_Trojan_Hooker_Gen_Variant_Barys_4848_1_1_Trojan_Hooker_Gen_Vari_352

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Hooker_Gen.Variant.Barys.4848_1_1.vir, Trojan.Hooker_Gen.Variant.Barys.4848_2_1.vir, Trojan.Hooker_Gen.Variant.Barys.4848_3_1.vir, Trojan.Hooker_Gen.Variant.Barys.862_1.vir, Trojan.Hooker_Gen.Variant.Bredo.2_1.vir, Trojan.Hooker_Gen.Variant.Lazy.501855_1.vir, Trojan.Hooker_Gen.Variant.Ransom.Hydracrypt.7_1.vir, Trojan.Hooker_Gen.Variant.Ransom.Loki.2268_1.vir, Trojan.Hooker_Gen.Variant.Ursu.469251_1.vir, Trojan.Hooker_Gen.Variant.Zusy.538052_1_1.vir, Trojan.Hooker_Gen.Variant.Zusy.538052_2.vir, Trojan.Hooker_Gen.Variant.Zusy.553604_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_1_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_2_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_3_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_4_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_5.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_10.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_1_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_2_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_3_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_4_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_5_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_7_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_8_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_9_1.vir, Virus.Delself _Gen.Heur.Mint.Hiamoe.20.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_1.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_10.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_11.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_12.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_13.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_14.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_15.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_16.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_17.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_18.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_19.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_2.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_20.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_21.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_22.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_23.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_24.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_3.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_4.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_5.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_6.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_7.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_8.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_9.vir, Virus.Delself_Generic.Dacic.1754.0B058D80.vir, Virus.Delself_Generic.Dacic.1754.4CCE85AA.vir, Virus.Delself_Generic.Dacic.1754.A5B42967.vir, Virus.Delself_Generic.Dacic.1754.DA0C2510.vir, Virus.Delself_Generic.Dacic.2DFC86B9.A.099C1C29.vir, Virus.Delself_Generic.Dacic.2DFC86B9.A.3EE5D206.vir, Virus.Delself_Generic.Dacic.2DFC86B9.A.4AB4296F.vir, Virus.Delself_Generic.Dacic.2DFC86B9.A.FB47DBFA.vir, Virus.Delself_Generic.Dacic.8D53B3EC.A.7E54040D.vir, Virus.Delself_Generic.Dacic.8D53B3EC.A.8CF210F9.vir, Virus.Delself_Generic.Dacic.8D53B3EC.A.E93BFDB5.vir, Virus.Infector_Gen.Heur.Mint.Hiamoe.20.vir, Virus.Infector_Gen.Heur.Mint.Hiamoe.20_1.vir

rule _Trojan_Hooker_Gen_Variant_Barys_4848_1_1_Trojan_Hooker_Gen_Vari_352 {
  meta:
    description = "datamaliciousorder - from files Trojan.Hooker_Gen.Variant.Barys.4848_1_1.vir, Trojan.Hooker_Gen.Variant.Barys.4848_2_1.vir, Trojan.Hooker_Gen.Variant.Barys.4848_3_1.vir, Trojan.Hooker_Gen.Variant.Barys.862_1.vir, Trojan.Hooker_Gen.Variant.Bredo.2_1.vir, Trojan.Hooker_Gen.Variant.Lazy.501855_1.vir, Trojan.Hooker_Gen.Variant.Ransom.Hydracrypt.7_1.vir, Trojan.Hooker_Gen.Variant.Ransom.Loki.2268_1.vir, Trojan.Hooker_Gen.Variant.Ursu.469251_1.vir, Trojan.Hooker_Gen.Variant.Zusy.538052_1_1.vir, Trojan.Hooker_Gen.Variant.Zusy.538052_2.vir, Trojan.Hooker_Gen.Variant.Zusy.553604_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_1_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_2_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_3_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_4_1.vir, Trojan.Hooker_Generic.Dacic.6AAA6DD3.A.E33A450A_5.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_10.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_1_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_2_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_3_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_4_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_5_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_7_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_8_1.vir, Trojan.Hooker_GenPack.Trojan.GenericKDZ.96830_9_1.vir, Virus.Delself _Gen.Heur.Mint.Hiamoe.20.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_1.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_10.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_11.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_12.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_13.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_14.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_15.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_16.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_17.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_18.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_19.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_2.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_20.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_21.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_22.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_23.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_24.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_3.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_4.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_5.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_6.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_7.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_8.vir, Virus.Delself_Gen.Heur.Mint.Hiamoe.20_9.vir, Virus.Delself_Generic.Dacic.1754.0B058D80.vir, Virus.Delself_Generic.Dacic.1754.4CCE85AA.vir, Virus.Delself_Generic.Dacic.1754.A5B42967.vir, Virus.Delself_Generic.Dacic.1754.DA0C2510.vir, Virus.Delself_Generic.Dacic.2DFC86B9.A.099C1C29.vir, Virus.Delself_Generic.Dacic.2DFC86B9.A.3EE5D206.vir, Virus.Delself_Generic.Dacic.2DFC86B9.A.4AB4296F.vir, Virus.Delself_Generic.Dacic.2DFC86B9.A.FB47DBFA.vir, Virus.Delself_Generic.Dacic.8D53B3EC.A.7E54040D.vir, Virus.Delself_Generic.Dacic.8D53B3EC.A.8CF210F9.vir, Virus.Delself_Generic.Dacic.8D53B3EC.A.E93BFDB5.vir, Virus.Infector_Gen.Heur.Mint.Hiamoe.20.vir, Virus.Infector_Gen.Heur.Mint.Hiamoe.20_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "9ce09db478fd6207a5564cfb9ff089f94fe175b7d250ca6a3c4f25d328ab4ffe"
    hash2       = "fbcb24690ca145306b8532dbb09fdfba6d3e023fd1b9c3d7f92ea29e1cb33170"
    hash3       = "ccb7033f68d4e2618a00a777bb27e94cdd7ca5229be59752517fd78a0de70f74"
    hash4       = "83ab63be3575e7bf4dc55aa0675c1807884242a5f05f1efcef2a76ae1f469d10"
    hash5       = "fdcecb3770489b618b582f3042b7904d52869e10b66b53389ac4ec80814b0b97"
    hash6       = "056dcf7271d62fb3b5d34424ed4d818d2d07d848829ae05ca7efae7f8613e974"
    hash7       = "03a4f60a3b88c9915ae0ab6b695e3400740f6e916ae385481980df7fa2c2a585"
    hash8       = "da2f7d8172d13713ed0362b796b2c70645af149882ab087bb0a3d8bf7b951bc6"
    hash9       = "37b9944de4b6bd1bd2667e2bc75c3d19d3fa06f0afb3500434cf6fe6c9545def"
    hash10      = "2b340a77b588d7c5de82796a2b336760ec186fea4f2fbf9fc40c99461d6e8eb3"
    hash11      = "e612f5384dc1b6626f793408341a080ff40a09169a1659437b9a6bcfcfb9dfdc"
    hash12      = "d4cbc02c82a4dda7728feff090754b72a93be8130af09c7d4cb913e9dfa7e2c0"
    hash13      = "779098e49cc678596d934abda6e77dfd5287a370b16d465744c9ce0a313f833f"
    hash14      = "cf3355f802ac976f666bf2e3352601538397d5df58181fb6467278f52399023a"
    hash15      = "cb0168111793bf5b718c09522e98c258a55038ecf801ec1ca81621f77fa0e3dd"
    hash16      = "8f22bf0e59e700b58f7f04976aa8a97d6b10bb9e6bdf03bc78a230d464fdd26f"
    hash17      = "246a2073a7b56cc35c81e45e60986b114b2bfe5b58dd5efa96706576b39796e7"
    hash18      = "ce5960c0698df99bc88692fd9a067b08e0ab97808e2ea9e71b8fc6031d70af0d"
    hash19      = "594d444f91fd600fba989476369f0e7d99e2f3e6135f7394724c982ab3cb934f"
    hash20      = "28e5e606d48ae2ff4bde4b7f74318f4423d7f13cde34c6dc3d10c21d113dd113"
    hash21      = "8278b92a79513175c372ea2b06bbfd5c39fcc905feb1a57e48c6dea946924684"
    hash22      = "23739641868fb4d078cf6445fef7eeb2e2be07a29049c283cc1c7aabf78cf68a"
    hash23      = "aaf5170c76e2aeab04c381c83c54d20c133d426f4665a4608f7caccda5cb3792"
    hash24      = "8fca0867a4c4a7cd76db8bbddf6dd48be3c1da65fd40d374be59bf0fe5fc0828"
    hash25      = "1810f62b3973454ab48020949c105961b3ae8a9d792728573e1e4f69d3ff4dee"
    hash26      = "212282ec65863c9d9723ba84c7c932670b9d06db97763769d74d800fd472aea0"
    hash27      = "19f4d44acf364ebcd7ab9c45347a0791ff70bdd25a87cab8abfa9830ddb3bd02"
    hash28      = "8e936a41abccf88b8cf3ccf6273e3f4879255bca64c02dfd85169af24e85b467"
    hash29      = "79e66a0fb62e0cd2e58d6bee95f21c9d4de9c7f657d58a70600a5136e361c174"
    hash30      = "9ff0ddb150c14ee6a4fcf5f39e28fb46900737aa203886392353bd7b8b3fba04"
    hash31      = "14a592a2554566945051f2efdda3501cf6e6ee05774bc040a7511cc146c3d8ae"
    hash32      = "eb420dca5d3a0406fffa8a38bfb66fc190e77a8c21942c4edd3b0b06d69b043c"
    hash33      = "091a0c4176458b11aa5ae77896f3c1e1fbcbfc2dd69f9f546b82fd24ee7152dd"
    hash34      = "6994edb1bc4de8b7cec9136f74351a95482e6e6a8ca353f144ffebd6c06854fd"
    hash35      = "31641e8b0744d2d49297386c20fea478b0c60807d347e1c3477155d85c07f5c8"
    hash36      = "4fe079f3e32987684aa44380636b90a5682be39a81946f9e7e2f8ee718e27251"
    hash37      = "9a1609f532e470206d6653e4e6d30f1834b78d2529bdd46e5c84b37c8e0c0c1e"
    hash38      = "a08f54309e84c9008281fde751c5192c935fe79dfe0d91d5241cfc617f585e08"
    hash39      = "5ac32d436f60d4bf2a1307eb09f207eda71e9f9d32bd825a3f142c4d12d058c6"
    hash40      = "946a20159e45c0b51f5ef05684844a953b67ced19a5cee97a592d7df41e4bef7"
    hash41      = "3761775e6a3139dd8d8d8924f89403997e918895da11e5dea90551bdf3af85cb"
    hash42      = "339d7d4ed660acc3feacc171830afbc92f08d98200caa19e835aa63de5bf009d"
    hash43      = "26216e3d3e092ff7de945d01429338d6a71c58a3b2eed7b7f1812845cd74485d"
    hash44      = "1e04f56040663dc13d1890fc93b24f1ac43ac75fe7a8ef3d9f4793e3d81647b7"
    hash45      = "34da984faf0c51a073843de435c5b5677d7762d89979ec989b92636b4cdd4a06"
    hash46      = "566c992afd2f21233855d76daa1600ea6c10b9f3b2de25207ea4ae45ea9db460"
    hash47      = "3dc50c6c9d52253a84220b7d394dfaaa821750c3459ff2ec725c8a8f985f5a83"
    hash48      = "5f46aa9efdebb28d4ef0e382704d51b0efa9df7a00bcf0effc9dc2b0d9bdee4b"
    hash49      = "6d88d30e21475b696e261067494b289878aaf9df85b10acab40a1b0d8dfbb9e1"
    hash50      = "c0e1b2ac733c085669ccede3c5a867b7678745f81dc171b398889bf948dc6daf"
    hash51      = "1a42587898b112df6b5a5cae446f949153fd5ca23f72a81f08b374cdec886cb8"
    hash52      = "25b3150630797946b0a8414951979170da526be93bf6970b4a2d05f41d1537da"
    hash53      = "e860a1f3962df31cab2989ec0daef5e6532ae5527d126296cf4be264aad653a3"
    hash54      = "9f1d3c5389449706fc95cb4d41a07cbbe8f5e25a95819bf7242343a6914a44ea"
    hash55      = "2d4a1b4ce4606d0baf941fcf36830f8379f8a5659a80fb7af07c019040db4472"
    hash56      = "1c4c3e6aa35301f894b6ed1c8d2cca56079bac7a58efc2990dfd264f585b4725"
    hash57      = "bdb344e7b4b379bfc38b507b37dad939eead98620322d4dac29bc10ff6a1a3d9"
    hash58      = "c4c48a1ddf5405cebafaff1072101f0ebae0b31584c6b6be165f634d16139d7d"
    hash59      = "ddc9bcf24d9ee1835ef02bfeb410e01b3417f12d090df7cc147b44493e3be33f"
    hash60      = "9db3e5486fdbc20e14882f67eb4753ca09f60e45f09071bbcd71a265c2cedc21"
    hash61      = "d702300f2efbf2fadae3625d82c1d61872fecc82bbdc1abb6d94a23b16a28218"
    hash62      = "490a20c5bd736ae22d6870cc8711e15cd7987ecff370f213a2be467b7fa00e40"
    hash63      = "e2eb4c344666de157b90d7453f8674b2a0e0aa91b17048b54090c2bd6ba939ac"
    hash64      = "156806f3e1faf062fa2cbdf40349f2311354b4c678eae84ce4dadac2c0b57df4"
    hash65      = "f0da9717bf6498248c5705c4a0be036fc300d3d26794f892690f9bd168eaf690"

  strings:
    $s1  = "  Here is checking and downloading iexplorer_update.exe:  --> :" fullword ascii
    $s2  = " procedure CheckPart_2_30ServersForDownload; --> Strated" fullword ascii
    $s3  = "  WinExec(PChar(Var_WindirSys32+casino_notificationsExe),SW_HIDE) > 31   --> Was executed" fullword ascii
    $s4  = " Address to parse -->" fullword ascii
    $s5  = "  Unknown_root: The file was started -->" fullword ascii
    $s6  = "  Delete file: --> " fullword ascii
    $s7  = "    procedure CheckPart_1_30ServersForDownload; - Started" fullword ascii
    $s8  = "  File Was Renamed - " fullword ascii
    $s9  = "   The file is not running and will be deleted: -->" fullword ascii
    $s10 = "galley:galllt4@217.117.20.60:21" fullword ascii
    $s11 = "client:out@ftp.remontauto.ru:21" fullword ascii
    $s12 = "  Procedure GetEnviromentVariableValues " fullword ascii
    $s13 = "   The Current file was renamed -->" fullword ascii
    $s14 = "   procedure CheckDeleteFileInIExplorer; --> Started" fullword ascii
    $s15 = "   Procedure Rename_File - OldName: " fullword ascii
    $s16 = "   Procedure CheckWhichPartItIs - Result: " fullword ascii
    $s17 = "    Casino Notifications: keyCheck -->" fullword ascii
    $s18 = "  END registry at startup was written! : " fullword ascii
    $s19 = "    Make Parse to address: " fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

888cc37f-5603-4ad2-b5f1-3a6d437ca1c8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion