WEBSHELL_ReGeorg_Variant_Jul21_1

Rule Info

Required Modules
[]
Date
2021-06-22
Reference
Internal Research
Rule Hash
c63d358986d0970d19dd5576a0520132
Name
WEBSHELL_ReGeorg_Variant_Jul21_1
Author
Florian Roth
Tags
['WEBSHELL', 'T1100']
Minimum Yara
1.7
Score
90
Av Ratio
12.0
Description
Detects reGeorg webshell variants

Antivirus Verdicts

Rating
Number of Samples
Malicious (>= 10 engines)
13
Suspicious (< 10 engines)
70
Clean (0 engines)
0

Rule Matches

Timestamp
Total
Positives
Hash
VT
2021-10-20 16:29:07
57
6
3853602a769d63657c7f9b7ad4e9dae20bee528273499661d87b7bb20444fede
2021-10-20 12:10:23
58
12
7b5e3c1c06d82b3e7309c258dfbd4bfcd476c8ffcb4cebda76146145502a5997
2021-10-18 15:27:36
58
3
60a3a3bf09c64bb082eeb10fc5453b1e9deb263ce32074359d8d408f63064774
2021-10-18 15:23:50
58
6
d367cb30ef72d78ae92dcd7e26692a55562dc6f993f446e49e3662e4fb9ceea3
2021-10-18 07:10:53
58
7
107359fa554d37185ef859bec26146f7e36cb436331280cb2feb7e14015da165
2021-10-16 12:17:13
56
11
969c67d212e9eefaa393b4567ddae21330940d3ae64dfb4cfe91d88de7d0b984
2021-10-13 12:09:40
58
6
2627867d2b73699c67bc979ccab4914b0edaefc7dd748748e378a303e46f7859
2021-10-13 11:30:23
58
4
428ae4298404a9cbd3f291321fa9a4ae6802639d85f78581c2799b019f099465
2021-10-13 11:29:12
58
4
f47a05fcf52c7b91f8a8e4b5e08c6eae9d0dcc38388f3657938698472b43dbdf
2021-10-13 11:25:01
57
8
48db09e78815df4ba530d163f6c9d9ab56206f44d51e562efe000a8ac0a8bc9b
2021-10-13 11:22:38
58
3
585d7776f4687f444763db220799ac65f9ffbf10461deda7430d9cb7dd8dbe34
2021-10-13 11:22:29
58
4
e7134df4aa1a3efe41a5e8d2ef6848e08c4956f7206bb243dcd3cc90577717aa
2021-10-13 11:17:22
58
4
66eafa54f3daa081c04387570203ee48b5fc0dbb07d470767668ad24c94afc93
2021-10-13 11:13:30
58
8
bfc0c6f3604a35cb4e6482830539f9b52e128026d9b59204731624dedfb173ca
2021-10-13 11:12:15
58
3
c6553959ce570dc770349fc89c90b9743dc7c75568e26a12cbb56db1538ddd12
2021-10-13 11:12:13
57
7
631948e798050af06539294e9dd20ab03e98380af646890309a941bb77442731
2021-10-13 11:09:38
58
4
f2285feb5dd2e215b74279029b0cc6a73bac0be119964ea1e3451dc5c42e6fe8
2021-10-13 11:08:25
58
11
27f478858cf5b076bb8c0f81b3b1eea50582ad1b4d34b9436ed07033e634e750
2021-10-13 11:07:01
58
9
c5ef5dbec391ae03f2dfe16c179a4571ab0b67e4b47f776180dd7fa4fffdb790
2021-10-13 11:05:51
59
4
6c88c6579e353f248328de194b4f6fc003f51a64ff4f7386a63a981722b15fc9
2021-10-13 11:04:39
58
7
458bda00113a3cd0c0cfd080b1bc20f29915e7d82f59fa88f380077c30b4f5d1
2021-10-13 11:03:28
58
5
63737b1400174430ca0f936905a2338e49f815928e39de8dc5b9e8d0727233a9
2021-10-13 11:02:04
57
7
87cbad1477b66bd01ef407e748b20a915eadce5123856b7983bba57f3fe0b0f7
2021-10-13 11:00:57
58
4
1b1970e77592fa3fd4a480b5731945ce2dfe509401b67a85df5b728bd0e98cf6
2021-10-13 10:58:12
58
8
f80db929f87f5825bcf2b43ec5b8e101484a767756c2605251e2d7f634cc738e
2021-10-13 10:55:54
58
13
2b7c2c54d091a712643a21f5acfb9271f0421ff45c690f5bc8c30231069a9ac4
2021-10-13 10:49:40
58
9
fe709b18ed3d3988359bf6d92693bc0a81100992c3537fe07b116678a828b8bf
2021-10-04 22:49:30
57
2
c7dec1c0a129b1dff7af5a4a072a8cc6e0d7aea2ffa734578a32e139bf78c880
2021-10-04 22:49:30
58
5
e817830910cf6f1787d2b435fb436f8cb26dbe3802aec975c5e0f11a3c3ebdbf
2021-10-04 22:46:21
58
6
80277ace7f4264eff187b83dca55be7efccef9225c410dc806ba2815d1b21acb
2021-09-29 05:37:34
58
7
c17faed2451599b2c72745760069241628140a6f90c15ab6e6517deb2cd3b990
2021-09-27 11:30:14
58
6
e7449dc8d834c1981ae0c178a09831ebcf235f04d94afd3649570b868fcebe31
2021-09-27 06:34:18
58
6
3cb8b6e8d77fbcf5f59c4d466861b0ee85f6c59a5391031e33289335b6324be0
2021-09-27 06:30:07
58
7
458dff2d046167f67f879a599c091bd1e97259651576e9190c6aa17535d9ba1c
2021-09-22 20:22:51
57
2
a22715106d0ec4e360e84ec3b26ababa71fe369c5d3a95dc7afdea1f7b44e59f
2021-09-22 20:10:17
58
3
f98b0b950d159db230bd093bdef677bbeb346ed2b89290ad3aea6a369ea46e55
2021-09-22 20:05:13
58
3
376481c0fc445e156ab41d58096a7dd00dcde8895f7e8366a3561361edaea3ac
2021-09-22 20:00:29
58
6
6c7217ab9213c2251a707641b803fefd037349019099a0dc91f24a2312f18c67
2021-09-22 19:57:45
58
9
3ea5739ca35a3f65a9d1dc2255b8d3d135619b1f425c1f38287de3e60e07fd77
2021-09-22 19:56:32
58
7
1e0f4e31448ed0e508ecf7392bd8fc21f4ecfc4531eb0524db298456e8b15b75
2021-09-22 19:54:21
58
6
14b7a6ae2816c6a42a9e2f091ccdd46decc3a02a32f9fcdf9c8aa3d1279f0a05
2021-09-22 06:28:25
57
6
20808bfc0ad462416a690b76ec79078629d87a66d7419ffd3b0b32aa7cf815e5
2021-09-22 06:25:17
58
3
351b0cdc7f72bd77f63eb436d589fb234bee1af5994238769c37b90790d4e776
2021-09-21 10:27:08
58
6
c959cffe5e7dfee7e3dbdc8bbbda459f2e81d475b939de1f701267f15c8af8a7
2021-09-18 05:22:11
58
11
e0857fded1066b879841ecd7da65f951f2695e3d2018987982c33d62be51f1b8
2021-09-18 05:21:07
57
1
5169d9235ecaee9865dcfdb915cc1f9b3cf602524e4daa3e6b9385efc3456687
2021-09-18 05:17:56
57
2
db88018f2f74896f14e780b2c0d8dd5941c09d75ccac1c6c5c0abc7bfb7afe6e
2021-09-18 05:16:52
57
7
8329452850a97dbe76eb84e8b776385fd3c701191091720f0a5823437d552994
2021-09-18 05:16:49
57
4
bb353d3db81e39396a1097890b1687557039b81de2e82350172faed52a4572e7
2021-09-18 04:27:39
58
8
2ab1bb1af13ca6754e691000ffbe4ee07ff0089c6413d855501a2abc85e9ac84
2021-09-18 04:25:32
58
9
5b8e719b2f2dfa7b7648f1c96d1a62d25f3c1f65128cb64dacae33a6ebaac97d
2021-09-04 18:54:01
57
8
3c09739afdcefc7700e3bd48db576cc4156934c9556d6436e7aca7474ef638a2
2021-09-03 11:32:00
57
8
a68f59ca60e978b5ef16ffc2fff969866a221d7d0b531a2f19952f959dcea4f4
2021-09-02 09:15:14
57
5
3c260299629bfdf5888f46dda1c522024b1deff82d34c5b2a2f72ad9d3e3ed23
2021-09-02 09:12:03
58
11
4a99461a6dad67eec2b5c56862c19bb415c1a8e071c5ffd5b1b65c1ab41bee28
2021-09-01 11:58:43
58
11
0f2014076e9bf5eac8c91b56826e01994f052b4e2fe8d9ee3293438edbc528b6
2021-09-01 11:55:36
58
4
5ff5f85ac0769921d991460e27c0ab90a20ed44557ee1570f69596692012854a
2021-09-01 09:00:35
58
6
fa84572c5629bb596d9c0d5dcc390fa3549fbc597b542a85c1ed68b8ea826f37
2021-08-31 11:43:54
58
8
c06888e9f00032c81dafaa860fde59779e799f36cea99a5059dee994dc2bca3a
2021-08-31 11:41:47
58
9
b061772052a08b3582dfe9d58672b71622366dc3e461638b5159de00dd7e2fe7
2021-08-31 06:54:12
58
9
8baaca1a2ea4e1d29b47087ce9a8d2a8519f4615484991d258edc269458aa120
2021-08-30 13:58:29
58
7
5215a82b96d052e8bf84121173a07a0a96995eb90c56fed79061b95f8de8b40a
2021-08-30 13:42:25
58
9
d8077b5d77daae72b9054622f2499b7d891deabba76bdae6bf8cea19f18b1f8f
2021-08-29 16:11:55
58
10
fec577f9a1f50b619b8ca2153ce021f0aec978e8645799d997fab4a821646927
2021-08-27 07:19:51
57
9
6abc7df04d2c19132f116463982f53f0fdc3fbf1a1568ee7e9a054ea59119b08
2021-08-24 19:30:09
57
4
18ad181bfabb09e99f7ecd59adde30d66122107ebfbf304647d1f3bc5618884c
2021-08-23 12:10:56
58
9
518e0bfc8feb94bc601098971f01f1c5fb930fd7215ac975a50ccd84bd16c3ad
2021-08-23 10:10:06
57
9
65263a2d2e91bac87f3f54c11e5f024b6bce4fdb22bb8a23543658473c3ecc10
2021-08-22 00:43:25
56
4
2df5b1d66b04f2895bae8d9b21b045f394c9876af49a9d1c3f055b1d7d3d0516
2021-08-19 16:37:41
59
3
487d8ccfd2efedcd4a57b351772551b9aacbdc3b5b12ad557cc7d23f7368bcbe
2021-08-13 12:33:38
59
11
dc18834e1aba6a68086027f887a6683ee2776549b0ebaae5bd2d248f970a0b50
2021-08-13 12:29:52
58
4
99b1459d6ffb17d54482227c7c0ff9ec63a2149d41a43d14e2a8d1721f6ab736
2021-08-12 15:15:16
59
18
0bbe4d425679143b27efd4543b772de91602be6c215bfc5e043058580ea40a31
2021-08-11 17:35:09
58
4
304433ac3beb1f8333055ba76bdf013fc40e5cf77eeacc673f57a3ba712b8bb1
2021-08-11 17:34:06
59
10
d058e88614f6c7bd33b4d8af9ade1c0aac27dea05e61fcee1e74d0deda1ef0b2
2021-08-05 16:17:19
57
4
50e65149676c42d9ab9ce645ef01c5569173c22f7af85fc11db6acc9288ec542
2021-08-05 11:21:36
59
8
9e6e9a9f732cc32668e4e286fb6a7fa9b56ef500221a08e0b98c5e6f83d5410e
2021-08-05 04:30:27
58
4
f66ea02bdd959911f5a158e555c4ad29a4a0b0279b6f48b5de7748fa0ddad5dd
2021-08-05 04:27:18
59
9
d2cb3d84e6750144b611a3cd2c44ebeb638b49c6cf2368e5ac35fe8a6b80aa4c
2021-08-04 07:45:16
59
9
b9ea613bee0899e0d59ce5e533a4ef10890e83fa35b4ce7368f855751f42376f
2021-07-29 17:31:40
59
9
36943ec284b9e3fc6a55d20f82b2ef1f10b0ca2b156ffc3bd0b09dedcab8786b
2021-07-29 07:26:07
58
14
fdc2ff312e3e2355108873a58b74fdff936b525b71cdb6f3f7f6ead77e883982
2021-07-08 10:29:02
47
17
406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928

Rule Matches per Month (last 24 months)