TrojanDownloader_O97M_Donoff_203

YARA detection rule by roadwy

TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 00

rule TrojanDownloader_O97M_Donoff_203{
	meta:
		description = "TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,04 00 04 00 04 00 00 "
		
	strings :
		$a_01_0 = {4b 36 37 59 7a 76 59 6f 49 6e 20 3d 20 53 74 72 43 6f 6e 76 28 4c 53 69 56 68 72 6b 76 35 54 71 28 54 51 45 36 6f 34 6e 39 64 58 76 52 4a 39 29 2c 20 76 62 55 6e 69 63 6f 64 65 29 } 		$a_01_1 = {4b 36 37 59 7a 76 59 6f 49 6e 28 22 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 38 41 41 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 42 6a 57 57 50 37 4a 7a 67 4e 71 43 63 34 44 61 67 6e 4f 41 32 6f 50 4b 57 54 71 44 73 34 44 61 67 38 70 61 65 6f 53 6a } 		$a_01_2 = {52 74 6c 4d 6f 76 65 4d 65 6d 6f 72 79 20 43 58 53 6e 77 6c 4f 51 79 48 6a 56 54 63 41 28 30 29 2c 20 54 69 33 6e 38 65 78 4d 45 69 61 31 6f 62 28 30 29 2c 20 35 31 32 } 		$a_01_3 = {59 58 35 42 62 52 37 39 35 49 53 20 3d 20 59 58 35 42 62 52 37 39 35 49 53 20 26 20 4b 36 37 59 7a 76 59 6f 49 6e 28 22 6c 55 45 41 44 4a 56 42 41 41 53 56 51 51 44 30 6c 45 45 41 34 4a 52 42 41 4e 53 55 51 51 44 49 6c 45 45 41 50 4a 56 42 41 4c 79 55 51 51 43 77 6c 45 45 41 } 	condition:
		((#a_01_0  & 1)*1+(#a_01_1  & 1)*1+(#a_01_2  & 1)*1+(#a_01_3  & 1)*1) >=4
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

de7215c5-1a1b-4644-bc01-7fe828a0cbfe

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion