_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_528_1_Trojan_Danger_Ge_447

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_528_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_120_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_14_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2D3D82A8_5_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_88_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_13_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_47_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_56_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_116_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_147_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_169_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_1_1.vir, Virus.Danger_Gen.Trojan.ShellObject.k8Z@au4JtZd.vir, Virus.Danger_Gen.Trojan.ShellObject.k8Z@au4JtZd_1.vir, Virus.Danger_Trojan.GenericKDZ.103285_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_3.vir, Virus.Hijack_Trojan.GenericKDZ.103285_401.vir, Virus.Hijack_Trojan.GenericKDZ.103285_534.vir, Virus.Hijack_Trojan.GenericKDZ.103285_570.vir, Virus.Hijack_Trojan.GenericKDZ.103285_620.vir, Virus.Hijack_Trojan.GenericKDZ.103285_639.vir, Virus.Hijack_Trojan.GenericKDZ.103285_663.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_528_1_Trojan_Danger_Ge_447 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_528_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_120_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_14_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.2D3D82A8_5_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_88_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_13_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_47_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_56_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_116_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_147_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_169_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_1_1.vir, Virus.Danger_Gen.Trojan.ShellObject.k8Z@au4JtZd.vir, Virus.Danger_Gen.Trojan.ShellObject.k8Z@au4JtZd_1.vir, Virus.Danger_Trojan.GenericKDZ.103285_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@au4JtZd_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@au4JtZd_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_3.vir, Virus.Hijack_Trojan.GenericKDZ.103285_401.vir, Virus.Hijack_Trojan.GenericKDZ.103285_534.vir, Virus.Hijack_Trojan.GenericKDZ.103285_570.vir, Virus.Hijack_Trojan.GenericKDZ.103285_620.vir, Virus.Hijack_Trojan.GenericKDZ.103285_639.vir, Virus.Hijack_Trojan.GenericKDZ.103285_663.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "41f7940601770f57209a32df2dbf93bc48d1ee6660ae9460425bdbd45ea405d0"
    hash2       = "31aa881c4d66e58b2dda88411a6ebf6032e5ec026171740d0166f756add51650"
    hash3       = "bd971fdbd8818f221ec4ccb50246848f0b3e7a47bb4d9a80539a3555ac0cdc48"
    hash4       = "663d816692b17ae7badb06fd84d5137b0d629ea4def22a7698ba713e524f46e5"
    hash5       = "4d5d46acdf5a516744d739f8520063392f53f9e44d9ae82b402d8db180df066c"
    hash6       = "befb555f8c1aa704415cde2c71184cc84e7e23c7d9ccff2f00758520f990c71d"
    hash7       = "413f74a82f2b53f0d6343552abcf3c7068a79eeda66abf1704573b978c9d7389"
    hash8       = "a790da6d69631af8db0302c4c1d671660744fdf8bc6f43696f613648c2c06e01"
    hash9       = "5fd8eec41359900bd0ca0ffb5fd13f67238a1a6d8cce62a173616261aee9814d"
    hash10      = "ac1d531d60263b859107116bb91dfe122857965cf216da0407cf09e4a2c57ec4"
    hash11      = "cd40a848c826c8426b3200445bcf1b01ba0b65c38e2ae9c3215bbf131d6f0942"
    hash12      = "7808453d7f464c1220b97e1976cfac6fa3771a418d5597cc11b1586c3dad3100"
    hash13      = "b383a50a9e551e386b04dd5cfb140d715124909a28fd331d5802988ffa8d34bd"
    hash14      = "b418685b254aad99c4f0d53651769a68d35703b1702b56caea0273ece0610ef2"
    hash15      = "d7989ecc80503910b6bceccff9952191f37dad20c1c928b5bc1cd4d48ac4635a"
    hash16      = "704c7961993fde8299f80763989c1861cd22a8109b08461e55df401d60be38df"
    hash17      = "7c3946ba2eead15eaf0662c958453597e3eb708c9e296f2727eb1bb97ad6391e"
    hash18      = "01f8de37770e3db292499e25a2fd9e0bbd363c8774b77193b00b54ca308bf4ef"
    hash19      = "24cbafd2784edacefcd8e8a8a59a2ba86077de458c923abe93957025cc4185dd"
    hash20      = "8d40dfd658e229c1278ccc6d0d83a44d0ad494a0942a8bd403087099f25e876c"
    hash21      = "96712f132d3316e715c77bd648f1abd2503c3d18a6c1a0dd5b3462ba73241433"
    hash22      = "dba9db8d56c35c33791d54386bffe984ed9863d5beb72e6ce9a03eb48ada274c"
    hash23      = "d469e58483574e40e49f0d92a40330c38374a70d2231f6449440c81c0c5bd2b8"
    hash24      = "7357894bc90f79f99fa3f6b10d10f8d578ea15d12b6f673af596de4cd3be1f3d"
    hash25      = "5055f7006f1ba4e20af4b1ec2c34b9cdc0a66e68ba45fd1e86c40a27f0781201"
    hash26      = "d7e43902ff880de4b03d808e51b517fa1113c264bb307ee9e0b091779168da15"
    hash27      = "33523424e02fb21ce203754144de588483fdd9088be5571eae153974bcf1df05"
    hash28      = "dacc12f55ad53763ebc7ab303b3f72910c9ff384a1bb0696af07e6ac2576b4b3"
    hash29      = "051df2c6cbb8e97ce628c63ab6cea43b53a2e00506afb970461fa51387279d4d"
    hash30      = "dad1657ceef381843148a535fddb41ccd6a4b354046a9a54dc34d95a7b51020a"
    hash31      = "dfafa2b4a1a0ae47bc94871c48e7165920d3a1c9d98972cfc9f53ece98de22b6"
    hash32      = "f94b273cd44351217d9122e83ec13dc801a4327b4e556428018437b535cea3d6"
    hash33      = "8fc0632479101db483f4dc4056e00ef9ca79e66cc71171c2b421488199fe4ffc"
    hash34      = "78b43e2922316c495f9a26cfddc06e0f47021d8a44b3e7eccdfb7c44e873879d"
    hash35      = "bcf8b81172cd1be13dfcb38128688e2f929efe49560781ea2357b4b1d72f4de0"
    hash36      = "609f875a1eeada6e70830803044d8c1264e5294fa3a8cbf7e3d68e0d098595b3"

  strings:
    $s1  = "Neither of us shall be responsible for failure or delay Processor: shall be defined as all processors where the Oracle programs " ascii
    $s2  = "Neither of us shall be responsible for failure or delay Processor: shall be defined as all processors where the Oracle programs " ascii
    $s3  = "Ported Number: is defined as the telephone number that end users retain as they change from one service provider toe also have t" ascii
    $s4  = "Ported Number: is defined as the telephone number that end users retain as they change from one service provider toe also have t" ascii
    $s5  = "the expiration of any trial period without conversion, most features of the trial software will stop running.uthorized to use th" ascii
    $s6  = "System: shall be defined as each distinct production database. Test, development, failover and standby databases are not will no" ascii
    $s7  = "Military Appreciation edition software is not licensed for use in any commercial, non-profit, or revenuegenerating activities.te" ascii
    $s8  = "System: shall be defined as each distinct production database. Test, development, failover and standby databases are not will no" ascii
    $s9  = "cooperating with the audit.d documents, except that you may not: (i) sell, license or" fullword ascii
    $s10 = "to return the software with the entire computer on which the software is" fullword ascii
    $s11 = "confidential legends or markings placed upon the TRMs. Oracle shall retain all title, copyright and other proprietary rights inu" ascii
    $s12 = "income (interest income and non interes(including your list of Most Recently Used Documents, your custom dictionary, and your vi" ascii
    $s13 = "Neither of us shall be responsible for failure or delay L. HOME USE PROGRAM SOFTWARE" fullword ascii
    $s14 = "policy, whichfee for Software Updates or Product Support will not increase by more than 4% over the prior year" fullword ascii
    $s15 = "are installed and/or running. Programs licensed on a" fullword ascii
    $s16 = "Military Appreciation edition software is not licensed for use in any commercial, non-profit, or revenuegenerating activities.te" ascii
    $s17 = "income (interest income and non interes(including your list of Most Recently Used Documents, your custom dictionary, and your vi" ascii
    $s18 = ", Manufacturing User, Purchasing User, TeleSales User: is defined as an individual authorized by" fullword ascii
    $s19 = "d use described under " fullword ascii
    $s20 = "the expiration of any trial period without conversion, most features of the trial software will stop running.uthorized to use th" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "f8b13d87494308df14c4b0ac0c76a57e" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

87a375b4-bea7-4ec2-badd-3b71d1f67538

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion