id: godzilla-webshell-hash
info:
  name: Godzilla Webshell Hash - Detect
  author: pussycat0x
  severity: info
  description: Detects the JSP implementation of the Godzilla Webshell.
  reference:
    - https://github.com/volexity/threat-intel/blob/main/2022/2022-08-10%20Mass%20exploitation%20of%20(Un)authenticated%20Zimbra%20RCE%20CVE-2022-27925/yara.yar
    - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/
  tags: malware,webshells

file:
  - extensions:
      - all

    matchers:
      - type: dsl
        dsl:
          - "sha256(raw) == '2786d2dc738529a34ecde10ffeda69b7f40762bf13e7771451f13a24ab7fc5fe'"
# digest: 4a0a00473045022076837eec80a696dd94820f09606d9c0b898df167062019438d6a524deae170e7022100e04494a4faf434420541568819f6c974b92716787d9a86c27c660eee5bf1ca7e:922c64590222798bb761d5b6d8e72950