TrojanDownloader_O97M_Donoff_140

YARA detection rule by roadwy

TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 00

rule TrojanDownloader_O97M_Donoff_140{
	meta:
		description = "TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,02 00 02 00 02 00 00 "
		
	strings :
		$a_01_0 = {58 2f 52 58 6d 49 61 52 36 74 58 74 33 52 6c 51 65 75 49 76 36 61 59 37 6c 56 59 76 58 67 65 67 36 2e 52 63 4b 56 6f 36 6d 59 7a 2f 33 56 31 56 71 33 2f 56 31 52 71 67 49 2e 52 56 65 51 56 78 67 56 65 33 27 56 58 2c 37 33 27 36 7a 25 56 54 59 59 45 52 58 4d 56 56 50 58 25 58 5c 49 } 		$a_01_1 = {58 56 63 58 33 6d 7a 4b 64 37 2e 52 65 7a 78 75 65 52 67 20 37 7a 2f 4b 63 33 20 36 58 70 7a 6f 4b 33 77 75 52 65 67 72 59 73 52 58 68 56 65 49 6c 59 59 6c 7a 2e 4b 65 49 78 51 75 65 33 20 58 56 2d 58 77 49 37 20 67 56 68 67 49 69 75 64 52 64 52 7a } 	condition:
		((#a_01_0  & 1)*1+(#a_01_1  & 1)*1) >=2
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ee9ecbf1-7f4b-45b6-9401-65d24f4b0b6b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion