_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_452_1_Trojan_Danger_Ge_297

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_452_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_453_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_454_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_458_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_459_1.vir, Virus.Infector_Gen.Trojan.Malware.1q3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.2q3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Iq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Iq3@aunLb5ni_1.vir, Virus.Infector_Gen.Trojan.Malware.Iq3@aunLb5ni_2.vir, Virus.Infector_Gen.Trojan.Malware.Kq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Lq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Lq3@aunLb5ni_1.vir, Virus.Infector_Gen.Trojan.Malware.Lq3@aunLb5ni_2.vir, Virus.Infector_Gen.Trojan.Malware.lS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.Mq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Mq3@aunLb5ni_1.vir, Virus.Infector_Gen.Trojan.Malware.Mq3@aunLb5ni_2.vir, Virus.Infector_Gen.Trojan.Malware.mS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.nS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.Oq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.pS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.Qq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.qS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.Rq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Rq3@aunLb5ni_1.vir, Virus.Infector_Gen.Trojan.Malware.Rq3@aunLb5ni_2.vir, Virus.Infector_Gen.Trojan.Malware.Sq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Uq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Vq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Yq3@aunLb5ni.vir, Virus.Infector_Trojan.Generic.32555357.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_452_1_Trojan_Danger_Ge_297 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_452_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_453_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_454_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_458_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_459_1.vir, Virus.Infector_Gen.Trojan.Malware.1q3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.2q3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Iq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Iq3@aunLb5ni_1.vir, Virus.Infector_Gen.Trojan.Malware.Iq3@aunLb5ni_2.vir, Virus.Infector_Gen.Trojan.Malware.Kq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Lq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Lq3@aunLb5ni_1.vir, Virus.Infector_Gen.Trojan.Malware.Lq3@aunLb5ni_2.vir, Virus.Infector_Gen.Trojan.Malware.lS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.Mq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Mq3@aunLb5ni_1.vir, Virus.Infector_Gen.Trojan.Malware.Mq3@aunLb5ni_2.vir, Virus.Infector_Gen.Trojan.Malware.mS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.nS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.Oq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.pS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.Qq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.qS3@aabLwqji.vir, Virus.Infector_Gen.Trojan.Malware.Rq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Rq3@aunLb5ni_1.vir, Virus.Infector_Gen.Trojan.Malware.Rq3@aunLb5ni_2.vir, Virus.Infector_Gen.Trojan.Malware.Sq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Uq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Vq3@aunLb5ni.vir, Virus.Infector_Gen.Trojan.Malware.Yq3@aunLb5ni.vir, Virus.Infector_Trojan.Generic.32555357.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a489a639572bec47f655987703d9d63665a5fa8185d2404c1dacf160ea06dee3"
    hash2       = "dadac01ef58d28a12f9d0b03ba1a87394006951a5a24036646a3d70acae11e52"
    hash3       = "3e3dde133e34e78b4f0f04056bc4a9483f812626956efc9bd9145b700eb18d69"
    hash4       = "ef8b633e53d8b975cab73ccaff8f072daec73706f8930965aed5523a4d76ec41"
    hash5       = "d0ca3a5d5cf90c8b4e847690ecf2609ec04fb3e77475c24ae13fcd999af12bd0"
    hash6       = "31a0a4a153e963e65b5dc96dd15d81116a27d39a7f420ad312bf468c46562100"
    hash7       = "397ae7be3917fb66cf691c62136ba2b48de0c5b0eee3ed21a3f2e66c55b28d65"
    hash8       = "14afdecd4ba591eb8377f9a0229f1a7469ee782f28385878a7e77a87eaf6de6e"
    hash9       = "05fa887ddfd5c48fdd14ea10bb922a279b07497ff75d9e74d40c313beb80b109"
    hash10      = "b08cbb2c7adc727598ac35dfdf72556952e92f65ce94a98243740ed03e9348f0"
    hash11      = "abd81fad1d8ade9e7526086db996d0bcf9bc5e33da68a5eb451bd3111324cdba"
    hash12      = "68d91641542dd624e6175fe6f62abc1ef42766132096c7e2f43a7e2a9e79a066"
    hash13      = "d8a57a4a2f1af747095f2519a46ad51bfca6ebed62e3ac9b48b19c587cd496a3"
    hash14      = "c50f254fc76e3ffef05edb13321e468949ef588c76ac5ee818e4d783a3455291"
    hash15      = "a4f8ea8f213677a17ecef0508761c45943bbc6887b7739714ff3f81b87dc86e9"
    hash16      = "992fe51aad158fcab449105ae3663eac2044948a09b32294ab75939a547ebecc"
    hash17      = "5e3215d2e9afb6e4a0a6c89ecb16a7bd3338d4121a89143276e580d679533051"
    hash18      = "6e305d28d2c0b2fde7403a19d7ed8e3feed044a9c22a6dfc2e7ffb0554f56118"
    hash19      = "59b480f9943c78a2aab292cabaee686b6dffe43a029d9d618c84b74c6611e381"
    hash20      = "feea74ee6dfc4711498651653896e3bdd31ba37b84cc72eda54d862c96738b37"
    hash21      = "3d2221ecd040548b41a96558a65a02187ab9fa2bb20a52fdfbfb288ca36ad9d0"
    hash22      = "a02df9885a42ddc4f44233a4c0e6958a278d82fdb42fe8ab71e06736377950c9"
    hash23      = "9ec56fd9a92eba50892474320fb564c5af74f8a0c471599cd5ac6be8c3852d46"
    hash24      = "95046153819d9667000cdba874a798a55342fc63e7572d0748d1e4b8601770de"
    hash25      = "13cfc8ca94db64441daa1856324b3ddffdf9fce15a3f09eea1c6fe2f2c68e1e6"
    hash26      = "30407f126969ba35369979a6d25ae7b135133a6d232382d3919eb234f9ff2742"
    hash27      = "8653ab40b19f7527d8582ea1b6b301ab272c17dae76f16019ff579e058880096"
    hash28      = "89f281df1a7cf00f97e75ac4ff964e1c5cd5f09240add8be6c4763f5d604c160"
    hash29      = "65a6c38f0542f6b8519f16f77e6a27cd727468e2fdfa61c0d7989b118409a6b0"
    hash30      = "26c5622a1b1fc07ea016d9a978776166e2d26060870ee27b1d83efffb4d36ad9"
    hash31      = "e5d783328dfe2e67ba768a80875f0ef0abeb217a93834aa64872114336e0b6c6"
    hash32      = "4f4e5f657f0e25fdee406575ad8e0790443eee92e3c0ad3f474400a2ead514f2"

  strings:
    $s1  = "%s (Password: %s)" fullword ascii
    $s2  = "exit routine error GetLastError=%i " fullword ascii
    $s3  = "%s\\Users Depot" fullword ascii
    $s4  = "Could not get thread local data" fullword ascii
    $s5  = "Country: %s (%s) %s%s" fullword ascii
    $s6  = "%s [READ: %s]" fullword ascii
    $s7  = "Cmd %d absent" fullword ascii
    $s8  = "Phone%d%d" fullword ascii
    $s9  = "Owner: %s (%s)" fullword ascii
    $s10 = "%s [WRITE: %s]" fullword ascii
    $s11 = "User #%d" fullword ascii
    $s12 = "Signal Error" fullword ascii
    $s13 = "Range Error" fullword ascii
    $s14 = "Domain Error" fullword ascii
    $s15 = "Proxy: %s" fullword ascii
    $s16 = "User Idle: %s" fullword ascii
    $s17 = "STOPING" fullword ascii
    $s18 = "Advanced Dialer:" fullword ascii
    $s19 = "Unhandled exception: %08x" fullword ascii
    $s20 = "Current Time: %s" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "6f259aa39ae2d65ed9443828fb4ac812" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

980e349c-7926-43f3-bc20-6987b8b796d2

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion