_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_335_1_Trojan_Danger_Ge_458

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_335_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_336_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_337_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_338_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_339_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_340_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_341_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_342_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_343_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_344_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_345_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_346_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_347_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_348_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_349_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_34_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_350_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_351_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_352_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_353_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_354_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_355_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_356_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_357_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_358_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_359_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_35_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_360_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_361_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_362_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_363_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_364_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_365_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_366_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_367_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_368_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_369_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_36_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_370_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_371_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_372_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_373_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_374_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_375_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_376_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_377_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_378_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_379_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_37_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_380_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_381_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_382_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_383_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_384_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_385_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_386_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_387_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_388_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_389_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_38_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_390_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_391_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_392_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_393_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_394_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_395_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_396_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_397_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_398_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_39_1.vir, Virus.Hijack_Backdoor.Hangup.B_280_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aa9T7Ob_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aa9T7Ob_6_1.vir, Virus.Hooker_Win32.Backdoor.Agent.A.vir, Virus.Hooker_Win32.Backdoor.Agent.A_1.vir, Virus.Infector_Win32.Backdoor.Agent.A.vir, Virus.Infector_Win32.Backdoor.Agent.A_1.vir, Virus.Infector_Win32.Backdoor.Agent.A_10.vir, Virus.Infector_Win32.Backdoor.Agent.A_11.vir, Virus.Infector_Win32.Backdoor.Agent.A_12.vir, Virus.Infector_Win32.Backdoor.Agent.A_13.vir, Virus.Infector_Win32.Backdoor.Agent.A_14.vir, Virus.Infector_Win32.Backdoor.Agent.A_15.vir, Virus.Infector_Win32.Backdoor.Agent.A_16.vir, Virus.Infector_Win32.Backdoor.Agent.A_17.vir, Virus.Infector_Win32.Backdoor.Agent.A_18.vir, Virus.Infector_Win32.Backdoor.Agent.A_2.vir, Virus.Infector_Win32.Backdoor.Agent.A_3.vir, Virus.Infector_Win32.Backdoor.Agent.A_4.vir, Virus.Infector_Win32.Backdoor.Agent.A_5.vir, Virus.Infector_Win32.Backdoor.Agent.A_6.vir, Virus.Infector_Win32.Backdoor.Agent.A_7.vir, Virus.Infector_Win32.Backdoor.Agent.A_8.vir, Virus.Infector_Win32.Backdoor.Agent.A_9.vir

rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_335_1_Trojan_Danger_Ge_458 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_335_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_336_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_337_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_338_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_339_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_340_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_341_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_342_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_343_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_344_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_345_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_346_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_347_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_348_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_349_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_34_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_350_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_351_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_352_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_353_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_354_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_355_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_356_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_357_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_358_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_359_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_35_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_360_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_361_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_362_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_363_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_364_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_365_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_366_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_367_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_368_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_369_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_36_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_370_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_371_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_372_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_373_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_374_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_375_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_376_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_377_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_378_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_379_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_37_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_380_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_381_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_382_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_383_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_384_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_385_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_386_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_387_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_388_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_389_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_38_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_390_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_391_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_392_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_393_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_394_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_395_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_396_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_397_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_398_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_39_1.vir, Virus.Hijack_Backdoor.Hangup.B_280_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aa9T7Ob_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aa9T7Ob_6_1.vir, Virus.Hooker_Win32.Backdoor.Agent.A.vir, Virus.Hooker_Win32.Backdoor.Agent.A_1.vir, Virus.Infector_Win32.Backdoor.Agent.A.vir, Virus.Infector_Win32.Backdoor.Agent.A_1.vir, Virus.Infector_Win32.Backdoor.Agent.A_10.vir, Virus.Infector_Win32.Backdoor.Agent.A_11.vir, Virus.Infector_Win32.Backdoor.Agent.A_12.vir, Virus.Infector_Win32.Backdoor.Agent.A_13.vir, Virus.Infector_Win32.Backdoor.Agent.A_14.vir, Virus.Infector_Win32.Backdoor.Agent.A_15.vir, Virus.Infector_Win32.Backdoor.Agent.A_16.vir, Virus.Infector_Win32.Backdoor.Agent.A_17.vir, Virus.Infector_Win32.Backdoor.Agent.A_18.vir, Virus.Infector_Win32.Backdoor.Agent.A_2.vir, Virus.Infector_Win32.Backdoor.Agent.A_3.vir, Virus.Infector_Win32.Backdoor.Agent.A_4.vir, Virus.Infector_Win32.Backdoor.Agent.A_5.vir, Virus.Infector_Win32.Backdoor.Agent.A_6.vir, Virus.Infector_Win32.Backdoor.Agent.A_7.vir, Virus.Infector_Win32.Backdoor.Agent.A_8.vir, Virus.Infector_Win32.Backdoor.Agent.A_9.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "28a392343ffb864b21b8567269d94d3ca135c4ad5f84950fda905ad4dd21b68a"
    hash2       = "8b44b5ffd279da7da75eb24c79867b79981e68daafb479b5d8e52aca75410062"
    hash3       = "da563e7828a6fd87e48bb8a7c71884f15d204a0f58c1b25e3888072174080348"
    hash4       = "8403be2d50e4a8b6258d63951eaffc32d9aee49b2210de78dc1cc6dc4b4cabe3"
    hash5       = "167bfc17c94b3ee722174cb13cea5448c18b33d9308801bb2c2e5ffc9e38fe1a"
    hash6       = "48e410176519b9c712b48271e536450bfbacb0e2443844fa05d6ba434b32e0b0"
    hash7       = "ff802563bde512c6bce67b7dbf5e4cf57d45f4366045545d3d0dae2739cf09d3"
    hash8       = "d7671375f2ea272072610c732bdc74a0894cad752c629b6bb7d229eae1352e1d"
    hash9       = "c5c683eaf65736655e121b54b581b36029867fbf781d677c3a00b21b8a843e69"
    hash10      = "b0da42ac528de6007c979be8da6ef0177b13a70d59698d541c83d861c8b3ce64"
    hash11      = "65f75208410166b15a607a411f1a1c7665502dbf8cf5bce5df98b49245f5dddf"
    hash12      = "db829fc1a521cd4749e7c71ba30e5c07a4d8331a2801902141cccf9a9e9fef38"
    hash13      = "2123b7c738a3da84645ca88d22898d9eb04eab13a383866491c2ab1a33c76bdd"
    hash14      = "2f6c82f5a3f657f633040ddd08ab4fbd7b105842e5180e65206b7d0690301f06"
    hash15      = "2427a950340d7aeca5f78b5528799ed67033c7c778da43727871a93946df04d1"
    hash16      = "ee7b858d9f84f296703172880052ad57bde6d1ed322719518b566dc698f22656"
    hash17      = "855077fcab63188f78ff45cd0001dbd6a8a3826fce06a9717c8812446b2cef5c"
    hash18      = "d5b1fee37da9616136d587823b4dd5bc17a5a3cec47729588ea06a484ad4590d"
    hash19      = "7079df4b9986f1fdaab225dd8e0e0716a957565435e1ea833c1b3f9014a97f15"
    hash20      = "0a20aafeee0b42567577e8e77629c62baac854f2c02c7bb5367fb67998946dd8"
    hash21      = "551c6fa9ea6fbf81e2146688df95b6528ec9278f714e97309d720ecebd1f3180"
    hash22      = "40d44b0e8c66b08cb7db87198d7a66c5996d813042e5e18ba6b25f7cb5b1eac0"
    hash23      = "556526798a92a05cadd6a2b115434c9bf29b3bfede3c719fdd6915b0753acb42"
    hash24      = "1f5259e48f53dda6c8a654ab6c5eb528c7f5c077f50ec5c9a63df966578d5711"
    hash25      = "b56d34127cc725b03b304ed285914b947e3168fc519e8277f7d70e5e4f9e1b46"
    hash26      = "08a27712d1938986fe2d89fb83933e475c7af4ea0015d2f6b288e1721b4bbde2"
    hash27      = "7625f20f1d9020584a40560924888a7d5b1f57edce231c5011f203ab3e93ffd7"
    hash28      = "362b80571e93f2305f276ca2505b66a295c32d9bccb4dfb8196b7fc62791b93c"
    hash29      = "c72a7ebf0be1dc214ed19e7265e1fa7ec53d7474390cad447023d0da0b301e18"
    hash30      = "68d9e11a5b225ee1d4a2c8ff69fd0fc075043a62f0c289cebc68791312051dd9"
    hash31      = "bb39dd6e4175033ff326e34f74324e79ff80e7def061a095ecc3bd53d30a3780"
    hash32      = "3db78838d40b38b14ebd9d90f67c0d18f8ab46606f405b8b6005ec13b769ae6e"
    hash33      = "8e2ee18502e9675845ac7c8998a4af8da81665adaf0e183be2187939a95b8db5"
    hash34      = "83bfdfae99d35152ee349df20b6b262d8fe460dd0e8e11ba8769a36d19815775"
    hash35      = "d9cbf530cc3c1ab0a42bc04c92d6e97059681c42d372ab00295754bf788681b1"
    hash36      = "79da205f222ed0ee4bb32afa11f8e1da9da4b802b96a5eaeb2cb5605e9e2f2d6"
    hash37      = "5b6ca7b6979a7c8ad5355de080bf4d5213dcc1f43a9140922d9de3f1d428c066"
    hash38      = "a45dba5f173b96d38316fc0951e8678c0301005f5627f48c14f2a267b481902b"
    hash39      = "76daa9136fd580623d51d70bc36c36a6145cd50ec7b787e8772645a420cd39e8"
    hash40      = "3657c2b928e6e2d40106ae02952ab174013e764ef099ae49e42965cac01d8cc4"
    hash41      = "50dda1904d6d738ec8ecf6a0e77c550a884ae3d02eb7fad5deb0bdb1928ae363"
    hash42      = "9f0683967fa1616268d9e8b9de391ba7529c912c00e2dcb8bf0baf0fb7179e41"
    hash43      = "330f2992b5783a5ad1d087cf2619d49eb6dca7e77fd85d0df35588892bba1d07"
    hash44      = "d90832a5cd2534c325bb45c7a362d78e6a18de880503872830a475ef16138171"
    hash45      = "1f10a3a22fc8b20ce4f9a6a1d674ddeefa1e3cd222c09c6f20d64575cd2ffdd4"
    hash46      = "590f20840f6275abf35c41862de9b74ec49c80fdab4b388895da5dfc42df5913"
    hash47      = "e0a125fbf3c3cc4c16856a7b27e17c062ab2e24efeebd8de417aa475a1c7896a"
    hash48      = "006cd26de1882776dc47769ff68b340610a1aff066b175e0b3578fd3ffaa6e90"
    hash49      = "4845555de65f9a36bd4650c5c04f94b3cd7b1e25677cbdaf75cf33af4d870ec8"
    hash50      = "87fc62fcf9982a3888cb5697f71e9ebf57b0e8545619d2925917ed2b664f7326"
    hash51      = "3d0a9c423451e43b3c2077c79792cc758420e92fbc37323dc4b1205c22c9db2a"
    hash52      = "ebcd4cb2cfb162afcd2c04c79d0f08fa953c2ebbc85fdfb3575bf7ac1f6c3263"
    hash53      = "d016df931fb8a2706bb5c0885aefa155e8525238282ab65aa756491ff13322c5"
    hash54      = "6156cd1ca78956114e378ad98c6e705a3fc3b093ef2cfb2d9e95229eb8af4999"
    hash55      = "7159dfa110a229839b24a001de9e65225ff08a6d1646b726c2b07ff32bc20f8c"
    hash56      = "8806b8b317a3002d1b746b9937da670880e5a81804a07b584af8f802da2ff259"
    hash57      = "112fd3e941e17648c857b64ac31b96bb512a37a5ce4c095b55a1276e5c88ce74"
    hash58      = "5dbaad9de845c885ebbef1a77d74fb6d380915e356389ec2a1f20ce57f7ea9e2"
    hash59      = "2c9a836b33b83c1896fa8c02821ceb6d37949896c10a36a84c8b194d2c28fdf6"
    hash60      = "d6c5e3ba772915984f6a42d354595e039a54b7378f0faa091b2c245f5b8bc9f3"
    hash61      = "665c35bfd70f2cef143a76d8e1c4bf819c6fe9e9ec8b4320c7d3ebe2406200af"
    hash62      = "09339de0cf3d60f03e222090fb636eed6156ca0fc617011e3086a33e13042ab4"
    hash63      = "401a6c6a97a6fbc70223cfc9f0f538b624b31e26f9db06d9ec521b3b4842dcc9"
    hash64      = "2148d927bb92d54ae7170d416f2c4f815ded547610c8dfdac3355de7ed03378a"
    hash65      = "277e062f4cfd572e75665b59ef719f7bb27adbe77c8596c3c06eb752b56d5c3a"
    hash66      = "9eeb64fcc5a6e610e1b3e704d43fb7719dc6de4b01a4be46ad83ab6b0392a031"
    hash67      = "d49b585d062b51ff3a8d6fa6b35446bec1529e219f021cca51c2cb70d7e0f233"
    hash68      = "e1b4bea2fb1f2d67c6cb205f74611f22b3eb5383028fabcdbdd9ac5bdc66b2e0"
    hash69      = "f2e14df78a3fef368bb041a4b07892445469ebfc87b37f19291330837c5504ee"
    hash70      = "fd41c548b5978d72e9dd7ffaba374616f320c9ee097e4209c554b54e933b6b8c"
    hash71      = "9bb4452b2e69d8f4130597511f0081811d72fa25684fa6413ee83b7eace85bbe"
    hash72      = "2f882d6a7f50534276b63d3e736c0ba05a937e9663980c3be5b61f6d71288996"
    hash73      = "de9e708276fbc97aa681c900684f7b4ff17ceb977a8a7b36638e17e8cf355cab"
    hash74      = "d4b9f0dd838679fea46492a4978167da4eea83644eb77fe3b28e753f24420c75"
    hash75      = "2624cd3a9e9c2181f3ade7c82322bb92e4c2d68984391c6a5538c4972bdf46ee"
    hash76      = "0830a0f7aa6718ea93f5e37a9e5099b0402444dd6a6da919044371034cb92da9"
    hash77      = "c41d21776efca919706708202c55dc22642c3afc10510f11afdeefdd1fcbca29"
    hash78      = "d0c9a7adee1e1931be9d182cead9027b6d1212dee785b4a2c6aebcd079147ea1"
    hash79      = "fe59cc6c55cde398b7aad181d4eceea8caf2d499f11d440a77691fb7ff591172"
    hash80      = "bfbf21fadff627580ece8277f3109d23121a556de2e9399975843aee7833c96f"
    hash81      = "006c9cc5b57bad92414bc6c762f4f6e1092e7fec5d7f740730caeca7d0d7f7d5"
    hash82      = "221f86bd4b9131a0528d26deb30e80e734cd359622950f926a8d6d56b4f0c4f1"
    hash83      = "2ee405e00335a78c1f129035da236e22c85ffe059b135ad4edb49387b942a62e"
    hash84      = "d38e4b6364191af9e2f2a3375af65c8678ce7b8857f50cf602355144dd5eba9f"
    hash85      = "69ff892bc89166968c75c0f9b61254533790066c7a84a9c4cf0d2288a9abc674"
    hash86      = "49e3df484261b8348dbbd0ba4c90f172da67c838c0b959eda922be346934f9cf"
    hash87      = "09d72627c9197ad871483318166b7be20cbb163d02dd5818456faf35ebf0261b"
    hash88      = "54f0412e70c00c441616a891c853d631ed25d2771227c2055367f14e0de9f9e1"
    hash89      = "34a3063146e5faf380124b42485d41a87211afff368d9d6e814ef5c09ffffc45"
    hash90      = "1533501277c45660e160278f464b45aa86a9b67d6fd9efbf30f930638c7fc8f3"
    hash91      = "3ac9e3b2dc53e80a7b55744a3f11ac2e989e2dd73917cc714987c8785a810e19"
    hash92      = "c64c3ae37c59529766ceff74dda91f122e15839124e0c28306b48f1f038a15ea"
    hash93      = "d7355010e550bac083c129a4de387c8799fb6014e454fa0c8088ee42602fe4c3"
    hash94      = "8c2ebb18b897423e8c170ddeb079de20d9c3c5c7aa6df8f3704ab16afb94872f"

  strings:
    $s1 = "FROM LOADER" fullword ascii
    $s2 = "Cannot kill that process" fullword ascii
    $s3 = "Cannot execute program! Application will be terminated" fullword ascii
    $s4 = "  [ERROR] " fullword ascii
    $s5 = "EXE_VERSION > VERSION" fullword ascii
    $s6 = "Cannot copy current file to main dir" fullword ascii
    $s7 = "cannot find RCData" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

fb683eee-d654-4c08-a5ab-2a8e2ef7e097

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion