_Trojan_Danger_Gen_Variant_Ransom_Babuk_69_Trojan_Danger_Gen_Var_442

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Babuk.69.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.69_1.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.69_2.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_1.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_2.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_3.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_4.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_5.vir, Trojan.Danger_Trojan.Agent.CQST.vir, Trojan.Danger_Trojan.Agent.CQST_1.vir, Trojan.Danger_Trojan.Agent.CQST_2.vir, Trojan.Danger_Trojan.Agent.CQST_3.vir, Trojan.Danger_Trojan.Agent.DCBC.vir, Trojan.Danger_Trojan.Agent.DCBC_1.vir, Trojan.Danger_Trojan.Agent.DCBC_2.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_708_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_709_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_710_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_711_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_712_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_713_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_714_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_715_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_716_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_717_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_718_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_719_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_71_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_720_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_721_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_722_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_723_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_724_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_725_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_726_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_727_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_728_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_729_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_72_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_730_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_731_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_732_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_733_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_734_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_735_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_736_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_737_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_738_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_739_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_73_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_740_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_741_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_742_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_743_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_74_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69_2.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69_3.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.86.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.86_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.86_2.vir, Virus.Hijack_Trojan.Agent.DCBC.vir, Virus.Hijack_Trojan.Agent.DCBC_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_268_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_269_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_270_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_271_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_272_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_273_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_274_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_27_1.vir

rule _Trojan_Danger_Gen_Variant_Ransom_Babuk_69_Trojan_Danger_Gen_Var_442 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Babuk.69.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.69_1.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.69_2.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_1.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_2.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_3.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_4.vir, Trojan.Danger_Gen.Variant.Ransom.Babuk.86_5.vir, Trojan.Danger_Trojan.Agent.CQST.vir, Trojan.Danger_Trojan.Agent.CQST_1.vir, Trojan.Danger_Trojan.Agent.CQST_2.vir, Trojan.Danger_Trojan.Agent.CQST_3.vir, Trojan.Danger_Trojan.Agent.DCBC.vir, Trojan.Danger_Trojan.Agent.DCBC_1.vir, Trojan.Danger_Trojan.Agent.DCBC_2.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_708_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_709_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_710_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_711_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_712_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_713_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_714_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_715_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_716_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_717_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_718_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_719_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_71_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_720_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_721_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_722_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_723_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_724_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_725_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_726_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_727_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_728_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_729_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_72_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_730_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_731_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_732_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_733_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_734_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_735_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_736_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_737_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_738_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_739_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_73_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_740_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_741_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_742_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_743_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_74_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_1_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69_2.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.69_3.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.86.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.86_1.vir, Virus.Hijack_Gen.Variant.Ransom.Babuk.86_2.vir, Virus.Hijack_Trojan.Agent.DCBC.vir, Virus.Hijack_Trojan.Agent.DCBC_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_268_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_269_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_270_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_271_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_272_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_273_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_274_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_27_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "19172c5ce991d5ba7db0668f63ff50d45ce21d96355a287078258aa1d5199b4e"
    hash2       = "8a778df918ff246de63ea910513755289f85ec22fc18fe7ec6fb6b6f4f184657"
    hash3       = "a4d21e51ee33832827e7a6150b3f80c266386651152214ff31aa8db3f070edaa"
    hash4       = "8c3a6378fa64eb2e347f4257019d42aceeadcdf2bc46f9854aa9289953ad2db3"
    hash5       = "f4118aaa317010087d084c01782f6171a08657e0559a4204760fce42164f0da0"
    hash6       = "7d3a119b5756a3a5c0f6e318182ae49472f4632eada5e7536c2b0c76be3c9095"
    hash7       = "bfbb1df999c7e98648c354656285a672353720dce906f42bff495d762573ef47"
    hash8       = "c8ff260970157238b50200408a7e4977aa359b115316a3fbb1f1926880ac273b"
    hash9       = "7f37d56c460f9f3c7fb20bb042adbdcc8f33488bffbc84cd1585f945a93c632e"
    hash10      = "0f9de7822a9f3ba4b4c34417b400095e02d80320823ded1641d50f615592a659"
    hash11      = "16f42761816c7de1f558467a74c802f31202d02acbd03f43977b3b30984f0662"
    hash12      = "1c82be062e827e3bde005ab7375491cb3ed439b7caa04b7e60a420f918bebde7"
    hash13      = "ec920518d54428aa77d7543df71a17215241e032de110ee11d3c566ebe4ff0c3"
    hash14      = "a3b02a8b02049766b21d387299f1e9e12f4cd5a0fca733bb3303d7e2f21e6717"
    hash15      = "701e0649f8dd90296eff9debd09f89be119123f5fec97cb03ebbd3c90367af81"
    hash16      = "6f24ed97d5d0c680ad3a58aaa4d16cd9359ec47b0534fbb0075f527917406d1c"
    hash17      = "23ea20329458491abf1eac79a4bbda226216090429ebdefeaa4060d6a955c541"
    hash18      = "9c88172f7640a9118e3ee5aca47ca37b0e204943e7c4ad17b76f88686a6a21cc"
    hash19      = "dd0dd5288bdc7b999f8a647d663d9b11d2163b51cfa75ca47a6e8ac557dd9ad2"
    hash20      = "dc46d1d0564c7a9f7791aa49670282ac4085c5f487bc56becf5fbfc46e66f080"
    hash21      = "b38eca06848c4c785987e21a0cb5cbf0670267d746af98aebd2fe29e6db6ba5e"
    hash22      = "9d8d404efe46839604e3c6855133160cb8b230ead5e0455d9b06ea947ea1ef2d"
    hash23      = "394f5b0a530cb0f39cde3b6376a0b81316139c6c6e265af9b922e5cb080df0bb"
    hash24      = "38241905ab597c27a1a29cbbae1e908c37b2c445a564107d9e6c53bf197eb949"
    hash25      = "401b2224726ef88f1bb94090dc7f2dcb10a4b719c46e441bdac99954f1d19d2d"
    hash26      = "cb402851f165815691c997b64cc410821ec29ff96812a8ea42c10896481c97a1"
    hash27      = "6e85c4fd1e54fcd5c8f743ed60b760a41ff3a468470bcafd07678089bfd8329a"
    hash28      = "fd4764b0c35451696d3808f9e75eb655d0f7d9f1ef87939840449cacfa41800f"
    hash29      = "4f875d202ee15b53bbf500675572b252d79a123f225956d754a646b2826c48ee"
    hash30      = "f70375cafa915a62e077b17bf3c748a3f1d00f0b77d002d9690f7f2ab16b95ef"
    hash31      = "bc115b79e6ce60c0d3ca25afd9322869d3aa0b2b434ee5d763e7923faba26c71"
    hash32      = "ad17cdde8dde120bdba2227e753a507d8973a84b53453f5ebfae9e38757b73ab"
    hash33      = "c114f6e1b235b96e3f81b110cc6a02ead129d5fa71b819978ad1618df5223b6d"
    hash34      = "2ede358fc1b25552763a17d18377e47aa76dd306f55c40ccbd6ad3c98b6d1fd1"
    hash35      = "deeca5d634b19e0c55198f3cc6d34e031b3eb53205320ccff64e854b60f8cca4"
    hash36      = "c6feea693fe8e8504e1b7603a0250935f2ad72549786e07a4e134786cc0f942e"
    hash37      = "5cc61cfc4ed9ada680ed919a7b90485e2d0e9093deaa965c98e3c18c1cc662d5"
    hash38      = "1bf0a93ee22e5985da0d153b7d1d6c193827adbfdffe8bd795f9e68ce475bf70"
    hash39      = "5c483b03cda15695b62f5b7d7c58d978c41e66f3f9e043bc66b756b24bbae2a4"
    hash40      = "9b10b484de5bb4db8a6d57bbfd68b290447cb1aa8d726df742af39440f11edf5"
    hash41      = "49fb59f137aa2d9a7b25edbf1aed6925b481b2799eed5bd1436c181bf568bece"
    hash42      = "2cc5a00d67f6f6812759c619b5ee06980c7d1e54c8780666a085a3e072b8301c"
    hash43      = "c48b02393880d36abcbc2a48aa574152a4725fc386902916a64c175541d17e81"
    hash44      = "b9b5b158a981aabefb18ea7192ea5e02bda6abc2663dc2cb79bd69a0b1ffba4d"
    hash45      = "6f55a802c520b7786d4000ed85958d3c8de752f26f69451c85a9765c3e7d6cfa"
    hash46      = "499cb0caf07f95db83ae6f3a7b79193b5ed8b577972391516269843577b8f6e3"
    hash47      = "f6503fc3b329655e3b7ebc35b2115a12a30af68485899a256bc789306f587f4c"
    hash48      = "0c44092bbc3e4c48392587ef6d0c44b978a84d237754caa9110f61452699cd50"
    hash49      = "0f0bc37b7001e8950cf527542b5aa55a534d55ce3f524403f58d85818e2457ba"
    hash50      = "a0f77db4f3ca9ad0b2e8e0265e1c1e73cf148824bb4c42aeca10d5a1540f214a"
    hash51      = "8cf369cf568edc4aa26da68c5067bf8c243eab666d51ec41019f38bc3c74cf9b"
    hash52      = "2239cfe9eb9859cb24f9357729caaefe8ee465b3df75f22d0e3831246f6f263c"
    hash53      = "cb31eec678d7e124b885e3f40f942223eb5989ab022fc5189369ad89cb769c03"
    hash54      = "8b71b9075b45c667630406e0705c6597a76fc322b9528938d6bb312ad1339ae6"
    hash55      = "4bc6a438d039e76b07fbd6b26a108d45bb3a3e59183cb4cf8a612d0a3bdb3813"
    hash56      = "8d4dd23d3dd6a413d3cc7441ee1ef87437ab7d65b949315f7e40068faddaa06e"
    hash57      = "7a34a8374f396206511c8cb00d80a5817293afa93bfb464d50515a6597eff93c"
    hash58      = "020eab18d60967ce3d67a68077fd40c0a489fefa48a36cf4109d60864ad6b3ec"
    hash59      = "00d9916e795c53f32af24edd5b808b6dc3d51ff364b032027cb62b4e2b7802bf"
    hash60      = "9cfe05c0304b6e3ec6f8f3428be4305041ba7270f3f17d24c68a031cb8f70a21"
    hash61      = "e9974c363b90c1579f30c950b8f209cf413479157a79a3b3708a36223b35ff26"
    hash62      = "09460003f8b25eb273d09ec2644ece01b0a1e14439860c423e62c30fb7fb9046"
    hash63      = "3d75c21db079d6f4a2ed85b3f2a12f79c804c305c4e12cee3c34a23a4c4c881b"
    hash64      = "34aea333214af81f2715add9eac2289434d8290ccc6ba9584dc0b806de1ea089"
    hash65      = "0d441316bcea8d74c6c510546273825eefe0e4d32654719bd894156c278fc1ab"
    hash66      = "0a1425f4dafa9f9da793e6103940ffd75c65c6b5bff5390d071de93c94562ff8"
    hash67      = "86e6965f35d8e4254491f937bcc15d94a5ac003343d179549fb0bd208d7100fd"
    hash68      = "1e346464a3a357f2ac347935e2cd8b4aa5467b7786c47152fcc6c8bf0a382231"
    hash69      = "dea6ddf7ea26749360a0783d3798772c64b600934568455d48335003ec696495"
    hash70      = "391532c48dc00b3ab140ccf5c8a32931327d26c2d16167c49e8a4cfff7d25979"
    hash71      = "a0472855805f3f3e943f0bad8dbc14767033eafb0c6e0ae72381fa81e59f8f9a"
    hash72      = "18f09cf0594ad76612e73311ae540dee6e9d6367d4899b0ef6a94ee85e693518"
    hash73      = "a5b2351d9acfb98fed5178cea5cfbf6e200586068c7b91823272a3a6fe6093c9"
    hash74      = "d57cb03f164e13389ff9a32d3e97abe447bf021205a89a48a2c9097c512753ef"
    hash75      = "4bddc2d9005da165a637ffd0b13897a90224f40981e4b91aa3e890b62a8f23c5"

  strings:
    $s1  = "I`m so cool :)" fullword ascii
    $s2  = "Mess with the best , die like the rest" fullword ascii
    $s3  = "What`s the point !" fullword ascii
    $s4  = "I`m very dissapointed with your performace" fullword ascii
    $s5  = "Com`on , that`s the best you can do" fullword ascii
    $s6  = "I am the one and only" fullword ascii
    $s7  = "I rule" fullword ascii
    $s8  = "You suck" fullword ascii
    $s9  = "How lame can u be ?" fullword ascii
    $s10 = "You realy think you can escape me" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2ee4e870-7b63-4e1e-84bc-c45016f8de00

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion