rule win_rgdoor_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.rgdoor."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rgdoor"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 48634804 488d05db7e0200 4889841968ffffff 488b8368ffffff 48634804 8d51e8 }
            // n = 6, score = 100
            //   48634804             | mov                 eax, dword ptr [esp + 0x40]
            //   488d05db7e0200       | mov                 dword ptr [edi + 0xc], eax
            //   4889841968ffffff     | dec                 ebx
            //   488b8368ffffff       | lea                 eax, [esp]
            //   48634804             | dec                 eax
            //   8d51e8               | lea                 edx, [0x1365d]

        $sequence_1 = { 83fa02 7c12 8a03 4b8b8cea503f0300 48ffc3 4288443139 83fa03 }
            // n = 7, score = 100
            //   83fa02               | mov                 eax, ebp
            //   7c12                 | and                 eax, 0x80
            //   8a03                 | mov                 dword ptr [esp + 0xc8], eax
            //   4b8b8cea503f0300     | mov                 eax, esi
            //   48ffc3               | je                  0x9a9
            //   4288443139           | mov                 cl, 0x20
            //   83fa03               | mov                 edi, 1

        $sequence_2 = { 440fb60c3a 4180f93d 7504 33d2 }
            // n = 4, score = 100
            //   440fb60c3a           | inc                 ecx
            //   4180f93d             | push                edi
            //   7504                 | dec                 eax
            //   33d2                 | sub                 esp, 0x80

        $sequence_3 = { 48895c2408 4889742410 57 4883ec20 488d3d064a0200 }
            // n = 5, score = 100
            //   48895c2408           | pop                 edi
            //   4889742410           | pop                 edi
            //   57                   | pop                 ebx
            //   4883ec20             | xor                 eax, eax
            //   488d3d064a0200       | dec                 eax

        $sequence_4 = { 488d4c2420 41b801000000 4889442458 e8???????? 488d05e6840100 488d154f530200 488d4c2420 }
            // n = 7, score = 100
            //   488d4c2420           | dec                 edx
            //   41b801000000         | mov                 dword ptr [ecx + ecx - 0x20], eax
            //   4889442458           | dec                 eax
            //   e8????????           |                     
            //   488d05e6840100       | arpl                word ptr [eax + 4], cx
            //   488d154f530200       | lea                 edx, [ecx - 0x10]
            //   488d4c2420           | inc                 edx

        $sequence_5 = { 488b0f eb03 488bcf 0fb606 440fb60408 ba01000000 488d4dd8 }
            // n = 7, score = 100
            //   488b0f               | dec                 ebp
            //   eb03                 | mov                 eax, esp
            //   488bcf               | dec                 eax
            //   0fb606               | mov                 edx, ebx
            //   440fb60408           | dec                 eax
            //   ba01000000           | mov                 ecx, eax
            //   488d4dd8             | test                eax, eax

        $sequence_6 = { 4863f0 89b424b0000000 3bf3 0f8475010000 488bce 488bd6 }
            // n = 6, score = 100
            //   4863f0               | cmp                 byte ptr [edx], cl
            //   89b424b0000000       | jne                 0x135
            //   3bf3                 | dec                 eax
            //   0f8475010000         | add                 edx, edi
            //   488bce               | mov                 dl, 1
            //   488bd6               | dec                 eax

        $sequence_7 = { 4c8d35e4fb0100 f0ff09 7511 488b8eb8000000 493bce }
            // n = 5, score = 100
            //   4c8d35e4fb0100       | mov                 dword ptr [edx + ecx - 0x10], eax
            //   f0ff09               | dec                 eax
            //   7511                 | mov                 eax, dword ptr [ecx - 0x10]
            //   488b8eb8000000       | dec                 eax
            //   493bce               | mov                 eax, dword ptr [ecx - 0x10]

        $sequence_8 = { 488d057635feff eb0a 33d2 33c9 e8???????? 90 4883c420 }
            // n = 7, score = 100
            //   488d057635feff       | dec                 eax
            //   eb0a                 | sub                 esp, 0x30
            //   33d2                 | dec                 eax
            //   33c9                 | mov                 ebp, edx
            //   e8????????           |                     
            //   90                   | mov                 ecx, dword ptr [ebp + 0xb0]
            //   4883c420             | nop                 

        $sequence_9 = { 488d1510da0000 488bcb ff15???????? 488bc8 ff15???????? 488905???????? ff15???????? }
            // n = 7, score = 100
            //   488d1510da0000       | mov                 edi, esi
            //   488bcb               | jmp                 0x392
            //   ff15????????         |                     
            //   488bc8               | mov                 edi, 2
            //   ff15????????         |                     
            //   488905????????       |                     
            //   ff15????????         |                     

    condition:
        7 of them and filesize < 475136
}

import "pe"
/*
   Yara Rule Set
   Author: Florian Roth
   Date: 2018-01-27
   Identifier: RGDoor
   Reference: https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
*/
rule win_rgdoor_w0 {
    meta:
        author = "Florian Roth"
        description = "Detects RGDoor backdoor used by OilRig group"
        reference = "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/"
        date = "2018-01-27"
        score = 80
        hash = "a9c92b29ee05c1522715c7a2f9c543740b60e36373cb47b5620b1f3d8ad96bfa"
        malpedia_version = "20180208"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rgdoor"
    strings:
        $s1 = "MyNativeModule.dll" fullword ascii
        $s2 = "RGSESSIONID=" fullword ascii
        $s3 = "download$" fullword ascii
        $s4 = ".?AVCHelloWorld@@" fullword ascii
    condition:
        pe.imphash() == "47cb127aad6c7c9954058e61a2a6429a" or (2 of them)
}