_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_537_1_Trojan_Danger_Ge_123

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_537_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_140_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_17_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2D3D82A8_6_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_18_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_223_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_83_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_15_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_42.vir, Virus.Danger_Gen.Trojan.ShellObject.KuZ@aKo42Jj.vir, Virus.Danger_Gen.Trojan.ShellObject.puZ@aKo42Jj.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.WuZ@aKo42Jj.vir, Virus.Hijack_Gen.Trojan.ShellObject.WuZ@aKo42Jj_1.vir, Virus.Hijack_Trojan.GenericKDZ.103285_121.vir, Virus.Hijack_Trojan.GenericKDZ.103285_157.vir, Virus.Hijack_Trojan.GenericKDZ.103285_181.vir, Virus.Hijack_Trojan.GenericKDZ.103285_220.vir, Virus.Hijack_Trojan.GenericKDZ.103285_262.vir, Virus.Hijack_Trojan.GenericKDZ.103285_387.vir, Virus.Hijack_Trojan.GenericKDZ.103285_412.vir, Virus.Hijack_Trojan.GenericKDZ.103285_438.vir, Virus.Hijack_Trojan.GenericKDZ.103285_503.vir, Virus.Hijack_Trojan.GenericKDZ.103285_595.vir, Virus.Hijack_Trojan.GenericKDZ.103285_61.vir, Virus.Hijack_Trojan.GenericKDZ.103285_627.vir, Virus.Hijack_Trojan.GenericKDZ.103285_656.vir, Virus.Hijack_Trojan.GenericKDZ.103285_73.vir, Virus.Hijack_Trojan.GenericKDZ.103285_740.vir, Virus.Hijack_Trojan.GenericKDZ.103285_753.vir, Virus.Hijack_Trojan.GenericKDZ.103285_770.vir, Virus.Hijack_Trojan.GenericKDZ.103285_788.vir, Virus.Hijack_Trojan.GenericKDZ.103285_820.vir, Virus.Hijack_Trojan.GenericKDZ.103285_84.vir, Virus.Hijack_Trojan.GenericKDZ.103285_859.vir, Virus.Hijack_Trojan.GenericKDZ.103285_93.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_537_1_Trojan_Danger_Ge_123 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_537_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_140_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_17_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2D3D82A8_6_1.vir, Trojan.Danger_Trojan.GenericKD.67064203_18_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_223_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_83_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_15_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_42.vir, Virus.Danger_Gen.Trojan.ShellObject.KuZ@aKo42Jj.vir, Virus.Danger_Gen.Trojan.ShellObject.puZ@aKo42Jj.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@aKo42Jj_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.WuZ@aKo42Jj.vir, Virus.Hijack_Gen.Trojan.ShellObject.WuZ@aKo42Jj_1.vir, Virus.Hijack_Trojan.GenericKDZ.103285_121.vir, Virus.Hijack_Trojan.GenericKDZ.103285_157.vir, Virus.Hijack_Trojan.GenericKDZ.103285_181.vir, Virus.Hijack_Trojan.GenericKDZ.103285_220.vir, Virus.Hijack_Trojan.GenericKDZ.103285_262.vir, Virus.Hijack_Trojan.GenericKDZ.103285_387.vir, Virus.Hijack_Trojan.GenericKDZ.103285_412.vir, Virus.Hijack_Trojan.GenericKDZ.103285_438.vir, Virus.Hijack_Trojan.GenericKDZ.103285_503.vir, Virus.Hijack_Trojan.GenericKDZ.103285_595.vir, Virus.Hijack_Trojan.GenericKDZ.103285_61.vir, Virus.Hijack_Trojan.GenericKDZ.103285_627.vir, Virus.Hijack_Trojan.GenericKDZ.103285_656.vir, Virus.Hijack_Trojan.GenericKDZ.103285_73.vir, Virus.Hijack_Trojan.GenericKDZ.103285_740.vir, Virus.Hijack_Trojan.GenericKDZ.103285_753.vir, Virus.Hijack_Trojan.GenericKDZ.103285_770.vir, Virus.Hijack_Trojan.GenericKDZ.103285_788.vir, Virus.Hijack_Trojan.GenericKDZ.103285_820.vir, Virus.Hijack_Trojan.GenericKDZ.103285_84.vir, Virus.Hijack_Trojan.GenericKDZ.103285_859.vir, Virus.Hijack_Trojan.GenericKDZ.103285_93.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "213a9788c52ddd5521986de34768c51faa56e60d7dca50d42cf4839fefa1dfe4"
