id: regeorg-webshell-hash
info:
  name: ReGeorg Webshell Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects the reGeorg webshells' JSP version.
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2022/2022-08-10%20Mass%20exploitation%20of%20(Un)authenticated%20Zimbra%20RCE%20CVE-2022-27925/yara.yar
    - https://github.com/SecWiki/WebShell-2/blob/master/reGeorg-master/tunnel.jsp
  tags: malware,webshells

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == 'f9b20324f4239a8c82042d8207e35776d6777b6305974964cd9ccc09d431b845'"
# digest: 490a004630440220526fa19e306c7a67f8dc2fa322983b84af7ed269fc4a26a115e6ff5235044951022016acfd0a2c4f3278f9f31b2732f8bd87650751d8d696aff400450356eafee1a3:922c64590222798bb761d5b6d8e72950