_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_463_1_Trojan_Danger_Ge_15

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_463_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_535_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_541_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_36_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_40_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.600D51C8_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_110_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_197_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_209_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_267_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_33_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_101_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_150_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_3_1.vir, Virus.Danger_Trojan.GenericKDZ.103285_23.vir, Virus.Danger_Trojan.GenericKDZ.103285_42.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_113.vir, Virus.Hijack_Trojan.GenericKDZ.103285_13.vir, Virus.Hijack_Trojan.GenericKDZ.103285_250.vir, Virus.Hijack_Trojan.GenericKDZ.103285_374.vir, Virus.Hijack_Trojan.GenericKDZ.103285_643.vir, Virus.Hijack_Trojan.GenericKDZ.103285_701.vir, Virus.Hijack_Trojan.GenericKDZ.103285_724.vir, Virus.Hijack_Trojan.GenericKDZ.103285_733.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_463_1_Trojan_Danger_Ge_15 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_463_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_535_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_541_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_36_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_40_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.600D51C8_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_110_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_197_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_209_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_267_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_33_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_101_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_150_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_3_1.vir, Virus.Danger_Trojan.GenericKDZ.103285_23.vir, Virus.Danger_Trojan.GenericKDZ.103285_42.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.tvZ@amBwvTb_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_113.vir, Virus.Hijack_Trojan.GenericKDZ.103285_13.vir, Virus.Hijack_Trojan.GenericKDZ.103285_250.vir, Virus.Hijack_Trojan.GenericKDZ.103285_374.vir, Virus.Hijack_Trojan.GenericKDZ.103285_643.vir, Virus.Hijack_Trojan.GenericKDZ.103285_701.vir, Virus.Hijack_Trojan.GenericKDZ.103285_724.vir, Virus.Hijack_Trojan.GenericKDZ.103285_733.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "cb5e0ac9be720ec02d89b39eb527615a13bb027bd7b0e358328f64789096a225"
    hash2       = "1573b5721cb75a3fcfd6956ee6215fb912188de12a37a36031d550bfe0f9a767"
    hash3       = "828dddd935808545fb1a41675445c2927d05d0f9e7d6140e362249048a286e2f"
    hash4       = "f0fa50c1134677e0d4209f96de1c1df0a3bae14ec378725c294482d67bb96ca9"
    hash5       = "a0a65ca4c63f96e558680055b5b46952d4189d039cf8f6c4624a685410e869f7"
    hash6       = "f542cf5914e508cf7ca39aab62f06cabf8a75f51f11f66c1e72aa917b16ce28e"
    hash7       = "1a6ae7e3326f39c2d16f8f7bd051aa9ea0aadd01d9b4529e9fedb55a836428d4"
    hash8       = "1b2e8349d32238bfe2c38a3cbab0e5388a5db3af4fac347a1a65947fd6254d11"
    hash9       = "3d3dd1689baf7d841c5a110923da05b9a9b10663a67fee8dc03ac0208ce8378a"
    hash10      = "c4e78a15d78f87c5c181833e23b17361129510f97bfd9436460e892cbdcf32c8"
    hash11      = "a4b325b92784fc6c33bd9157599db5fcb73c514d8952850e5019fef4c5301835"
    hash12      = "d290794b131f959df9ea15f5770ef9d9152ea409806885a21a89857b11128f0a"
    hash13      = "ab58e90fe7c6b47edd1e0f43e85be6c70f400c265d44cdcf78967bd55e6c3a58"
    hash14      = "1e9a4c8a5a3a4e6816c7b5f5cf244d20e8062e3e857311a2462a65395bac9194"
    hash15      = "e57d85073273eec75eb25540c4dbbbb99cb387ce44d4253a8ee32be75d2875fc"
    hash16      = "d4ba1a959e8d17dcd6349c6aad2a20ab661463d3b5b29cc5a28a8dfbf5d9f03f"
    hash17      = "2420e1fb1eb10827991510d3152e359b8483ca46f28c5c006a097e3d9e03ce34"
    hash18      = "bde6ff2ac02bde3450c09cd925949e5146a54bf39db75522bc8dff514ec05fc4"
    hash19      = "87b77d29689f22c3b280fcf810ba0383c99b80dcf5d4021410ee72128f403fea"
    hash20      = "40a19cbd99752a8d21638d455ab98726185072673902403fe22c13d332941ff3"
    hash21      = "56b9654fa1db1a910c2a94c16d04a246a99f28362f388bd58e40a38cdcfe9db7"
    hash22      = "aa3d385e5d7ccaec9fdfa0725224b7a37c150f193da11c485649be5b1a178001"
    hash23      = "8a95b4b1bfddb42069e35f55e4d72619a110d186f255a859b12efc86b8b00793"
    hash24      = "2214951fd7447ec7413a653f0f30504afda19dd3ab6237116e62ef18ce14aea9"
    hash25      = "49accc55b83ab8b7866ef97ec5b687b2ff469e5a68cf3ad3a41ff50e086b9af0"
    hash26      = "0f1a447bd77d7d38041c6de3aede6e149ceda37f84b9875b365f5d505fff3f96"
    hash27      = "5b4def75d321f497cef9a7c3dcab42c918a23c931712212a78aedbb58bdb09bf"
    hash28      = "dc49b95b32ac58b1e8dc29b6200342ba2eac72d5523df6aff701d4e08ec63dda"
    hash29      = "8c2f4abb86ec1940ecb263d4fbd3adfd80bcbc75c2969a78c0501f378ee7e050"
    hash30      = "d2f6087aae72382c3a440107df3632574c45f681e59da9d0bd097047aca0c628"
    hash31      = "46211ed60f9a6d143c8dc51123d004bf5e16cbbb30261cc5d352d31b794b44c8"

  strings:
    $s1  = ".?AU?$IAsyncOperation@P$AAU?$IVectorView@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@" ascii
    $s2  = ".?AU?$__abi_FunctorCapture@V<lambda_393bc439ba335407d51f0509169a5c0c>@@XP$AAU?$IAsyncOperation@P$AAVAggregateAnnotationCollectio" ascii
    $s3  = ".?AU__abi_IDelegate@?$AsyncOperationCompletedHandler@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeCompon" ascii
    $s4  = ".?AU?$IAsyncOperation@P$AAU?$IVectorView@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@" ascii
    $s5  = ".?AU__abi_IDelegate@?$AsyncOperationCompletedHandler@P$AAU?$IVectorView@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCa" ascii
    $s6  = ".?AU?$IAsyncOperation@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@@Foundat" ascii
    $s7  = ".?AU?$__abi_FunctorCapture@V<lambda_c6656b49f2501d4f9f764f55e1323e43>@@XP$AAU?$IAsyncOperation@P$AAU?$IVectorView@P$AAUIContactC" ascii
    $s8  = ".?AV?$AsyncOperationCompletedHandler@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@Micr" ascii
    $s9  = ".?AU?$__abi_FunctorCapture@V<lambda_7bd136e48940ecd6cbcd11b3d7f4d8e8>@@XP$AAU?$IAsyncOperation@P$AAUIContactCardAppInfo@Annotati" ascii
    $s10 = ".?AU?$IAsyncOperation@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@@Foundat" ascii
    $s11 = ".?AV?$AsyncOperationCompletedHandler@P$AAU?$IVectorView@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeCom" ascii
    $s12 = ".?AU__abi_IDelegate@?$AsyncOperationCompletedHandler@P$AAVAggregateAnnotationCollection@AnnotationsProcessing@ContactCardData@Na" ascii
    $s13 = ".?AV?$AsyncOperationCompletedHandler@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@Micr" ascii
    $s14 = ".?AV?$AsyncOperationCompletedHandler@P$AAVAggregateAnnotationCollection@AnnotationsProcessing@ContactCardData@NativeComponents@P" ascii
    $s15 = ".?AV?$_Func_impl_no_alloc@V<lambda_b59d6075917e0549ad566ce5c1079d48>@@V?$task@P$AAU?$IVectorView@P$AAUIContactCardAppInfo@Annota" ascii
    $s16 = ".?AV?$_Func_base@V?$task@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@@Conc" ascii
    $s17 = ".?AU__I?$_AsyncInfoBase@U?$_AsyncAttributes@XP$AAU?$IVectorView@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@N" ascii
    $s18 = "o@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@@std@@$00PublicNonVirtuals@C" ascii
    $s19 = ".?AV?$_Func_base@V?$task@P$AAU?$IVectorView@P$AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@Peop" ascii
    $s20 = "AAUIContactCardAppInfo@AnnotationsProcessing@ContactCardData@NativeComponents@People@Microsoft@@@std@@$00PublicNonVirtuals@Colle" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "26babd76bbb7f9c516a338b0601b4c9f" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7412893b-1484-4b39-ba95-b1539e33808b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion