_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_479_1_Trojan_Danger_Ge_491

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_479_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_510_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_109_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.184D283B_1.vir, Trojan.Danger_Trojan.Generic.4385790_3_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_162_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_240_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_306_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_366_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_415_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_453_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_487_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_488_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_49_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_50_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_51_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_52_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_53_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_5_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_7_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_52_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_177_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_178_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_195_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_32_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_72_1.vir, Virus.Danger_GenPack.Trojan.GenericKDZ.103285.vir, Virus.Danger_Trojan.GenericKDZ.103285_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_5.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_1.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_10.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_11.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_12.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_13.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_14.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_2.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_3.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_4.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_5.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_6.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_7.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_8.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_9.vir, Virus.Hijack_Trojan.GenericKDZ.103285_219.vir, Virus.Hijack_Trojan.GenericKDZ.103285_342.vir, Virus.Hijack_Trojan.GenericKDZ.103285_379.vir, Virus.Hijack_Trojan.GenericKDZ.103285_453.vir, Virus.Hijack_Trojan.GenericKDZ.103285_465.vir, Virus.Hijack_Trojan.GenericKDZ.103285_466.vir, Virus.Hijack_Trojan.GenericKDZ.103285_58.vir, Virus.Hijack_Trojan.GenericKDZ.103285_589.vir, Virus.Hijack_Trojan.GenericKDZ.103285_634.vir, Virus.Hijack_Trojan.GenericKDZ.103285_670.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_479_1_Trojan_Danger_Ge_491 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_479_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_510_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_109_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.184D283B_1.vir, Trojan.Danger_Trojan.Generic.4385790_3_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_162_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_240_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_306_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_366_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_415_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_453_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_487_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_488_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_49_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_50_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_51_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_52_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_53_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_5_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_7_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_52_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_177_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_178_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_195_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_32_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_72_1.vir, Virus.Danger_GenPack.Trojan.GenericKDZ.103285.vir, Virus.Danger_Trojan.GenericKDZ.103285_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_5.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_1.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_10.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_11.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_12.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_13.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_14.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_2.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_3.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_4.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_5.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_6.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_7.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_8.vir, Virus.Hijack_GenPack.Trojan.GenericKDZ.103285_9.vir, Virus.Hijack_Trojan.GenericKDZ.103285_219.vir, Virus.Hijack_Trojan.GenericKDZ.103285_342.vir, Virus.Hijack_Trojan.GenericKDZ.103285_379.vir, Virus.Hijack_Trojan.GenericKDZ.103285_453.vir, Virus.Hijack_Trojan.GenericKDZ.103285_465.vir, Virus.Hijack_Trojan.GenericKDZ.103285_466.vir, Virus.Hijack_Trojan.GenericKDZ.103285_58.vir, Virus.Hijack_Trojan.GenericKDZ.103285_589.vir, Virus.Hijack_Trojan.GenericKDZ.103285_634.vir, Virus.Hijack_Trojan.GenericKDZ.103285_670.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "fde027721164bfa246def635cbef3fe2c25de9d059a4afd48af762488fc8fb85"
    hash2       = "23623cde934297ddf886b30d5859809f224c7efa8b67f3d7608b5a23028ac903"
    hash3       = "f4c09d7b6c75b788dfb360c708b6df2031bd572dd7af77fa018b3178aa5c8720"
    hash4       = "525abd5cdf1ee1f2601b76ed6f6e8b4529429145761d1fbbb94c251893e23254"
    hash5       = "39db9a552bf70861e935c9b47a6e69f07ed701bc7ed8b03968592b260dae55c2"
    hash6       = "02f17f38f55e3c843dbe98741b115aaf187bed05065f89f4f960eb1f93bf7b69"
    hash7       = "0de91de9e1702d1414235f06c6670fa6ee9ee7bcd26d5673adbe600c60b7f422"
    hash8       = "511ade7a819f63ddc9dc7d37be68f365029ee724522d0a6167043a52a71cbc5e"
    hash9       = "ebbc65f81dab6a5f4a8416d2d54d6255966a787fd6343b545579fc4bfc5c9c5d"
    hash10      = "5e08fc7010cdaf6e0d450628ef5ada6e530a9a56dab69e83cb2a03af521016d0"
    hash11      = "4392433fffbb2dc36756dbba84dd916cb1e9074f6ac587c270295bb8da6841c9"
    hash12      = "a402411df17250cb7741d1ce704848b51f33105084fe29bd59fa1eff83aaff5b"
    hash13      = "8ca137ec33d3d7603a5f74598d797ed0e172f1ba22aeb7296a83a76c5e210d5f"
    hash14      = "c163e72dd44d2e9e09617dd0740d9d81aef5123a50aed5934fc2f8a910971f67"
    hash15      = "71525b4a874898067cb433adc480a7d8b7dc264632682f91da0c53c3a3a38e15"
    hash16      = "32b73786432177952a0f2b728da520f683305a98abf5e80c883be66d49f28822"
    hash17      = "bf7d3af49ea1499361e7fdd12d09d7da291855d3256ea542c8a1208f9286a99b"
    hash18      = "b65b00c2e3afb5a2e56fde2e6c075a9a94853b2f814222d22bfd05f65ae6d141"
    hash19      = "92c273f0f94bfebb701fa72e905f951b58bffbc82f44788ac7f5d2f4e3dd3e53"
    hash20      = "bf2c8c262814323b1def3296c7601b790cfd1bd3b5bbe18105840ebd4f9cb354"
    hash21      = "6cf1b85e45b9b89598390e02d9c4a333d5b51775680dd4b799d8ae35d495d771"
    hash22      = "672a9b423aa09dba38cf02e8c29a329f5c4b88a052bcd08c36abd23efb2b8370"
    hash23      = "5c33df1fed2feb99c208e18bd481ed289b01b5e66f564c41e3c764ac287f1c1a"
    hash24      = "6a7a7bbf6a6f61f44836480e40fa69793be0a222e3eed2bef9fd1aaca13a0a30"
    hash25      = "dc2ecc2cc2ed76d0b8f20a3d51c86506fbf9a8cd0922a2062f72aa7c27c0643f"
    hash26      = "6c14235395aba31e464363189f8b204f69da9a49724628465f073b227337099f"
    hash27      = "8a04ad8980d273401a8b78b4ab9ecad0785a136491b4e2e64a5c985bd09c9ce7"
    hash28      = "94f22610375145ea35982da1ddd0d1c191357b6b56e8fb856278c2d4d166c0f6"
    hash29      = "3b9e3a78e78c958e43f2c49bf601a6b0b0f76e6e621175fd7a9a246b2af9d3f4"
    hash30      = "6255bac087fa42fedcfd37ac8109ede294654999caf0edd8432a34d455c898d3"
    hash31      = "97b7e6e3ffa9c0a7e0a97d515a372a68d76fe47f24a8f4f3d0aa7c0698581b17"
    hash32      = "70f8aba43755735e5b8a8a4c4ed50d94c46a3429d8495ef7417324dde4740aec"
    hash33      = "58f5863b4f5640d01d488ceaf4126e5f63b5185c58823d7864d6ca40852165a1"
    hash34      = "7d370f378767379ef2a4e169251617a7f5f60b2eeab1119734f0b32462657e44"
    hash35      = "903e7add5b4011805bba7bc421a7f37425462fd059e469419bdd83a7d4839615"
    hash36      = "1cad144b45ec7fb1a871e7afa0c4517b62171c717402421640c111b698c70e34"
    hash37      = "caf60d1393c6c18c607aadf5ed64ceef37a537b60b70433db4530f7b37e8b945"
    hash38      = "8164a195c08c293236dead6e9ecf37ec6925238a2ddbc8ea6d743706ee84bdef"
    hash39      = "9052f7515a3de62e38ff08bda59448eb26c50865885e3a7cfa6e95c650e61968"
    hash40      = "2283f8ecf17a9c970702a88d32ae3213bc1ae471db2d2bf7b7d519b3ef46e400"
    hash41      = "15c620dafd58dd02a57500119738e057741ade9911ce54b0b72ee0c4448829c8"
    hash42      = "056084c536ed7624e492969bd070ede462a936628e67849ecdd03e10bc3f9fda"
    hash43      = "5b3ad0e3ce1c50ddde31d9b3aa7d150da2f9ce7255d78dc9bf13c1c9ff3f4e54"
    hash44      = "d2ead90fa7726697af27bcb4e1b5906e9868f1fbbf03939fd62e7e555950da6b"
    hash45      = "47bd347eaa143067b8ad340bc030c65743a4afaf304cc8fc670ef0d29317bbf9"
    hash46      = "87c06f07724917f2156b6f823089fc79b90c2a484517d6bc130f9d8ada0c5a42"
    hash47      = "35738fb9cf7d2b164301936bd1d2a4ec18f554bb49086e96ca3ed0bd3fdc9338"
    hash48      = "fd19e43f3de05c0f327500ef343b0edcf260072976aaa3692b2d96edb6222efc"
    hash49      = "be026057146969b40b7cb795b759080f4eda4228b97fd806d964c67a19f7a0b7"
    hash50      = "3453a45162e7b0e7ebf23bcdd8b3f785459ae9c8ed45b07e6875e755995dae1a"
    hash51      = "e33ece0965a2b2a0b876eaa0d44c037ec5d300e8b0a343c487b08e5ee18cc7ac"
    hash52      = "9dc6a0d09d5ee4c45b74e10f7a2acdd956c798d717c14e90b4212f08240f3393"
    hash53      = "c4323461fd95e9c55cb41fadeebe690cace95fb57721521ca349e050edc4f8ba"
    hash54      = "66e92e41aa1477852303ecbd7dad67877cc72a1468afafd25b675a396e6a0343"
    hash55      = "bd21c8e97e9c6d50b1eb972d7c7188b0d64ac4038d5c38d0e116d1d46c4606a8"
    hash56      = "e4a52a854fa14f9997a73ccb412a2e59d3ef705bd7b4c066cc75295cdfecdddc"
    hash57      = "5045b1df170a2e54092b4a3bc5e31d1f707bd46495effe2310ef37f1b9113444"
    hash58      = "aa22eb2eb6b5fe0b4e2c53f7c26fb754f3ac0c77c1d4670161ff599ee8ec2cc6"
    hash59      = "33177120b334aec8b866a9f98f2aa174c0f18773169dbccb1b865b912a900b52"

  strings:
    $s1  = "your proof of purchase. If you acquired and downloaded the software online, your proof of license is ther. At the end of the ter" ascii
    $s2  = "your proof of purchase. If you acquired and downloaded the software online, your proof of license is ther. At the end of the ter" ascii
    $s3  = "instruct your employees and agents of these requirements for the TRMs; (c) restrict disclosure of the" fullword ascii
    $s4  = "r employees and agents of these requirements for the TRMs; (c) restrict disclosure of the" fullword ascii
    $s5  = "the licensed compu" fullword ascii
    $s6  = " LIMITED RIGHTS VERSIONS" fullword ascii
    $s7  = "m, you may renew your order for an additional 6 month term at the" fullword ascii
    $s8  = "gents of these requirements for the TRMs; (c) restrict disclosure of the" fullword ascii
    $s9  = "s of these requirements for the TRMs; (c) restrict disclosure of the" fullword ascii
    $s10 = "How does Internet activat" fullword ascii
    $s11 = "s Reserve Force;" fullword ascii
    $s12 = "the licensed compuprovide reasonable assistance and access to information. You agree to pay within 30 days of written notificati" ascii
    $s13 = "the licensed compuprovide reasonable assistance and access to information. You agree to pay within 30 days of written notificati" ascii
    $s14 = "(including the denial or cancellation of any export or other license); other event outside the reasonable " fullword ascii
    $s15 = "with relevant hardware and software vendors, so that they can use th" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "a70efc8f7208c2d6236bbbb720c6eb1b" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

37a1baed-fcab-48b0-a06d-b837b0bf45e5

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion