TrojanDownloader_O97M_Donoff_215

YARA detection rule by roadwy

TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 17 00 00

rule TrojanDownloader_O97M_Donoff_215{
	meta:
		description = "TrojanDownloader:O97M/Donoff,SIGNATURE_TYPE_MACROHSTR_EXT,01 00 01 00 17 00 00 "
		
	strings :
		$a_01_0 = {63 76 47 51 57 66 20 3d 20 44 74 4d 4a 51 63 28 28 63 76 47 51 57 66 20 2b 20 6f 71 41 77 65 29 2c 20 4c 65 6e 28 73 75 58 65 57 57 29 29 } 		$a_01_1 = {6f 74 2f 6e 70 2f 77 2e 76 65 77 6f 2e 74 6d 2f 2f 70 78 65 69 3a 69 69 79 2f 64 2f 6d 77 63 32 68 2e 6d 31 74 61 67 63 73 6d } 		$a_01_2 = {63 68 6c 2f 6d 78 64 6f 74 6f 77 79 6d 64 6d 74 63 77 2d 69 72 2f 70 61 77 69 6e 65 65 73 74 2e 70 64 73 6e 3a 65 6d 2d 2e 73 2f 2f 2d 61 61 } 		$a_01_3 = {2e 4f 70 65 6e 20 4e 4f 43 48 75 6c 69 63 61 46 4f 4e 41 52 61 70 74 65 6b 61 49 56 41 50 4c 41 50 45 4b 43 28 35 29 2c 20 4e 4f 43 48 75 6c 69 63 61 46 4f 4e 41 52 61 70 74 65 6b 61 49 56 41 34 2c 20 46 61 6c 73 65 } 		$a_01_4 = {4e 4f 43 48 75 6c 69 63 61 46 4f 4e 41 52 61 70 74 65 6b 61 49 56 41 34 20 3d 20 4e 4f 43 48 75 6c 69 63 61 46 4f 4e 41 52 61 70 74 65 6b 61 49 56 41 34 20 26 20 44 75 42 69 72 4d 61 68 6e 57 65 69 73 68 72 28 61 70 64 69 73 74 61 6e 63 65 29 } 		$a_01_5 = {55 4e 44 4f 50 52 59 58 4f 52 20 4e 4f 43 48 75 6c 69 63 61 46 4f 4e 41 52 61 70 74 65 6b 61 49 56 41 55 55 55 4b 41 42 42 42 2c 20 4e 4f 43 48 75 6c 69 63 61 46 4f 4e 41 52 61 70 74 65 6b 61 49 56 41 55 55 55 4b 41 2c 20 22 70 41 5a 37 78 79 57 65 64 53 71 32 33 53 57 70 41 52 35 76 46 79 71 6f 33 41 38 54 61 41 34 51 22 } 		$a_01_6 = {58 4a 42 43 4c 4f 20 3d 20 58 4a 42 43 4c 4f 20 26 20 59 51 55 57 52 42 28 22 33 35 49 34 36 4b 33 34 4e 33 36 50 34 38 52 33 36 54 33 39 56 34 41 58 33 36 41 34 33 42 34 43 45 33 36 46 33 35 49 34 45 4a 33 32 4d 33 38 4e 35 31 51 33 34 53 33 36 55 35 32 57 33 37 59 33 35 41 35 35 43 33 36 46 34 } 		$a_01_7 = {3d 22 22 68 74 74 70 3a 2f 2f 64 69 73 6b 2e 6b 61 72 65 6c 69 61 2e 70 72 6f 2f 32 61 64 66 74 59 7a 2f 33 39 32 2e 70 6e 67 22 22 } 		$a_01_8 = {7a 2e 32 2f 75 61 2e 6d 6f 63 2e 70 75 6f 72 67 77 61 6c 63 61 2f 2f 3a 70 } 		$a_01_9 = {61 28 22 4a 49 6c 48 54 72 74 61 61 6f 6a 75 75 22 2c 20 31 30 39 2c 20 35 39 29 2c 20 61 28 22 53 45 65 4f 74 72 20 52 4c 6f 73 70 4d 6c 73 73 64 50 45 54 52 78 63 22 2c 20 31 38 30 2c 20 35 37 29 } 		$a_01_10 = {22 65 2f 69 6e 4f 70 77 2f 63 74 32 6d 6c 2f 73 2f 6d 47 6f 2f 74 64 72 2f 77 6d 6f 74 2e 61 42 67 3a 63 69 76 69 77 79 2e 68 76 2e 65 6d 70 31 78 53 22 } 		$a_01_11 = {28 22 71 e4 71 3a 71 71 7e 73 3b a6 71 78 75 72 3b 79 7b 6f 3a 71 75 7a 7a 6d 71 6e 7e 6d 73 fc a6 3b 3b 46 7c c7 c7 74 22 29 } 		$a_01_12 = {52 5f 52 77 66 58 54 72 57 54 66 7d 84 75 56 5e 5b 57 82 82 76 51 84 51 5f 5b 5c 5c 53 6e 78 7e 64 50 78 61 7e 84 7a 71 6f 53 } 		$a_01_13 = {61 45 70 67 65 46 4b 74 6f 6e 65 73 74 69 74 74 3a 28 4e 61 69 4e 4d 6f 6f 64 62 2e 65 2c 2f 4e 74 70 4f 63 29 28 70 53 6f 65 74 50 2e 6d 69 57 70 5a 63 64 77 4e 79 70 72 74 73 5d 63 28 66 6c 65 74 63 6c 61 4f 6d 68 27 2f 2e } 		$a_01_14 = {22 2e 6d 70 78 65 69 6f 2f 64 2f 6d 68 2e 6d 31 4f 73 6d 6f 74 72 77 2e 76 65 74 6d 2f 2f 47 3a 69 69 79 6c 77 63 32 54 74 61 67 63 72 2f 6e 70 2f 51 77 6f 22 } 		$a_01_15 = {2f 73 66 6a 69 64 6a 67 21 76 65 21 66 73 76 75 73 66 77 76 70 28 6d 21 66 65 21 74 73 70 6d 21 73 76 66 73 73 66 21 66 6f 76 21 66 73 75 6f 70 64 6f 66 73 21 62 21 65 73 70 58 } 		$a_01_16 = {28 22 74 80 80 7c 7f 46 3b 3b 6d 3a 7c 7b 79 72 3a 6f 6d 80 3b 7c 7b 82 86 71 74 3a 71 84 71 22 29 } 		$a_01_17 = {3d 20 22 6b 63 51 6d 59 48 64 7a 2e 7a 49 65 6b 78 4a 65 6b 20 6b 6b 2f 51 59 63 4c 20 6b 6b 70 58 7a 6f 48 77 41 52 65 48 72 4c 73 4c 68 4c 41 65 6b 6c 4c 49 6c 6b 48 2e 59 65 41 78 51 52 65 4c 51 20 6b 2d 41 77 48 } 		$a_01_18 = {22 49 63 56 36 6d 32 64 56 6b 2e 49 6b 65 6b 78 49 4c 65 6b 20 4c 34 2f 6b 63 4c 49 20 5a 70 4c 6f 34 77 5a 65 56 72 56 73 56 68 4c 36 65 56 6c 48 6c 49 2e 32 65 48 78 6b 65 34 20 4c 2d 56 77 6b 56 20 5a 68 49 4c 69 6b 49 64 5a 56 64 56 65 76 6e 56 } 		$a_01_19 = {49 66 20 63 66 6f 76 72 65 20 3d 20 22 22 20 54 68 65 6e 0d 0a 53 68 65 6c 6c 20 72 6f 6a 75 70 6e 2c 20 46 61 6c 73 65 } 		$a_01_20 = {2b 46 6c 78 78 74 3e 46 33 33 7b 7b 7b 34 49 49 32 77 79 46 34 72 6b 6f 34 76 73 76 77 37 37 65 72 6b 32 46 46 67 73 71 33 49 68 73 34 37 70 77 6d 6a 67 34 65 74 70 73 34 46 36 71 67 77 37 32 } 		$a_01_21 = {74 70 75 68 73 6f 3a 2f 75 68 73 6f 2f 75 75 68 73 6f 6e 69 75 68 73 6f 74 79 75 68 73 6f 73 74 75 68 73 6f 79 64 75 68 73 6f 69 79 75 68 73 6f 69 6e 75 68 73 6f 67 2e 75 68 73 6f 74 6f 75 68 73 6f 70 2f } 		$a_03_22 = {22 22 68 74 74 70 3a 2f 2f 63 64 6e 2e 63 68 65 2e 6d 6f 65 2f 79 6d 75 66 6e 6e 2e 65 78 65 22 22 3e 3e [0-05] 2e 56 42 53 } 	condition:
		((#a_01_0  & 1)*1+(#a_01_1  & 1)*1+(#a_01_2  & 1)*1+(#a_01_3  & 1)*1+(#a_01_4  & 1)*1+(#a_01_5  & 1)*1+(#a_01_6  & 1)*1+(#a_01_7  & 1)*1+(#a_01_8  & 1)*1+(#a_01_9  & 1)*1+(#a_01_10  & 1)*1+(#a_01_11  & 1)*1+(#a_01_12  & 1)*1+(#a_01_13  & 1)*1+(#a_01_14  & 1)*1+(#a_01_15  & 1)*1+(#a_01_16  & 1)*1+(#a_01_17  & 1)*1+(#a_01_18  & 1)*1+(#a_01_19  & 1)*1+(#a_01_20  & 1)*1+(#a_01_21  & 1)*1+(#a_03_22  & 1)*1) >=1
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7afd2a28-e5cc-4d4a-8cea-c32111910efa

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion