month (last 24 months)