    hash2       = "9381f91671a894791fe85ce977bf38aea3808e6981da63cb418e93dc918bce44"
    hash3       = "1beb88648522c0816b68b02d6e64862f813e8afc3b26c4e3b85c649c7599c9ba"
    hash4       = "ea2812f787ab252349f355633157cb2b062eabff10368860a354dca22ee8d664"
    hash5       = "d9d520a31cdc9bfd975f0486ab911e9a1c27112ce0f254ef9e89bc78ecaf312a"
    hash6       = "c9cb1b1dd348300b56df90ef5aa6709af47c677360491c3990ee124a57320c11"
    hash7       = "de9c46ecc8920c894d5dfc42f13f6fa4218554d274ce7beb420c74bc66f36428"
    hash8       = "a19c820fb1d90391a1c43551c51f11fd53281dfeffcd3791ca18fcb7ffd51035"
    hash9       = "8817d4adb0340236f833bc14d2e9426fdac2f6fb506f272d7e550e36e2e373cb"
    hash10      = "ea7819ad3567a53ed5d6afee7b0a417f0eff0472f19dba87dca80dd5f8a55e88"
    hash11      = "0c287b856134167d4d82e272237cf752854b7d98f75d6b0583212175703bbe41"
    hash12      = "f76f79135529bf75baad6843e8b256c46524799d6c7c7b5490e02d09337ce5ba"
    hash13      = "cd33b62756c72ad1040804e5992885e0902b03d65a3be80d07aec9839c18f75b"
    hash14      = "3572fbcb1cb8510aa3f68e53b39671baa2dfcd3c4cab7ba32b60c322c021dc6e"
    hash15      = "b30ea693af0b5d94c2a7c848c686ade9272f8b847fd8bf2756f9aef854935de7"
    hash16      = "bcb66d6c3363da65e8a6ab8d9c93597195a6512d8c6a01882d271e771828e7a5"
    hash17      = "eb3c7c1e3bbec9a98da3cff15a0c2e00371dd0ad3ba79096aab9a3fb5c04cc8a"
    hash18      = "f4234e6982c6d8e484c50aa0d8ece6422688d5071d62a5e58bd94cdc90b5c0bf"
    hash19      = "38e78f29e586f7faf50f4de85fd2613fae9cc1fcd446beb646f8b2ae2136ea5a"
    hash20      = "7c9e30586fe34935e5cba1bf59eb446e0155c9d1c154acc92cbbf1863538ea3c"
    hash21      = "a22e833fd93ef904614e5a211d7aa916a82d6693c620c2cad5d75bc87d4b11aa"
    hash22      = "0e77f688de08b23ba3eb0cac19d38a8cdc9c66af32677063cd2a9f7d6afbd1da"
    hash23      = "00d1f42c3b531e97efa60663a1699dafb0f64a4cbab1140f6558564f12c436f9"
    hash24      = "6b1828617ed212040c9735e578c72bce33b0e399ad1076d442592922de388f90"
    hash25      = "8ec8325110d0c5f6b4a0a055d37a62d2df6323b46c392a5ceb089eb0b11f0190"
    hash26      = "cb0f4cbeefd4bd573b0c52fb1a3bf91ac1dafa413f0ffb267c4750935890bfac"
    hash27      = "270973fa35bbb726f1c85354d1f26f90c5be5cf98a47ba1f1720001e100cd6e8"
    hash28      = "59727d17058eb191e8dc2b363298ac2fb3a374948b2dcd0d3a836865b63b12d8"
    hash29      = "5fc1ff16adf53d5993e7f016e056261ea0b0ddef70382d70f3197defecb11a7d"
    hash30      = "607dba1e9b9ed889ad456c8ff28f220654855f5bc94530f8d70cfd52ccfe507a"
    hash31      = "e8aa64a6bff1def932939c4a031eadf703dafebf50b63125784f9ba36e81bd1e"
    hash32      = "658b36b5abfa60b04159cc41464e3c86b2bc51a6f8ecbbfc463d363d28ef6f53"
    hash33      = "fbcff2e3f6aa12406d74b54d8ea5f4e0a530a943be3bf927ab67d14c26e1e067"
    hash34      = "94349b088bf03f798b363bfa86b1c902dfcb879864f7e986355378e12df39970"
    hash35      = "e57d4ec3a82c10bee6ee296422f4149ad375c06aebdc91f8e0636ae36bcc4e77"
    hash36      = "8c8b869401d4159d812836ffc1199520271d60b4e1042537048858a004fd54bd"
    hash37      = "56a0b3147d03ef273b151ae79181289edb60b55bdc099f1a50db70ebd6d764ab"
    hash38      = "172c94556865cd219c4ee8dc48a71751662d96866270555581ad89478502c397"
    hash39      = "3bc2bd8a07b6b3bbfac81a7578c22e4ae2506509d81868414ff49b06168c6bc1"
    hash40      = "016bb17a4eda22002c3641456368e5e10a6d2335f753137d4697fdb065d9e112"
    hash41      = "01526a3efd937802a9e9c582fcacabc0e5575c097557a77a560df6b2fb62455f"
    hash42      = "4fca92a43a63b11a1d5b5b034369dbb670cba56b52a6bd40233cd6861232203d"
    hash43      = "87d1fc4dac732852382e9c883fa5199ad2cec2236afc9cc30525bf9aaeb26f31"
    hash44      = "5691dd50c91bed8b2c2f3242233c29fd6f52ef0675605ce6d2e539d4093c7d45"
    hash45      = "01ea641c583562580801f77ca56a910134bad51e12e2497f2c23bea74555fb92"
    hash46      = "8d685ed788defd1c0e921037f7905763e61926bc40855e805b1b941a1a76ace9"
    hash47      = "8cc4b4875701b47de92973e0a3da08a7c9e058c8683eb37044aa208d7cf02b15"
    hash48      = "18892cb0d533c0e9f7c2de37a102c716cd5a1f4e67c35fe7a65d27df1ee096f7"
    hash49      = "161064fc491279a561236422759024a2f852d1ef165befc28336a4f6b7dea6df"
    hash50      = "feea867e313b13919d7c43ce078cb986649c9902dbbaac24b6601471ec151c0c"
    hash51      = "adb7cb0d6650ba0cc247aeb563b3dbc148c37b137a1058abf128ff7fb885897d"
    hash52      = "071df07efa3feea3eb577da128f4bb55dec2df3711ecb2ff3b6dd7db25f3ac43"
    hash53      = "571e79f82d18b591a221bed07bc646520b3a4ad2991375479ea42fa4722bd702"
    hash54      = "155f9e20bd6636c5f3f3e0b25fe42937a7ba13dcb93d07597399d21b7ba51e53"
    hash55      = "334248fabddab21f492487fa52c0c9ad4d265f4e73d7a14ba5e90826b719863b"
    hash56      = "f62bff0ac2874a4580bc728d3e5caaf4b28f0bcb14d5d8b2fa3464da9603b80f"
    hash57      = "26a1843a873d8e6e3c85345b68862ecedca2e3a58c73e47a38d8ec53ee51ab52"
    hash58      = "8b5dc0e6c47a361c683d5f9523790f751378008e734be1758d0ff31d4aa728bd"
    hash59      = "d564e852271966fcd83374f2130d4fcce8d17a843d3cf36b73a8ed8b398d004e"
    hash60      = "fb4af998a8f2be7495e7119dee8f3900a6c9643ccdbf134a167cec8b9d18c901"
    hash61      = "953d355b1376069cc5fa250689e92b0f9dbaa7fe42d26d3bd27db2a2963c9870"
    hash62      = "cc8fcd220e03df601aca5884316ed38007063b213acb5da506d78f2cbb3b0fab"

  strings:
    $s1  = "%24s:%5d [%-10s] %-32s| pri=%u - processing in-ram batch %u" fullword ascii
    $s2  = "%s(%d): %s ERROR  : [EVENTFLOW]: Package dropped - over retry limit: event priority=%d, event count=%d, retry count=%d, retry li" ascii
    $s3  = "%s(%d): %s ERROR  : [EVENTFLOW]: Package dropped - failed to save to offline storage: event priority=%d, event count=%d, retry c" ascii
    $s4  = "%s(%d): %s ERROR  : [EVENTFLOW]: Package dropped - failed to save to offline storage: event priority=%d, event count=%d, retry c" ascii
    $s5  = "%s(%d): %s ERROR  : [EVENTFLOW]: Package dropped - over retry limit: event priority=%d, event count=%d, retry count=%d, retry li" ascii
    $s6  = "%24s:%5d [%-10s] %-32s| _ProcessCallbackMsg: Cannot get the lock. Status is %d, return" fullword ascii
    $s7  = "%24s:%5d [%-10s] %-32s| ProcessSendEvent event source=%s, event type=%s, priority=%d, result=%d" fullword ascii
    $s8  = "%s(%d): %s ERROR  : Failed to post to collector, buffer=%p, buffer size=%d, userData=%p" fullword ascii
    $s9  = "%24s:%5d [%-10s] %-32s| m_messageTimer is set, stop processing messages, this=%p" fullword ascii
    $s10 = "%s(%d): %s ERROR  : PauseTransmission failed -- status: %d" fullword ascii
    $s11 = "%s(%d): %s ERROR  : ResumeTransmission failed -- status: %d" fullword ascii
    $s12 = "%24s:%5d [%-10s] %-32s| ProcessSendEvent: Banned event of Tenant(%s), Source(%s), Name(%s)" fullword ascii
    $s13 = "%s(%d): %s WARNING: device went offline while trying to process pending events. No timer scheduled." fullword ascii
    $s14 = "%s(%d): %s ERROR  : LogStatsEvent: unable to start a new stats thread" fullword ascii
    $s15 = "%24s:%5d [%-10s] %-32s| process failed events sending." fullword ascii
    $s16 = "%s(%d): %s WARNING: ProcessSendEvent: m_evtPolicyManagerP is NULL!" fullword ascii
    $s17 = "%s(%d): %s WARNING: UploadNow [time delta %u sec] - too many requests!" fullword ascii
    $s18 = "%s(%d): %s ERROR  : LogEvent: TPM not started?" fullword ascii
    $s19 = "%24s:%5d [%-10s] %-32s| LogStatsEvent: sent stats %s on the main thread" fullword ascii
    $s20 = "%s(%d): %s ERROR  : Compression failed!" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "26babd76bbb7f9c516a338b0601b4c9f" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

705ec35f-6697-43c2-aa08-72e0c46c3cf1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion