/*
    Source: research.ohiiho.com/arsenal/r57/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule webshell_r57 {
    meta:
        description = "r57 webshell v1.24 (Russian scene, physx variant)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/r57/"
        status      = "validated"

    strings:
        $title       = "r57shell" ascii nocase
        $curl_lfi    = "curl_init(\"file://\"" ascii
        $test1_file  = "$_POST['test1_file']" ascii
        $name_var    = "$name=" ascii
        $pass_var    = "$pass=" ascii
        $md5_auth1   = "ec371748dc2da624b35a4f8f685dd122" ascii
        $hexdtime    = "$hexdtime" ascii
        $cfe_exec    = "@shell_exec($cfe)" ascii
        $auth0       = "$auth=0" ascii

    condition:
        filesize < 200KB
        and (
            ($title and ($name_var or $pass_var or $auth0))
            or ($curl_lfi and $test1_file)
            or ($hexdtime and $cfe_exec)
            or $md5_auth1
        )
}