MALPEDIA_Win_Rgdoor_Auto

rule MALPEDIA_Win_Rgdoor_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "7a748caa-9610-585e-a73c-af1eb7a2a2d0"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rgdoor"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.rgdoor_auto.yar#L1-L125"
		license_url = "N/A"
		logic_hash = "2f0ca04169b6a62bbae53949d82c4fbf97fc4cec0ba1f3cd80e4bb6d6018d2d1"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 48634804 488d05db7e0200 4889841968ffffff 488b8368ffffff 48634804 8d51e8 }
		$sequence_1 = { 83fa02 7c12 8a03 4b8b8cea503f0300 48ffc3 4288443139 83fa03 }
		$sequence_2 = { 440fb60c3a 4180f93d 7504 33d2 }
		$sequence_3 = { 48895c2408 4889742410 57 4883ec20 488d3d064a0200 }
		$sequence_4 = { 488d4c2420 41b801000000 4889442458 e8???????? 488d05e6840100 488d154f530200 488d4c2420 }
		$sequence_5 = { 488b0f eb03 488bcf 0fb606 440fb60408 ba01000000 488d4dd8 }
		$sequence_6 = { 4863f0 89b424b0000000 3bf3 0f8475010000 488bce 488bd6 }
		$sequence_7 = { 4c8d35e4fb0100 f0ff09 7511 488b8eb8000000 493bce }
		$sequence_8 = { 488d057635feff eb0a 33d2 33c9 e8???????? 90 4883c420 }
		$sequence_9 = { 488d1510da0000 488bcb ff15???????? 488bc8 ff15???????? 488905???????? ff15???????? }

	condition:
		7 of them and filesize < 475136
}