_Virus_Autorun_Trojan_Ranapama_AMY_Virus_Hijack_Backdoor_Hangup__186

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Autorun_Trojan.Ranapama.AMY.vir, Virus.Hijack_Backdoor.Hangup.B_66_1.vir, Virus.Hijack_Backdoor.Hangup.B_67_1.vir, Virus.Hijack_Dropped.Trojan.Peed.Gen_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aqza5Lj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aqza5Lj_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aqza5Lj_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aqza5Lj_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aS0V58e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@auFLy0g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@auFLy0g_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.oSZ@aaT6Wyj_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.oSZ@aaT6Wyj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.oSZ@aaT6Wyj_7.vir

rule _Virus_Autorun_Trojan_Ranapama_AMY_Virus_Hijack_Backdoor_Hangup__186 {
  meta:
    description = "datamaliciousorder - from files Virus.Autorun_Trojan.Ranapama.AMY.vir, Virus.Hijack_Backdoor.Hangup.B_66_1.vir, Virus.Hijack_Backdoor.Hangup.B_67_1.vir, Virus.Hijack_Dropped.Trojan.Peed.Gen_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aqza5Lj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aqza5Lj_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aqza5Lj_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aqza5Lj_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aS0V58e_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@auFLy0g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@auFLy0g_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.o8Z@aW8PDib_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.O9Z@aG4fkNb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.oSZ@aaT6Wyj_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.oSZ@aaT6Wyj_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.oSZ@aaT6Wyj_7.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "3f7c076b5a055f951455521b7b929df67edd425c010949332f0a1507322c9991"
    hash2       = "6527e08290dd23faa65eacb0f51b0e2ae240f98a87f92bb585064d6ec56a6658"
    hash3       = "8048f36400e904118bd694ef596e2f42270657b7cb0ac82bf0a604a70f9870c7"
    hash4       = "7c113cded7764d7e028df664d26c8a4da56e025f6a39c4a31877b3ac944b43bb"
    hash5       = "e9e2ce30f0d8aa76324e75af05d24b4c0baa3cfb1926edd488f0d9d7692cb38d"
    hash6       = "c63093d25b14cb3debd28c862b328eebaca6533a50cf4d94d3d1bfc9182b8976"
    hash7       = "0adc8c3daa0443144266bc20be7ad08958a8a3c8422a6065f91cdf56efe71e30"
    hash8       = "808cb41470339ab4896114fbc7c40400632449fe003a77a8719b90e34caf1327"
    hash9       = "bd9784425a48c8a89d875b3a65f5d5fb4c756cb4d0cbcb4032f4de41694e73a4"
    hash10      = "d3b83a1bd1e066f22d6f52d2d168050c0ffc970b4db6eaaef632309836b1b5fc"
    hash11      = "7994bcf6e19c1e3ef8084e145e9a6d7c10059ae57f27b799ef7d9a17274d2b71"
    hash12      = "c1565be3be6f8e1cbaa149445cf76b32e6551859cb91cfbaadbf4ecb88cbcbf2"
    hash13      = "2ff5d37485b91666277da84b2b74284a2ad023b63470939b6ebcfadcf32e2b97"
    hash14      = "15283d2cb10c0b9eb9d7ebfc46edff1c75dff0c75d03aa1122033682cbf9edc0"
    hash15      = "e6f52ade7363ee54c36e62f3d62423ef47c369b396b11ecc91ff0c0719fc7316"
    hash16      = "9085baf950bd6edeff49e4e85fd0a89d2799b376d2396d0db8f1a7db3324f929"
    hash17      = "7c8ec702c5df3ee50a712df0a3946405622d54648d0273010294db4e7e1af4bf"
    hash18      = "c1dba271930b1dfbae374b790391fac0c651e9e1f930bcb79a361814b9024e1a"
    hash19      = "f1a120df824f4de99e198b8a4fdb5a6846d17ed9a50750b6cb5d7440e713e1c2"
    hash20      = "d2dc7bfaaf63531703aa1a234054c5ed6b404e1dc1d496a4c3def4195de57df7"
    hash21      = "a896cb2bb2ab0e0257df2d6863366abdee0147b6163762580820416a31d675b5"
    hash22      = "c02a9041e4ce467f9503608a7c1004874960da58f29f7c8668639d3a7464b0cf"
    hash23      = "ca85703c7be548920c84f7672b7dc669be5733351b878d594df0c8af343bb5ea"
    hash24      = "62b22e3d0df64cc4a8d3ee42d31ef3a8b75a777a3c6ee3b61ff05c24a070e195"
    hash25      = "786500fc8e7c4b49301cf3a6748243a41a6c0b0a2a92f41b7c69f02db0a234e9"
    hash26      = "944c4a5bbb263967c40e84420295f5106c6d2ffe483230b0a62e6db523f556a9"
    hash27      = "83c551610fb1ed3363a7225f5d46c65452cc010598af701c7ed498cec6f426f6"

  strings:
    $s1  = "User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) " fullword ascii
    $s2  = "User-agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; http://bsalsa.com) (" fullword ascii
    $s3  = "\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent" fullword ascii
    $s4  = "\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\User Agent\\Post Platform" fullword ascii
    $s5  = "Error while getting page print values from the registry!" fullword ascii
    $s6  = "Failed to %s notify icon" fullword wide
    $s7  = "Click here now to install Anti-Spyware tool." fullword ascii
    $s8  = "set version of" fullword wide
    $s9  = "set focus to" fullword wide
    $s10 = "Assertion failedFloating point division by zero" fullword wide

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d2c3668f-592b-469e-8e65-088b622519c3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion