_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_463_1_Trojan_Danger_Ge_11

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_463_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_535_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_541_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_64_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_36_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_40_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_72_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.600D51C8_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.F48C7B75_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_110_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_128_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_197_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_209_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_267_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_278_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_33_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_101_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_145_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_150_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_3_1.vir, Virus.Danger_Gen.Trojan.ShellObject.CwZ@amBwvTb.vir, Virus.Danger_Trojan.GenericKDZ.103285_23.vir, Virus.Danger_Trojan.GenericKDZ.103285_38.vir, Virus.Danger_Trojan.GenericKDZ.103285_42.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_113.vir, Virus.Hijack_Trojan.GenericKDZ.103285_13.vir, Virus.Hijack_Trojan.GenericKDZ.103285_198.vir, Virus.Hijack_Trojan.GenericKDZ.103285_250.vir, Virus.Hijack_Trojan.GenericKDZ.103285_253.vir, Virus.Hijack_Trojan.GenericKDZ.103285_299.vir, Virus.Hijack_Trojan.GenericKDZ.103285_374.vir, Virus.Hijack_Trojan.GenericKDZ.103285_643.vir, Virus.Hijack_Trojan.GenericKDZ.103285_701.vir, Virus.Hijack_Trojan.GenericKDZ.103285_724.vir, Virus.Hijack_Trojan.GenericKDZ.103285_733.vir, Virus.Hijack_Trojan.GenericKDZ.103285_885.vir, Virus.Hijack_Trojan.GenericKDZ.103285_889.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_463_1_Trojan_Danger_Ge_11 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_463_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_535_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_541_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_64_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_36_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_40_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_72_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.600D51C8_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.F48C7B75_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_110_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_128_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_197_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_209_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_267_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_278_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_33_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_101_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_145_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_150_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_3_1.vir, Virus.Danger_Gen.Trojan.ShellObject.CwZ@amBwvTb.vir, Virus.Danger_Trojan.GenericKDZ.103285_23.vir, Virus.Danger_Trojan.GenericKDZ.103285_38.vir, Virus.Danger_Trojan.GenericKDZ.103285_42.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_113.vir, Virus.Hijack_Trojan.GenericKDZ.103285_13.vir, Virus.Hijack_Trojan.GenericKDZ.103285_198.vir, Virus.Hijack_Trojan.GenericKDZ.103285_250.vir, Virus.Hijack_Trojan.GenericKDZ.103285_253.vir, Virus.Hijack_Trojan.GenericKDZ.103285_299.vir, Virus.Hijack_Trojan.GenericKDZ.103285_374.vir, Virus.Hijack_Trojan.GenericKDZ.103285_643.vir, Virus.Hijack_Trojan.GenericKDZ.103285_701.vir, Virus.Hijack_Trojan.GenericKDZ.103285_724.vir, Virus.Hijack_Trojan.GenericKDZ.103285_733.vir, Virus.Hijack_Trojan.GenericKDZ.103285_885.vir, Virus.Hijack_Trojan.GenericKDZ.103285_889.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "cb5e0ac9be720ec02d89b39eb527615a13bb027bd7b0e358328f64789096a225"
    hash2       = "1573b5721cb75a3fcfd6956ee6215fb912188de12a37a36031d550bfe0f9a767"
    hash3       = "828dddd935808545fb1a41675445c2927d05d0f9e7d6140e362249048a286e2f"
    hash4       = "ac3b9482fd275a6ef99c1abadd7840ffb9e215e116d310e5b7e9ae4d377ebbf5"
    hash5       = "f0fa50c1134677e0d4209f96de1c1df0a3bae14ec378725c294482d67bb96ca9"
    hash6       = "a0a65ca4c63f96e558680055b5b46952d4189d039cf8f6c4624a685410e869f7"
    hash7       = "ae7f4122b09f74b8023028d294741cd8a7f5618bb23442a837e2b12333c4c88a"
    hash8       = "f542cf5914e508cf7ca39aab62f06cabf8a75f51f11f66c1e72aa917b16ce28e"
    hash9       = "2430c81eb0a058fdf58e913f4a262a8c97c354e1ab59ad9642b1c3584def978a"
    hash10      = "1a6ae7e3326f39c2d16f8f7bd051aa9ea0aadd01d9b4529e9fedb55a836428d4"
    hash11      = "e07cf3ab343a24991be44170892fbbe33f3a101db54262581c468efd434faf63"
    hash12      = "1b2e8349d32238bfe2c38a3cbab0e5388a5db3af4fac347a1a65947fd6254d11"
    hash13      = "3d3dd1689baf7d841c5a110923da05b9a9b10663a67fee8dc03ac0208ce8378a"
    hash14      = "c4e78a15d78f87c5c181833e23b17361129510f97bfd9436460e892cbdcf32c8"
    hash15      = "926d5d226bf35aafb3ddf15d633c913f5474500a9fd8f22bf089c3f8e83795f4"
    hash16      = "a4b325b92784fc6c33bd9157599db5fcb73c514d8952850e5019fef4c5301835"
    hash17      = "d290794b131f959df9ea15f5770ef9d9152ea409806885a21a89857b11128f0a"
    hash18      = "1a71b122847da54a0c6dc8c37219d1b2228d0ca4941739bec8074ecc1ee5b2e7"
    hash19      = "ab58e90fe7c6b47edd1e0f43e85be6c70f400c265d44cdcf78967bd55e6c3a58"
    hash20      = "1e9a4c8a5a3a4e6816c7b5f5cf244d20e8062e3e857311a2462a65395bac9194"
    hash21      = "8225ac1e8cd6ff7f9a51503718ee4f246c40dfe2584d3246e7bafed71ef76ee2"
    hash22      = "e57d85073273eec75eb25540c4dbbbb99cb387ce44d4253a8ee32be75d2875fc"
    hash23      = "1cc2fd16d126a440d712beaebf172de35b77eeba1efbca6379a0ce5a44ec6c9f"
    hash24      = "d4ba1a959e8d17dcd6349c6aad2a20ab661463d3b5b29cc5a28a8dfbf5d9f03f"
    hash25      = "4b7dbca89f6f9b4662c59e35c7e7376a06aa084c1313729b37fef8d420c15399"
    hash26      = "8c355d6de3f7d060cf92874160bea7045da61ca39caffc4e6c4c73d4d6cc61a4"
    hash27      = "2271198269b7cf9c363107d37278436eda512f0f18e3abd9cd52a4fa3719d203"
    hash28      = "737ba60baee979131552b11f77e0e06ff027ee9b2409f8c4764188ccc16fd069"
    hash29      = "6ea1afd36be2fb014d132d10cdff1167241e691201e3a2f988b670211028964f"
    hash30      = "0ae6b794c3f2e09633dfb8903092f4d3c85232097890ac9cfbd0a71bd53ffb7a"
    hash31      = "e361eceb92465260a1b009b5e1ca8bd41536ba21e063d7eb661d8634422056b6"
    hash32      = "d7cbfcd6bbffdfa2fb233722c936c4c90c84b01e059c1e515446bac5a5812120"
    hash33      = "fe6b77e414d0c1f197cb8a568a2510f81a16a21438ebb98d366cf7d2bbb587ce"
    hash34      = "4a7adec1f5754dccaedfde5e54309bc99eb4d215c1df5fc04b4d5ce8be1d9729"
    hash35      = "2192bbb8d226d4a76a34530c580ea5576e606cb8f87bfecde6a7cba6ad4e9b8c"
    hash36      = "c877983da22956d54a44fb939d039286531d9edd42fab97c98c71e9ef15db97f"
    hash37      = "b9d17c758205738c80a5c99c7a52d382f582865b28b5212c36284cc3f065d39c"
    hash38      = "2420e1fb1eb10827991510d3152e359b8483ca46f28c5c006a097e3d9e03ce34"
    hash39      = "bde6ff2ac02bde3450c09cd925949e5146a54bf39db75522bc8dff514ec05fc4"
    hash40      = "87b77d29689f22c3b280fcf810ba0383c99b80dcf5d4021410ee72128f403fea"
    hash41      = "40a19cbd99752a8d21638d455ab98726185072673902403fe22c13d332941ff3"
    hash42      = "56b9654fa1db1a910c2a94c16d04a246a99f28362f388bd58e40a38cdcfe9db7"
    hash43      = "aa3d385e5d7ccaec9fdfa0725224b7a37c150f193da11c485649be5b1a178001"
    hash44      = "8a95b4b1bfddb42069e35f55e4d72619a110d186f255a859b12efc86b8b00793"
    hash45      = "2214951fd7447ec7413a653f0f30504afda19dd3ab6237116e62ef18ce14aea9"
    hash46      = "49accc55b83ab8b7866ef97ec5b687b2ff469e5a68cf3ad3a41ff50e086b9af0"
    hash47      = "5c4cdd4970671a80efbc909e0b3498c9755938f2306943b839d20a8524696eb0"
    hash48      = "0f1a447bd77d7d38041c6de3aede6e149ceda37f84b9875b365f5d505fff3f96"
    hash49      = "7ef507a849656f5257d56f342915fb17b83c7d0a46c5ca893c038eb2193ce60c"
    hash50      = "6afe1ea813da9b45cb5dab6016e63b09708251bcce1f44f7cd369d13678bf761"
    hash51      = "5b4def75d321f497cef9a7c3dcab42c918a23c931712212a78aedbb58bdb09bf"
    hash52      = "dc49b95b32ac58b1e8dc29b6200342ba2eac72d5523df6aff701d4e08ec63dda"
    hash53      = "8c2f4abb86ec1940ecb263d4fbd3adfd80bcbc75c2969a78c0501f378ee7e050"
    hash54      = "d2f6087aae72382c3a440107df3632574c45f681e59da9d0bd097047aca0c628"
    hash55      = "46211ed60f9a6d143c8dc51123d004bf5e16cbbb30261cc5d352d31b794b44c8"
    hash56      = "a1ac897be1667921c1a52657f0263ff3082cfbc0536f147c17441e43b897813f"
    hash57      = "e30e5760a097953ebcf56afba370937f9b3823f3d015d690d2dc8dc87394efd5"

  strings:
    $s1  = ".?AU__abi_IDelegate@?$AsyncOperationCompletedHandler@P$AAVWebAccount@Credentials@Security@Windows@@@Foundation@Windows@@" fullword ascii
    $s2  = ".?AV?$AsyncOperationCompletedHandler@P$AAVWebAccount@Credentials@Security@Windows@@@Foundation@Windows@@" fullword ascii
    $s3  = ".?AU?$IAsyncOperation@P$AAVAggregateAnnotationCollection@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft" ascii
    $s4  = ".?AU?$IAsyncOperation@P$AAVAggregateAnnotationCollection@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft" ascii
    $s5  = ".?AU__I?$VectorView@P$AAVAggregateAnnotation@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@U?$equal_t" ascii
    $s6  = ".?AU__I?$_AsyncInfoBase@U?$_AsyncAttributes@XP$AAVAggregateAnnotationCollection@AnnotationsProcessing@ContactCardData@NativeComp" ascii
    $s7  = ".?AU__I?$IteratorForVectorView@P$AAVAggregateAnnotation@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@" ascii
    $s8  = ".?AU__I?$Vector@P$AAVAggregateAnnotation@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@U?$equal_to@P$" ascii
    $s9  = ".?AU__I?$Array@P$AAVAggregateAnnotation@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@$00PublicNonVir" ascii
    $s10 = ".?AV?$_Func_base@V?$task@P$AAVAggregateAnnotationCollection@AnnotationsProcessing@ContactCardData@NativeComponents@People@Micros" ascii
    $s11 = ".?AV?$_Func_impl_no_alloc@V<lambda_326c335d429e5f062a6b738c0b04934b>@@V?$task@P$AAVAggregateAnnotationCollection@AnnotationsProc" ascii
    $s12 = ".?AU__I?$Array@P$AAVAggregateAnnotation@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@$00PublicNonVir" ascii
    $s13 = "AAVAggregateAnnotation@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@@std@@$00PublicNonVirtuals@Colle" ascii
    $s14 = "o@P$AAVAggregateAnnotation@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@@std@@$00PublicNonVirtuals@C" ascii
    $s15 = ".?AU__I?$WriteOnlyArray@P$AAVAggregateAnnotation@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@$00Pub" ascii
    $s16 = ".?AU__abi_IDelegate@?$AsyncOperationCompletedHandler@P$AAU?$IVectorView@P$AAVChatMessageTransport@Chat@ApplicationModel@Windows@" ascii
    $s17 = ".?AV?$AsyncOperationCompletedHandler@P$AAU?$IVectorView@P$AAVChatMessageTransport@Chat@ApplicationModel@Windows@@@Collections@Fo" ascii
    $s18 = ".?AU__abi_IDelegate@?$AsyncOperationCompletedHandler@P$AAU?$IVectorView@P$AAVChatMessageTransport@Chat@ApplicationModel@Windows@" ascii
    $s19 = ".?AV?$AsyncOperationCompletedHandler@P$AAU?$IVectorView@P$AAVChatMessageTransport@Chat@ApplicationModel@Windows@@@Collections@Fo" ascii
    $s20 = ".?AV?$_Func_impl_no_alloc@V<lambda_6c144981f825f566a2a42e6882342256>@@V?$vector@P$AAVAggregateAnnotation@AnnotationsProcessing@C" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "26babd76bbb7f9c516a338b0601b4c9f" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

63eedd06-4539-44a4-9d0a-cddc99819a7b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion