Essential information

Value / Name

5cbad1680babb4e71c75ed3259857e29dd1edb1c

Confidence

100/100

Revoked

Yes

Valid from

09/11/2023 15:13

Valid until

11/02/2025 15:13

Pattern type

yara

Published

20/12/2025 19:41

Modified

21/12/2025 01:49

Author / Source

AlienVault

Description

Pattern

rule M_Hunting_APT_Webshell_PHP_NEOREGEORG   
   {   
     meta:   
        author = "Mandiant"   
        description = "Searching for REGEORG webshells."   
        disclaimer = "This rule is for hunting purposes only and has not been tested to run in a production environment."   
      strings:   
        $php = "<?php" nocase   
        $regeorg1 = {24 72 61 77 50 6f 73 74 44 61 74 61 20 3d 20 66 69 6c 65 5f 67 65 74 5f 63 6f 6e 74 65 6e 74 73 28 22 70 68 70 3a 2f 2f 69 6e 70 75 74 22 29 3b}   
        $regeorg2 = {20 24 77 72 69 74 65 42 75 66 66 20 3d 20 24 5f 53 45 53 53 49 4f 4e 5b 24 77 72 69 74 65 62 75 66 5d 3b}   
        $regeorg3 = {20 75 73 6c 65 65 70 28 35 30 30 30 30 29 3b}   
        $regeorg4 = {20 24 61 72 68 5f 6b 65 79 20 3d 20 70 72 65 67 5f 72 65 70 6c 61 63 65 28 24 72 78 5f 68 74 74 70 2c 20 27 27 2c 20 24 6b 65 79 29 3b}   
        $regeorg5 = {20 24 72 75 6e 6e 69 6e 67 20 3d 20 24 5f 53 45 53 53 49 4f 4e 5b 24 72 75 6e 5d 3b}   
        $regeorg6 = {20 24 72 78 5f 68 74 74 70 20 3d 20 27 2f 5c 41 48 54 54 50 5f 2f 27 3b}   
      condition:   
        (5 of ($regeorg*)) and   
        $php   
   }

Labels / Tags

Labels: caddywiper gogetter microscada partyticket powershell russia sandworm scil ukraine variant wiper

Marking (TLP)

TLP:CLEAR

Related entities

No linked attack reports or intrusion sets yet.