_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_540_1_Trojan_Danger_Ge_463

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_540_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_119_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_12_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_13_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.265C4121_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.288916CF_1.vir, Trojan.Danger_Trojan.GenericKD.35816276_2_1.vir, Trojan.Danger_Trojan.GenericKD.44959075_2.vir, Trojan.Danger_Trojan.GenericKD.67166905_17_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_246_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_310_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_37_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_418_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_454_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_478_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_123_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_197_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_52_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_93_1.vir, Virus.Danger_Gen.Trojan.ShellObject.i8Y@amWqEpo.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@amWqEpo.vir, Virus.Hijack_Trojan.GenericKDZ.103285_100.vir, Virus.Hijack_Trojan.GenericKDZ.103285_116.vir, Virus.Hijack_Trojan.GenericKDZ.103285_180.vir, Virus.Hijack_Trojan.GenericKDZ.103285_297.vir, Virus.Hijack_Trojan.GenericKDZ.103285_512.vir, Virus.Hijack_Trojan.GenericKDZ.103285_581.vir, Virus.Hijack_Trojan.GenericKDZ.103285_62.vir, Virus.Hijack_Trojan.GenericKDZ.103285_685.vir, Virus.Hijack_Trojan.GenericKDZ.103285_811.vir, Virus.Hijack_Trojan.GenericKDZ.103285_91.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_540_1_Trojan_Danger_Ge_463 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_540_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_119_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_12_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_13_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.265C4121_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.288916CF_1.vir, Trojan.Danger_Trojan.GenericKD.35816276_2_1.vir, Trojan.Danger_Trojan.GenericKD.44959075_2.vir, Trojan.Danger_Trojan.GenericKD.67166905_17_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_246_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_310_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_37_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_418_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_454_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_478_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_123_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_197_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_52_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_93_1.vir, Virus.Danger_Gen.Trojan.ShellObject.i8Y@amWqEpo.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@amWqEpo.vir, Virus.Hijack_Trojan.GenericKDZ.103285_100.vir, Virus.Hijack_Trojan.GenericKDZ.103285_116.vir, Virus.Hijack_Trojan.GenericKDZ.103285_180.vir, Virus.Hijack_Trojan.GenericKDZ.103285_297.vir, Virus.Hijack_Trojan.GenericKDZ.103285_512.vir, Virus.Hijack_Trojan.GenericKDZ.103285_581.vir, Virus.Hijack_Trojan.GenericKDZ.103285_62.vir, Virus.Hijack_Trojan.GenericKDZ.103285_685.vir, Virus.Hijack_Trojan.GenericKDZ.103285_811.vir, Virus.Hijack_Trojan.GenericKDZ.103285_91.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "9afe8cdd9c77faae686a658fcebcea69c64f7315192ed2f7730ddaf59b1206e7"
    hash2       = "14430e124d85f467284df15179c373075134667cc0830f93adba1ab17cc90006"
    hash3       = "716794f1026a7d2293e3ca720325273a717685aae9ec845307ed955247b03520"
    hash4       = "4ce7d5b7dd0f8bd0e5f6a2d1d4cdb745f67b7c54511dd613df285a044591a955"
    hash5       = "c6d55dfc1ebcd50fd60711def9c8a38d114763a13de9399059462445ce95f2d1"
    hash6       = "dd28461e0205c317b4f30e412ed86a31cfb73d61dc70dd11c4d59e679b47ff13"
    hash7       = "474af1d38360549467fcf44ee55a0b015641495e659070c60daabdf55ce0fd9d"
    hash8       = "ca99d7d82d21be19d0dc570e146051b25a226096f35cd04742ef1f0c061368b3"
    hash9       = "53595157c520267a60d7425f111411049f3ded97bb78caa54d0ce8db74076e23"
    hash10      = "279f063d04b23d5ffd4fbcc1b223d2d499ded16f34c76de67621197ac620cefe"
    hash11      = "b7758a0c0ded50c9715565213f1b8c274f0fd690b0e1c0513f37a3e28c058c49"
    hash12      = "0739d39050b6f4746e87137ade224f14141123bb3652e1a7d99ec6cad8ae4bdb"
    hash13      = "2c7db59fb1b7a17d1392b32e1a920ecb946c7c0fa4850fdbd0da187d3315eeb8"
    hash14      = "f042a6436b595bddfcc285ab486ceb3cd5b99a6ba0262a9b2e21d54efb415938"
    hash15      = "4ff9010107332201a7209246340f492886fe214c18bd3015d11fdc7caa7b0aea"
    hash16      = "3371170a3f23adea181ffac3b2d854fc4ea584bc6dbaae8efc063e43b44c8da2"
    hash17      = "932f055e846aa59211bb7a175f797cd36c6653a3e99e3647a8c44c57937feb09"
    hash18      = "f581b855cc8a4fe05c2728505bf5fc4da10406b1fd1fb82254ab66b0248fc43b"
    hash19      = "942bbd225cb553e112c84ab744530d55fca938073b648f43aa0ba180971b60c7"
    hash20      = "ca8b955122c0aa9598ef5953a22c53732576fe0ee77b2c1e9857cb301cd034c4"
    hash21      = "b210ab760a7e691722f86572573e9b4e9cfb84bed07e88e9db338af663104981"
    hash22      = "3a4872cd8b9e75840f9dfd93a5e4e0728ef9f8af4c0ede680f79592e200ce4f9"
    hash23      = "a613225fd006efeb1209085209f14d39206452aeb74816f4afd4c56467c5ea58"
    hash24      = "bf09bd056e5484e05d753fde0208e86d86192fb336c9bd2fdaf8cee34b6bc364"
    hash25      = "484cb10c68c1450cda3ebab325fd49c46f335ff635c4d7448be3ad13d22c90c7"
    hash26      = "cde2ebafb71901a4f714356d82c16d325ce581be7f38612838309ce2b5bba84a"
    hash27      = "720fbd316897528db94df32b58a22b2d8fd64555861df331b18e903edec49bdb"
    hash28      = "9a5126d8f4fd4faa552ebf58fa11725fcdeb855a6bb5440f00981758eb94e056"
    hash29      = "ea35a02b02d4536cfc5f4ed1bc7e7e95b40604c49ec80eabf57c9d3cd4f1511c"
    hash30      = "f038585ef02cef09982420ca6cfb934dec954b2e14a1b7f26e174aa7b0cb3b0c"
    hash31      = "f1a5323999993d785effd9993569c860ad8dcac101d9439423f4b4d38f225069"
    hash32      = "994797bc2d8134dbb6ff524a229622ad2c49516bfc513cea5ccbada3f1224152"
    hash33      = "7331cf5a27674e53ff9d747aa955091c71b915235f168bf363ac45216d12d5b0"
    hash34      = "fa3d9f4917c35f906c44c9da7bdb10a2e713cabb079e6266e00eaa67a2fde472"
    hash35      = "0932f1ec12a62d02b4ed070a110a4cb3e8a9911258f3a3cd138080d63b4a86b1"
    hash36      = "54b16f022756f61301ccbbf7aed60a24f651f996c2c18cd7efcdba1bb6dc264d"
    hash37      = "dab77a539282cda6e7212ee17edb6887f29f9a59f72b84da98ddc5a24720cf5a"
    hash38      = "ed5cfc8738584b4b974a9befce80f57d8d2c7cd4a06e920f25851def9e5d073b"
    hash39      = "e57924db65886acd0e51d472896be6ab97d546a1772875b737308332f7322455"
    hash40      = "6fa6479cbfdcedac982e7d4c5f54224e7753f121500d16d2dc4cfe37d09fcd5a"
    hash41      = "6606da1edb3d5388f6c03955652c177ce4c41ae40bb05b21133ff3dc4cfef345"
    hash42      = "4c6e3b3e7b4ad82739d123af5275e7c4f77ef29570cd077ce73bf2e13a2991cb"
    hash43      = "bb9960005f4fcc8c6aea1b6e9640a85e943e92baea6e9e01463429c7f48ada48"
    hash44      = "36d847885861364d4f33ef615033fba7920ac420da18ab1b103207fdf7661767"
    hash45      = "25ee9eccf44f1e7102e5f43eab79422b1d601a025846f640f859952cf3155b53"
    hash46      = "efbcf6023eb0f9335dc90c7fc7719d7d997bec39f38488bccc72850e9aeaea07"
    hash47      = "cbc9b8621a9fd9dabbdb17d7b8cd8f48905bdbdba23b1d5ab9820d57f5bfb661"
    hash48      = "f83b479beb548ae17e4111cb41c11efb0b7e9a9928b4579f6815f5b0b573c99c"
    hash49      = "3593abd08368b88c048132c3e35faa89e7cf5099df3bc06d9ef70f2df5c5492c"
    hash50      = "225a30a4c3d110566a5abd9f6aaf4a5970b449758ef2f8957d9dde5c67bf85d0"
    hash51      = "7516aa7510ccc0817b6cb60aab7c5c6fb91c74384dedca3759714530013575e7"
    hash52      = "7ec7fc3e5f1233ef78a3a3827329ff445ad69c9f18c1d60f4af7910737b7f28a"
    hash53      = "2fac3c5c47e70c76a5eaa5718c4519986eab5d0e81f098f4c0f9f872d0f9549e"

  strings:
    $s1  = "r. If you save a template provided by Office.com, information will be" fullword ascii
    $s2  = "Employee User: is defined as an individual authorized by you to use the application programs which are installed on a singleenda" ascii
    $s3  = "ade Compliance web site which can be accessed at http://oracle.com/contracts. You agree that no data, information," fullword ascii
    $s4  = "licenses from Oracle.e TRMs. TRMs are provided to you \"as-is\" without any warranty of any kind. Upon termination, you shall ce" ascii
    $s5  = ". Microsoft may use the computer information, error reports, and malware reports" fullword ascii
    $s6  = "the TRMs. TRMs are provided to you \"as-is\" without any warranty of any kind. Upon termination, you shall ce8. Use of Informati" ascii
    $s7  = "orders directly into these programs but any orders transmitted or executed electronically (via EDI, XML or other electronic: LCA" ascii
    $s8  = "orders directly into these programs but any orders transmitted or executed electronically (via EDI, XML or other electronic: LCA" ascii
    $s9  = "yYYprograms. The term Compensated Individual includes, but is not limited to, your employees, contractors, retirees, and any" fullword ascii
    $s10 = "yYYagreements or representations, written or oral, regarding such programs and/or services. If any term of this agreement is fou" ascii
    $s11 = "yYYagreements or representations, written or oral, regarding such programs and/or services. If any term of this agreement is fou" ascii
    $s12 = "yYYSubscriber: is defined as (a) a working telephone number for all wireline devices; (b) a portable handset or paging device th" ascii
    $s13 = "yYYSubscriber: is defined as (a) a working telephone number for all wireline devices; (b) a portable handset or paging device th" ascii
    $s14 = "including breach of contact claims and claims under state consumer pr" fullword ascii
    $s15 = "s lawful possession prior to the disclosure and had not beenndividual authorized by you to use the application programs which ar" ascii
    $s16 = "s lawful possession prior to the disclosure and had not beenndividual authorized by you to use the application programs which ar" ascii
    $s17 = "MERCHANTABILITY AND FITNESS FOR A PARTICULAR P" fullword ascii
    $s18 = "if the laws where you live permit this even when our agreement does not. In that" fullword ascii
    $s19 = "the TRMs. TRMs are provided to you \"as-is\" without any warranty of any kind. Upon termination, you shall ce8. Use of Informati" ascii
    $s20 = "the TRMs. TRMs are provided to you \"as-is\" without any warranty of any kind. Upon termination, you shall cethe software, excep" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "1c8eb9641eaa368f49e6f6358981bf48" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f1383b91-e061-4744-8056-bf5886f52bc6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion