_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_463_1_Trojan_Danger_Ge_40

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_463_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_58_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_67_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.EB23919E_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_209_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_21_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_101_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_106_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_138_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_30_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_25_1.vir, Virus.Danger_Gen.Trojan.ShellObject.avZ@amBwvTb.vir, Virus.Danger_Trojan.GenericKDZ.103285_42.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_23.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_25.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_108.vir, Virus.Hijack_Trojan.GenericKDZ.103285_138.vir, Virus.Hijack_Trojan.GenericKDZ.103285_176.vir, Virus.Hijack_Trojan.GenericKDZ.103285_205.vir, Virus.Hijack_Trojan.GenericKDZ.103285_252.vir, Virus.Hijack_Trojan.GenericKDZ.103285_313.vir, Virus.Hijack_Trojan.GenericKDZ.103285_315.vir, Virus.Hijack_Trojan.GenericKDZ.103285_360.vir, Virus.Hijack_Trojan.GenericKDZ.103285_377.vir, Virus.Hijack_Trojan.GenericKDZ.103285_455.vir, Virus.Hijack_Trojan.GenericKDZ.103285_548.vir, Virus.Hijack_Trojan.GenericKDZ.103285_643.vir, Virus.Hijack_Trojan.GenericKDZ.103285_687.vir, Virus.Hijack_Trojan.GenericKDZ.103285_7.vir, Virus.Hijack_Trojan.GenericKDZ.103285_730.vir, Virus.Hijack_Trojan.GenericKDZ.103285_816.vir, Virus.Hijack_Trojan.GenericKDZ.103285_85.vir, Virus.Hijack_Trojan.GenericKDZ.103285_851.vir, Virus.Hijack_Trojan.GenericKDZ.103285_890.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_463_1_Trojan_Danger_Ge_40 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_463_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_58_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_67_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.EB23919E_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_209_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_21_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_101_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_106_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_138_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_30_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_25_1.vir, Virus.Danger_Gen.Trojan.ShellObject.avZ@amBwvTb.vir, Virus.Danger_Trojan.GenericKDZ.103285_42.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.avZ@amBwvTb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_23.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_25.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_108.vir, Virus.Hijack_Trojan.GenericKDZ.103285_138.vir, Virus.Hijack_Trojan.GenericKDZ.103285_176.vir, Virus.Hijack_Trojan.GenericKDZ.103285_205.vir, Virus.Hijack_Trojan.GenericKDZ.103285_252.vir, Virus.Hijack_Trojan.GenericKDZ.103285_313.vir, Virus.Hijack_Trojan.GenericKDZ.103285_315.vir, Virus.Hijack_Trojan.GenericKDZ.103285_360.vir, Virus.Hijack_Trojan.GenericKDZ.103285_377.vir, Virus.Hijack_Trojan.GenericKDZ.103285_455.vir, Virus.Hijack_Trojan.GenericKDZ.103285_548.vir, Virus.Hijack_Trojan.GenericKDZ.103285_643.vir, Virus.Hijack_Trojan.GenericKDZ.103285_687.vir, Virus.Hijack_Trojan.GenericKDZ.103285_7.vir, Virus.Hijack_Trojan.GenericKDZ.103285_730.vir, Virus.Hijack_Trojan.GenericKDZ.103285_816.vir, Virus.Hijack_Trojan.GenericKDZ.103285_85.vir, Virus.Hijack_Trojan.GenericKDZ.103285_851.vir, Virus.Hijack_Trojan.GenericKDZ.103285_890.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "cb5e0ac9be720ec02d89b39eb527615a13bb027bd7b0e358328f64789096a225"
    hash2       = "3d9d41e32338b408beb5d58345acae825d2b83bdb1a869bf1d01f0b236c78218"
    hash3       = "106f321a78ebe60da4d12e151feba0138035ff2fc0d4ad14cb19459686ee345e"
    hash4       = "f64341f3c83436c560abbe8d9f87c9a201ff4080f0d66eb56717df1b3bc79230"
    hash5       = "3d3dd1689baf7d841c5a110923da05b9a9b10663a67fee8dc03ac0208ce8378a"
    hash6       = "90ac7b6bebde17a7165cf04350fde3b05f9077b9e2c0fc68ecd865e9a79aeea3"
    hash7       = "d290794b131f959df9ea15f5770ef9d9152ea409806885a21a89857b11128f0a"
    hash8       = "b4a2f49815622bbd411588849be587d08cdc6868822183cbcd17eb3a69032514"
    hash9       = "f27f546f8c4016b59ed24d27eb4c7483a22932316f69cc12c513005ca9f87421"
    hash10      = "f78ac2c4770a9be463359940fd2c6363fd6527df504124c5ea80e3286719ad2b"
    hash11      = "08713a77d4939297c8c67fdc2176673ec7b20169dd833f54ad586650789818c5"
    hash12      = "50480b95466c269d0dced47345379290e89b2b3e1e96044c29d71675591db8bc"
    hash13      = "d4ba1a959e8d17dcd6349c6aad2a20ab661463d3b5b29cc5a28a8dfbf5d9f03f"
    hash14      = "4e75ae9d9dbd3518a6b785ef0bfa8ece07b1e8153e7a45e2014cedd9bdef766f"
    hash15      = "699b304aca219bebd6cf55f335c304ca8abd4e0924eafa06b5951d48083443b1"
    hash16      = "ea10c28197efeeb09d9b65655ccae5814b2c3a6841a7ec0f437f47ecef08ef94"
    hash17      = "0b9de1dffa8fff5c6492fd54f3bd2260c3022aa246bb0f4ce99cb0c235feb714"
    hash18      = "fa4aa46c348fcf8adb349528a1a7ff45ea53bbaf3cd32071ffa31816474e148b"
    hash19      = "51c5de3425f0cbfb9726f7c027d211f22a6aa33f53a366be654c28e749f2f1a7"
    hash20      = "ef0fb513f3a03523ab7f9232324772c49cf2fbd567405866959616bc0514dbc2"
    hash21      = "2978a597993f87c6c721bdb8365a1931e9ee7958128ae25fd2c3ffc32383e4fd"
    hash22      = "b769ee2cfe74d64744d5a4e58a97bd7e2adbf8a9f7815a286f69a530b3d321a2"
    hash23      = "0e6c3f97bcc54566688ce571adcc3146a9fcbc70e61daac537e7243407ad3201"
    hash24      = "175d0161312e7fdd3241a66b89e213ac3ef199aebeb1aea4962b71df312fea6f"
    hash25      = "340f5186d49e9437949ef2a91772027b07c29a618c98dd7c7283ea0f01864a75"
    hash26      = "88b1a0e64969cd25153289560479da3b464f925a767d00b181b9a7ad7f3439c5"
    hash27      = "043b8d856a1e579719537f54696d96d7faa6bfba9e80769b5f72072166ee926d"
    hash28      = "bbe103c836e5925aa2dd616563ff6bab0bb351f73e2e4939d31284dd5e9ae37c"
    hash29      = "95618e72570534d55ba012f1a24a69e0430aab6b248ea8543335985e0e01a789"
    hash30      = "329b6427168cd26646fb49b237622c478cf710c73ea3ea1cd6955f746529be04"
    hash31      = "1e033bec99714da353a1fb2e587886df2751aa128a871f996736481e406829e1"
    hash32      = "47b01310046ca04e03b610a57e924a2de3a512369d73678d812ddfaba0f3ad8d"
    hash33      = "4086337aca0b59e994ad5ab5d42660b4ac470d289761c53c81632c3e6fca0a60"
    hash34      = "ddcb36cce8000ebe5c5930bc657f93f653f7160f767ccd1ca9f30cf883445aba"
    hash35      = "ef7c2b2285332c2fcb9027574422dc382baf2e2a594a23f4a4a31069b6c742d9"
    hash36      = "cd5bd2d07300ed64dfd80e042250a17ff00dfb4b5395d41ca1e025e1f5a1e2e2"
    hash37      = "8ac5896beb17e75f97e3a6d47787fb019a9d5517f3ce90dc05203346671c33c3"
    hash38      = "ffe20ded8f8a2735fb8a407fd3575316774a0566e062224436ede67b2728349c"
    hash39      = "ee16e7a30f07308b8bbb09ff68387f063199dc73f967114aaf2ff4cdbd587ac9"
    hash40      = "1f0b1a8b795283278986cf0f2b8fbf834cb0485db036346feb2027d216dc8f66"
    hash41      = "7e154d4af20f86eed4ce033afd512ecb5a0cd88a1d02e78a20d686911f9ffa5c"
    hash42      = "e1da5521cabe460605053e5b85884b5e29794a23a2de51bc2f733fecedab569c"
    hash43      = "8190697b64bf98ea104360902bdb2a8a2826fb8a2a3d90ecee26c2693234d7e2"
    hash44      = "d7de0f12bbbb41ecf2f8e1d57267bb4d14dbf239afaa9a021a8ece5079707b26"
    hash45      = "2faf7c47f12e37afcdc441e29ab3802da6407b25ea4d09c2100ed9bea4b48e9f"
    hash46      = "e67306d4d8971ee1825dea77aca9a629d2fb49f32deffcfa4589bdf83adae633"
    hash47      = "d8e7de61b278e2c1186383531fded029bcc493aa8dc8eb1fe83445b7c6d35bd3"
    hash48      = "d3ac8c391f936dff784c8585c863566576d4bc4c402cbfdfbe6ad17f8e18bd9c"
    hash49      = "4f14e005684e1dd94294147f56a7bebc81d475150629f931b093381f15d74099"
    hash50      = "011a19f63aa614695bfce30a490cbf83c6a6ac5b172886d414123af5e69e1cbc"
    hash51      = "c26a493cbd39fa1a670ab3645a54a564c753f1b62d0382fcec9e8dbe2b607f1d"
    hash52      = "89b20fb3cb7971a223e70c9bb04e9ee2e34d62b8d70c4b3d2c92013d6d0196c9"
    hash53      = "dc49b95b32ac58b1e8dc29b6200342ba2eac72d5523df6aff701d4e08ec63dda"
    hash54      = "34b19967eb0b3e6351eb83879c63887676a941fef0347a72748dbecf3c65666e"
    hash55      = "51fd59f3647ffd9e16d10fdffa236cf54ccb41b9287c850a922fcacfba46e82a"
    hash56      = "6d51c5fb878f0aad22d07a1a41507311ccfea0bf52d83a019068a278828eb787"
    hash57      = "0aab329853a7daed5baf5abe0061e6d8a46d84434d0d08a6108b71dc584c1893"
    hash58      = "b0ba2e6d6317103085fa51c59ac0b42002ec1063bd13adf69e66b9eca33fcabf"
    hash59      = "cb13f1aa54ec3ba2c52faace8149d38d3d4b9748d52a0a1a3472cc7128a9e596"
    hash60      = "1b13a5f5fb36c31cfcbb30ab4f09cedfc21247603278f0ad9eb8066a84f8c837"

  strings:
    $s1  = "Exception in ExecuteVisualCommand" fullword ascii
    $s2  = "Exception in ExecuteDataCommand" fullword ascii
    $s3  = "rFile load error Mso::BI::Persistence::XmlReader::XmlReader: Failed to set prohibit DTD processing on create XmlLite reader" fullword wide
    $s4  = "SetVisualPropertyToDefaultWithUndoVisitor failed to create an undo command" fullword ascii
    $s5  = "eFile load error Mso::BI::Persistence::XmlReader::GetNamespace: Failed to get namespace URI" fullword wide
    $s6  = "File load error Mso::BI::Persistence::XmlReader::GetDepth: Failed to get the depth" fullword wide
    $s7  = "Could not Retrieve E2oFrameMoniker from parent ContentMoniker" fullword ascii
    $s8  = "?GetDepth@XmlReader@Persistence@BI@Mso@@QAEIXZ" fullword ascii
    $s9  = "Source ArtHostDocument is null for CmdChangeVisualType::CmdChangeVisualType" fullword ascii
    $s10 = "?GetValueString@XmlReader@Persistence@BI@Mso@@AAEXAAPB_WAAI@Z" fullword ascii
    $s11 = "?Perform@VisualCmdBase@BI@Mso@@UBEXAAVIProgress@Ofc@@AAVCRollbackTransaction@5@PBUCommandPerformParams@5@@Z" fullword ascii
    $s12 = "Source HostDocument is null for CmdReplaceVisual::CmdReplaceVisual" fullword ascii
    $s13 = "?GetNamespace@XmlReader@Persistence@BI@Mso@@QAEXAAPB_WAAI@Z" fullword ascii
    $s14 = "?GetNamespaceVersion@VersionTracker@Persistence@BI@Mso@@QBEIXZ" fullword ascii
    $s15 = "Source ArtHostDocument is null for CmdReplaceVisual::CmdReplaceVisual" fullword ascii
    $s16 = "Source HostDocument is null for CmdChangeVisualType::CmdChangeVisualType" fullword ascii
    $s17 = "?GetNodeType@XmlReader@Persistence@BI@Mso@@QAE?AW4NodeType@234@XZ" fullword ascii
    $s18 = "Could not Retrieve VisualMoniker from ContentMoniker" fullword ascii
    $s19 = "?GetLocalName@XmlReader@Persistence@BI@Mso@@QAEXAAPB_WAAI@Z" fullword ascii
    $s20 = "Parent ContentMoniker is null" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "26babd76bbb7f9c516a338b0601b4c9f" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a36999a9-0ccc-4037-af3a-d7158dd8cc4e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion