_Trojan_Injector_Backdoor_Hupigon_AAAH_13_1_Trojan_Injector_Back_392

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Injector_Backdoor.Hupigon.AAAH_13_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_14_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_15_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_16_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_17_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_18_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_2_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_3_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_4_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_5_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_6_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_7_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_8_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_9_1.vir, Trojan.Injector_Generic.Malware.SF!dld!.7F11D317_1_1.vir, Trojan.Injector_Generic.Malware.SF!dld!.7F11D317_2.vir, Trojan.Injector_Trojan.GenericKD.73245570_1.vir, Trojan.Sysbot _Win32.Sality.3_1.vir, Trojan.Sysbot_Application.Downloader_1.vir, Trojan.Sysbot_Dump.Generic.Dialer.32FFECB4_1.vir, Trojan.Sysbot_Dump.Generic.Dialer.A8475081_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_10.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_1_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_2_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_3_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_4_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_5_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_6_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_7_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_8_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_9_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_1_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_2_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_3_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_4_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_5_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_6.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.veZ@a8Qja3k_1_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.veZ@a8Qja3k_2_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.veZ@a8Qja3k_3_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.veZ@a8Qja3k_4.vir, Trojan.Sysbot_Gen.Trojan.Heur.ey2brXmj3Sjib_1.vir, Trojan.Sysbot_Gen.Trojan.Heur.km0@sX8r3Ilid_1.vir, Trojan.Sysbot_Gen.Trojan.RegistryDisabler.biXaayA9Sao_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_10_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_11_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_12_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_13_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_14_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_15_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_16_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_17_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_18_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_19_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_1_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_20_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_21_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_22_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_23_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_24_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_2_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_57.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_8_2.vir, Virus.Infector_Trojan.GenericKDZ.96072.vir, Virus.Infector_Trojan.GenericKDZ.96072_1.vir, Virus.Infector_Trojan.GenericKDZ.96072_10.vir, Virus.Infector_Trojan.GenericKDZ.96072_11.vir, Virus.Infector_Trojan.GenericKDZ.96072_12.vir, Virus.Infector_Trojan.GenericKDZ.96072_13.vir, Virus.Infector_Trojan.GenericKDZ.96072_14.vir, Virus.Infector_Trojan.GenericKDZ.96072_15.vir, Virus.Infector_Trojan.GenericKDZ.96072_16.vir, Virus.Infector_Trojan.GenericKDZ.96072_17.vir, Virus.Infector_Trojan.GenericKDZ.96072_18.vir, Virus.Infector_Trojan.GenericKDZ.96072_19.vir, Virus.Infector_Trojan.GenericKDZ.96072_2.vir, Virus.Infector_Trojan.GenericKDZ.96072_20.vir, Virus.Infector_Trojan.GenericKDZ.96072_21.vir, Virus.Infector_Trojan.GenericKDZ.96072_22.vir, Virus.Infector_Trojan.GenericKDZ.96072_23.vir, Virus.Infector_Trojan.GenericKDZ.96072_24.vir, Virus.Infector_Trojan.GenericKDZ.96072_25.vir, Virus.Infector_Trojan.GenericKDZ.96072_26.vir, Virus.Infector_Trojan.GenericKDZ.96072_27.vir, Virus.Infector_Trojan.GenericKDZ.96072_28.vir, Virus.Infector_Trojan.GenericKDZ.96072_29.vir, Virus.Infector_Trojan.GenericKDZ.96072_3.vir, Virus.Infector_Trojan.GenericKDZ.96072_30.vir, Virus.Infector_Trojan.GenericKDZ.96072_31.vir, Virus.Infector_Trojan.GenericKDZ.96072_32.vir, Virus.Infector_Trojan.GenericKDZ.96072_33.vir, Virus.Infector_Trojan.GenericKDZ.96072_34.vir, Virus.Infector_Trojan.GenericKDZ.96072_35.vir, Virus.Infector_Trojan.GenericKDZ.96072_36.vir, Virus.Infector_Trojan.GenericKDZ.96072_37.vir, Virus.Infector_Trojan.GenericKDZ.96072_38.vir, Virus.Infector_Trojan.GenericKDZ.96072_39.vir, Virus.Infector_Trojan.GenericKDZ.96072_4.vir, Virus.Infector_Trojan.GenericKDZ.96072_40.vir, Virus.Infector_Trojan.GenericKDZ.96072_41.vir, Virus.Infector_Trojan.GenericKDZ.96072_42.vir, Virus.Infector_Trojan.GenericKDZ.96072_43.vir, Virus.Infector_Trojan.GenericKDZ.96072_44.vir, Virus.Infector_Trojan.GenericKDZ.96072_45.vir, Virus.Infector_Trojan.GenericKDZ.96072_46.vir, Virus.Infector_Trojan.GenericKDZ.96072_47.vir, Virus.Infector_Trojan.GenericKDZ.96072_48.vir, Virus.Infector_Trojan.GenericKDZ.96072_49.vir, Virus.Infector_Trojan.GenericKDZ.96072_5.vir, Virus.Infector_Trojan.GenericKDZ.96072_6.vir, Virus.Infector_Trojan.GenericKDZ.96072_7.vir, Virus.Infector_Trojan.GenericKDZ.96072_8.vir, Virus.Infector_Trojan.GenericKDZ.96072_9.vir

rule _Trojan_Injector_Backdoor_Hupigon_AAAH_13_1_Trojan_Injector_Back_392 {
  meta:
    description = "datamaliciousorder - from files Trojan.Injector_Backdoor.Hupigon.AAAH_13_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_14_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_15_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_16_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_17_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_18_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_2_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_3_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_4_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_5_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_6_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_7_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_8_1.vir, Trojan.Injector_Backdoor.Hupigon.AAAH_9_1.vir, Trojan.Injector_Generic.Malware.SF!dld!.7F11D317_1_1.vir, Trojan.Injector_Generic.Malware.SF!dld!.7F11D317_2.vir, Trojan.Injector_Trojan.GenericKD.73245570_1.vir, Trojan.Sysbot _Win32.Sality.3_1.vir, Trojan.Sysbot_Application.Downloader_1.vir, Trojan.Sysbot_Dump.Generic.Dialer.32FFECB4_1.vir, Trojan.Sysbot_Dump.Generic.Dialer.A8475081_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_10.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_1_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_2_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_3_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_4_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_5_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_6_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_7_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_8_1.vir, Trojan.Sysbot_Dump.Worm.Ludbaruma.B_9_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_1_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_2_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_3_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_4_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_5_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.EeZ@a8Qja3k_6.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.veZ@a8Qja3k_1_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.veZ@a8Qja3k_2_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.veZ@a8Qja3k_3_1.vir, Trojan.Sysbot_Gen.Packer.Krucky.B.veZ@a8Qja3k_4.vir, Trojan.Sysbot_Gen.Trojan.Heur.ey2brXmj3Sjib_1.vir, Trojan.Sysbot_Gen.Trojan.Heur.km0@sX8r3Ilid_1.vir, Trojan.Sysbot_Gen.Trojan.RegistryDisabler.biXaayA9Sao_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_10_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_11_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_12_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_13_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_14_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_15_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_16_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_17_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_18_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_19_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_1_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_20_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_21_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_22_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_23_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_24_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_2_1.vir, Trojan.Sysbot_Gen.Variant.Ransom.VirLock.100_57.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_8_2.vir, Virus.Infector_Trojan.GenericKDZ.96072.vir, Virus.Infector_Trojan.GenericKDZ.96072_1.vir, Virus.Infector_Trojan.GenericKDZ.96072_10.vir, Virus.Infector_Trojan.GenericKDZ.96072_11.vir, Virus.Infector_Trojan.GenericKDZ.96072_12.vir, Virus.Infector_Trojan.GenericKDZ.96072_13.vir, Virus.Infector_Trojan.GenericKDZ.96072_14.vir, Virus.Infector_Trojan.GenericKDZ.96072_15.vir, Virus.Infector_Trojan.GenericKDZ.96072_16.vir, Virus.Infector_Trojan.GenericKDZ.96072_17.vir, Virus.Infector_Trojan.GenericKDZ.96072_18.vir, Virus.Infector_Trojan.GenericKDZ.96072_19.vir, Virus.Infector_Trojan.GenericKDZ.96072_2.vir, Virus.Infector_Trojan.GenericKDZ.96072_20.vir, Virus.Infector_Trojan.GenericKDZ.96072_21.vir, Virus.Infector_Trojan.GenericKDZ.96072_22.vir, Virus.Infector_Trojan.GenericKDZ.96072_23.vir, Virus.Infector_Trojan.GenericKDZ.96072_24.vir, Virus.Infector_Trojan.GenericKDZ.96072_25.vir, Virus.Infector_Trojan.GenericKDZ.96072_26.vir, Virus.Infector_Trojan.GenericKDZ.96072_27.vir, Virus.Infector_Trojan.GenericKDZ.96072_28.vir, Virus.Infector_Trojan.GenericKDZ.96072_29.vir, Virus.Infector_Trojan.GenericKDZ.96072_3.vir, Virus.Infector_Trojan.GenericKDZ.96072_30.vir, Virus.Infector_Trojan.GenericKDZ.96072_31.vir, Virus.Infector_Trojan.GenericKDZ.96072_32.vir, Virus.Infector_Trojan.GenericKDZ.96072_33.vir, Virus.Infector_Trojan.GenericKDZ.96072_34.vir, Virus.Infector_Trojan.GenericKDZ.96072_35.vir, Virus.Infector_Trojan.GenericKDZ.96072_36.vir, Virus.Infector_Trojan.GenericKDZ.96072_37.vir, Virus.Infector_Trojan.GenericKDZ.96072_38.vir, Virus.Infector_Trojan.GenericKDZ.96072_39.vir, Virus.Infector_Trojan.GenericKDZ.96072_4.vir, Virus.Infector_Trojan.GenericKDZ.96072_40.vir, Virus.Infector_Trojan.GenericKDZ.96072_41.vir, Virus.Infector_Trojan.GenericKDZ.96072_42.vir, Virus.Infector_Trojan.GenericKDZ.96072_43.vir, Virus.Infector_Trojan.GenericKDZ.96072_44.vir, Virus.Infector_Trojan.GenericKDZ.96072_45.vir, Virus.Infector_Trojan.GenericKDZ.96072_46.vir, Virus.Infector_Trojan.GenericKDZ.96072_47.vir, Virus.Infector_Trojan.GenericKDZ.96072_48.vir, Virus.Infector_Trojan.GenericKDZ.96072_49.vir, Virus.Infector_Trojan.GenericKDZ.96072_5.vir, Virus.Infector_Trojan.GenericKDZ.96072_6.vir, Virus.Infector_Trojan.GenericKDZ.96072_7.vir, Virus.Infector_Trojan.GenericKDZ.96072_8.vir, Virus.Infector_Trojan.GenericKDZ.96072_9.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "5fe204db6da98b01b67ce0c73bd2876753c832244b77f10d1528b9ecfbc23eae"
    hash2       = "b6a70299eed6cb638849cacae7c92fb0230c56d084999b519041a795b4f42541"
    hash3       = "6cc2e53453b6e8b75f8a1c73f88313f001805a4e933f7e02ef13dfd10c592d9f"
    hash4       = "8d89634e870fa0ca9626e457c496e2780327e133535e65cc755c1c0636d0ba1c"
    hash5       = "f4f3de545c42191390a40a47788e3eef2a73434f7af567622127e2ae250f4626"
    hash6       = "5536c7c61f6a7981da5a14d9eb5f70e7f0dc569755398f8ad6dd76d172b7e58f"
    hash7       = "15326584941cdccf26d316b91ad15d2626cc3d16fd5c5d4e13bdecced0810055"
    hash8       = "03c60142c6b58d4e091f66b66b6db38292bd34a21f0d9f5dce55196e8b04a791"
    hash9       = "2bf20823916c5f9e1fd6ec1855f80831b6cbd34cf8560c04ca4d8b1537597f85"
    hash10      = "ca90750f9ded33ebe07ad33c900b55b2f0255156b18f6a7650614137a626fc38"
    hash11      = "64631703483f6a8b7b0f4600e1901a7ef08fee484891a0f80848a38838b24d79"
    hash12      = "dd3917b826c53de831d1c2b853e8f87e359b0b6e62e85233337e17928681fb77"
    hash13      = "4995af5d70aa006f71c1df57c1f6a5a6347ccc8087e2fbd1bfd505aa64a49e9b"
    hash14      = "6ab744c337171f2b6fd8f672988b52f5a1b125d67f8de807cd4fc1daffaf255f"
    hash15      = "17c5d077965e42ef8de18bc31cb91cd350401c5b11a56b8cf66b65a06ec3f168"
    hash16      = "16acc97a96edae83517868f3dab3ae12a490927eb702377632379c60ac1d9e2e"
    hash17      = "1239985ac27ce6340fab0639288cbbc0e5332172459fc9293c4d900c8c9b08a6"
    hash18      = "d1d136d11adbfc5ede35d8f7c08a92e5d035d2da95de62194cfa069baae8dd43"
    hash19      = "aab1798b5551125cab1635e001fd1b6a3866f6ca0eb7e55e7520eb13446a5d96"
    hash20      = "5df4cad8529559d00b9eca043bb15c3ab5b3b971a766420897800607f018d88d"
    hash21      = "467645f59a845a32cecd7968679f79d8f1cef1a4e6fc66053a2e3cdeef73158c"
    hash22      = "4f7f6ad6a4da150ded3f93683060d855441b116506a59c5d1bb9f8ca665c92e2"
    hash23      = "5342fe0c9fe0548264185d2c820fdcfd0a9bf933f464cce9de98a56af2ed4e1d"
    hash24      = "f23f560bfc560aec4424614550be1de29f13fb1f299f160c9f5090d98f65f383"
    hash25      = "a0505406a76234b917087362fa37b577b60f34ad8888d2874fd5bb5c889e6f6a"
    hash26      = "14aa41724f5c82991aa4c51bed5d47198794941d60de1d50a2eb709c367f974a"
    hash27      = "4c39a97069f95894c145294b3a09fc55b63c699398b399308c9720ba1f176851"
    hash28      = "5e66d9597a2c366c910e6a267e041b6b542fba975b2f5277392528aeef3dc49d"
    hash29      = "7c3cbaaf2586ba43af08d08ac35d79e33a034ba5a88b0c019a25cf4997b7a931"
    hash30      = "1772ab38e20742ff774edba12844f6a00d448652dfca701f6e294b324f8e1eb5"
    hash31      = "e74bc11bce8ecd3c9cc6e030b44d29b06b272e834bf916bf95d75774019de070"
    hash32      = "5eaa24e7451025494b9172de4476ea936d433e4c60c8798f132b9a58e4e71ae6"
    hash33      = "7d5fa50b228a25b9e1b149dc1923dfea69cb7c09b1fa91db04b0f8eaa905ccd1"
    hash34      = "9de186436a9cfda029a3476a45b58fc6bfe8b5322323e8d2a6dd7e30b97c6b05"
    hash35      = "7edac468f2badd47d643716ee0fe7a71c405d9bcc130f102741764a4f5b31c60"
    hash36      = "42cd6bf1d811632b0612bc09756e426903de3f018cd136413036797115825489"
    hash37      = "54288ffa69004e1a98547ce9a2d94c8b3fb2db29774c8960bc9ec8f0ab0e2687"
    hash38      = "a4d250b6b0487653f88afb8a72297737b3654e32b8d20881f370af7df00e9570"
    hash39      = "cffee379684a40f5090e798d05dc53c955363ff2b4fb46610fc4f683aab15d51"
    hash40      = "4b3a042c1ebcad1175968e75265297bf219e4c054b8eaf5b9460692b06fac81b"
    hash41      = "571aa0b78e28f2a2f7ce94db85814288696baa530a5b19c05ad0decc672ef584"
    hash42      = "0f7d9b435ba412ea81fe0ec032f78ddf4f892a65c80f7f95f982c7266f20c2d1"
    hash43      = "d7e4962936320977b5e08b1d4957a71a5144ea0c48484c96f51b5bebdb41178d"
    hash44      = "471cacafa2067e10221906be3467429b90c137769c3fa3216c82114ade60c75a"
    hash45      = "a62c26d1fcc13265bdfa1b754d3a96e2f845aceae7a07041184a289941e7775e"
    hash46      = "6a8c44de79cc1038cae549022655eaacd7449b19302f7d40c898f066789f8da1"
    hash47      = "6942a989b6e62eac287da3add41b16a08d100712d2ab2068248d5b81568db3a4"
    hash48      = "a5ce5f185a0747a4a2dd8c0323ab846b482818c61ebf1202d407327037673743"
    hash49      = "ffd1263c9718dde7510431e55ff97e242fea540aa1ca14712ebaa57421bfe566"
    hash50      = "5d8bd0470139fecc7769f92aab62bc1072437bb87f8aed53227afdcba9dd3e32"
    hash51      = "30b7abfae6a3bbb92065dc67e7405c4e2b6b0046769ec9eec1866ca447070c99"
    hash52      = "98f9463b437cbe4bfb08fd5547f8f4254e9ab52f714e9f75aac73597211f05ea"
    hash53      = "6dd6de43cda71cc85d05f19aa7ce3903c47533be9c24060488771964fee5dce6"
    hash54      = "0997e66d1d973ed9c0c1a2a5367b46dcaf1d061c5dec73c3f575b01149e82b25"
    hash55      = "bd46b55610e3db6de2cca264bfcdee5c97c3cfc2a49acdccd84e873f7976ac6e"
    hash56      = "694f46b7d707925e0644b8c980f9e6b3f25aeffec4dbe7f6f71e831f877e34ba"
    hash57      = "e4ba11561bf7e2fc9120147840d264b6f6588c314f75db4bd35a939314006a98"
    hash58      = "c09b057a7c89016db1efe36904f0b2d66270678eb4e35e3ffe0b3c08955188e8"
    hash59      = "161a00061da34e46689f49a3c6e3fe7fdd5b34c8d5d0a1135cb0a679e79af6d5"
    hash60      = "1560e6531dba42f827ed3cefc72052d71d76b51293b10f2f26167c4aa92ecf4f"
    hash61      = "f0dbbbc84c0f88d061d5dc609cba91ff1ce47a1ab763426751f4432e890613b0"
    hash62      = "2e9c94b2f6342bb043f50bebab6209a71378996bc25a2fafc58a27471de5414c"
    hash63      = "3daf9f00ea5bc5cbbfba18f542dd2ab2a0c17851db259fda397e8fd986bf3a0e"
    hash64      = "9b9ceacdbb3ea1603f7b866d3fb92fc4fd516905405c9b4cfc2b8d91ead3f46f"
    hash65      = "3cf571eff51a656248d5ddfaa288ff553340773b4b18e29aa665bb3412aa527a"
    hash66      = "064946b29847ff8214aa6590208ca8264884328372fbdee6c078be9016111e06"
    hash67      = "fc3eaa4b14cc8cf0d1ddff2918bc7b28da7c7cabc0a5fbcf3ad84dc458c455a3"
    hash68      = "2cb6a8b7428275bbaaa909b809fc732e3f91914c0bcce02d53548f1ca24cf572"
    hash69      = "e73f8525fdb3a22fb5abb628989b9b357248216db2e09267abfb7e573e54268d"
    hash70      = "28f486d36aac5928cbf8bbb9694b7b38273e3a14e20d6b6e88798fea2df074af"
    hash71      = "bc6c0843fab91fa19b22c08392490a455b7e3d158d3d7861efda2e434b874df5"
    hash72      = "f5ccebd74e5b51be80cda2edc12896f55d70fca5f931faa75958dee87f165529"
    hash73      = "ca53a0387b1f69895c703ac587be23ddfaf691fdf9357f1ef6f81be76ab57da9"
    hash74      = "0a8354f10dabd36911df72e80fb999c2e380001f04634f676ddc4800c3a0bd9e"
    hash75      = "79cc1b5aa83846a6ab74c7b2fac5cb9fa0ccb95a43320d05fc92ccf610f26e5a"
    hash76      = "489d3b6bd396baa5710bb390a0ef44ab7771e46c4e62b0acc24e975cc45bc564"
    hash77      = "cac32a4b5322ea6ecfa3bfb624d0fecc211df799ceb50723ca5695dc3829a849"
    hash78      = "9e7f9eee16ae4aff1e3e6c5df7a1bf6e10176861af0685462974404d316d4cde"
    hash79      = "c419d6ed3f9d5a2e6e8f03c685c089faf3557551f83099083500d34674ca625a"
    hash80      = "386cdc7118e208c3befb1b3dc4f1e4415d209bb2c21e0984927a0ed15287fa27"
    hash81      = "a1898433917cbfa20aac655b6fb8dfa08dcce6d6029edad1b9184a1bc7c80b78"
    hash82      = "d0e9016157cdf2f2e4434eaab0523f6aeb479d2850392820d887d8ecf49dbf99"
    hash83      = "a11a98ff1638fdb680f7d8029cf147c9ab121695a182fd31c5f350f4a1203255"
    hash84      = "06128ff769333371c0379a6a213135da08b5b64da17f38d556dffb90b9a6ede9"
    hash85      = "6c7a535805caa7edccf04e5b582cf69736996ca3e60c5585c9a9945b7b739ef1"
    hash86      = "1f78ae0b8a3faf5e29f5609effc3298f852c64965c51974d76b79859b9c58eb1"
    hash87      = "513d8d0a8d03e0722d85fa17989e95063883b3906011f2dc5db0a033a53890e5"
    hash88      = "62c836681a8acfdff8d67d9cddf1b209f823663f8980a7c8aae13b83d3b0777a"
    hash89      = "e58d86829b4281bae9646c323a6fbca192cdc58caef2f499f00ef86e51a64e35"
    hash90      = "a89103f29ad5ac959bd8b24e8d6ce1621e31d4c7347026302d49e6f39bea6a51"
    hash91      = "55d724627265e30d069519b5f4eb03f199ab0a8392bdd7df87e872c34fae3bad"
    hash92      = "41bef55d0326af1cc66ef01b353099f701b8d631ea34c9d98b6f8ed567daad78"
    hash93      = "069ebed335d149c3363a5dc4adf785ca981cc02060a9707fe2ea9ab5baa657d0"
    hash94      = "de81f7a957a348d3586c64061fa315625d61b25fe90947f1c0002f59d04230aa"
    hash95      = "73b62540842511fb8a23124450ce5ce8833116e5e1e592d56acc12811897c6fd"
    hash96      = "b83da659a7df79dfa1b1c23d5b54d2c4018986cade6e72b01c3bf6ec8f557584"
    hash97      = "1459d6c2baa0a25c34bf1ff4ab15ec743f46ada4d14a82d7e60ac1870c76d6fd"
    hash98      = "9174f5cca78013ebc4ec5cc5e81466b561e950ddb6e842de20ba8a10d5c43d45"
    hash99      = "36ef145c7935ba7116b0951a0e90f2cbbefe4d6a7207de748c57e1acca8a7197"
    hash100     = "16c096bc036305f5a16952fe9bd82f0628f20ba6ee3ae4f80f472701588b499d"
    hash101     = "fee72404f87b60cf47f1285d819a22926ea8c0905f34e8c1d17bc18297e35251"
    hash102     = "d154b514d709ff4b4359d2251bb56be0d1e3a6fcfbd4a8445c189ece82dba431"
    hash103     = "7554997902036b7622cabb6111adaa247a69156d5412002be61bf163c19b076d"
    hash104     = "b2a033e7467c1e5a92164580d7b2afe032110af2ab05fa9bb1c1ba6b18e30001"
    hash105     = "7a3b1706287abd670c7dc83cd6dc5836b5c7276a9c1ab5885c489caaa674c6bd"
    hash106     = "ed6836b8c5279d3ee8006e254aa6ee3755b1aee0a7edda0efd0a01b1a2551cc0"
    hash107     = "940efa7ca3a16ff0b64e000d6f5aee6c17c71bce4bc9d7ba8587c12bbddd7fce"
    hash108     = "ddcd9855bcee62c976e23ff57493d9c6f72a6b1036e670dd924442e9a66a00aa"
    hash109     = "5780bd801f44ded24731054d27bc027d9943445e7ecdfe8512f40bcda83e425a"
    hash110     = "9d76b8699694d76a82861bc9b72c6af5106748d80fc720e7b29ab1c9e127f50d"
    hash111     = "ec7c894aaca5c12ebebc4e238d7146dc1121e946f69814669b411952b26e8927"
    hash112     = "f3f2e19f544eee5cc14b2c00c2478378f04e024c5bbfcdb3a7a389d20ba70fa3"
    hash113     = "eb95c04caa033575bc791fb1f49b52ed389634a7be7bab180d4e622cde952e90"

  strings:
    $s1  = "support@e-gold.com" fullword ascii
    $s2  = "support@cyberplat.com" fullword ascii
    $s3  = "support@wmtransfer.com" fullword ascii
    $s4  = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322)" fullword ascii
    $s5  = "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; InfoPath.1)" fullword ascii
    $s6  = "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0;)" fullword ascii
    $s7  = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon)" fullword ascii
    $s8  = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)" fullword ascii
    $s9  = "Content-type: Application/Octet-stream; name=\"%s\"; type:unknown" fullword ascii
    $s10 = "FROM: <%s>" fullword ascii
    $s11 = "support@rbkmoney.ru" fullword ascii
    $s12 = "Administration WebMoney" fullword ascii
    $s13 = "Administration CyberPlat" fullword ascii
    $s14 = "WebMoney Instruction" fullword ascii
    $s15 = "PayPal Instruction" fullword ascii
    $s16 = "EasyPay Instruction" fullword ascii
    $s17 = "RUpay Administration" fullword ascii
    $s18 = "X-Mailer: Microsoft Outlook Express 6.00.2800.1106" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

04c8fee9-c102-45b9-8042-0ff345c3ee2b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion