_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_477_1_Trojan_Danger_Ge_515

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_477_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_507_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_105_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.0D531AE7_1.vir, Trojan.Danger_Trojan.Generic.4385790_13_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_159_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_238_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_304_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_364_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_413_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_451_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_477_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_90_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_17_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_49_1.vir, Trojan.Danger_Trojan.GenericKD.67993768_10_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_103_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_112_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_156_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_200_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_37_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_90_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_24_1.vir, Virus.Danger_Gen.Trojan.ShellObject.h8W@aqG68Ic.vir, Virus.Danger_Trojan.GenericKDZ.103285.vir, Virus.Danger_Trojan.GenericKDZ.103285_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_330.vir, Virus.Hijack_Trojan.GenericKDZ.103285_439.vir, Virus.Hijack_Trojan.GenericKDZ.103285_448.vir, Virus.Hijack_Trojan.GenericKDZ.103285_474.vir, Virus.Hijack_Trojan.GenericKDZ.103285_537.vir, Virus.Hijack_Trojan.GenericKDZ.103285_567.vir, Virus.Hijack_Trojan.GenericKDZ.103285_576.vir, Virus.Hijack_Trojan.GenericKDZ.103285_653.vir, Virus.Hijack_Trojan.GenericKDZ.103285_688.vir, Virus.Hijack_Trojan.GenericKDZ.103285_708.vir, Virus.Hijack_Trojan.GenericKDZ.103285_757.vir, Virus.Hijack_Trojan.GenericKDZ.103285_772.vir, Virus.Hijack_Trojan.GenericKDZ.103285_793.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_477_1_Trojan_Danger_Ge_515 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_477_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_507_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_105_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.0D531AE7_1.vir, Trojan.Danger_Trojan.Generic.4385790_13_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_159_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_238_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_304_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_364_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_413_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_451_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_477_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_90_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_17_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_49_1.vir, Trojan.Danger_Trojan.GenericKD.67993768_10_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_103_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_112_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_156_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_200_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_37_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_90_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_24_1.vir, Virus.Danger_Gen.Trojan.ShellObject.h8W@aqG68Ic.vir, Virus.Danger_Trojan.GenericKDZ.103285.vir, Virus.Danger_Trojan.GenericKDZ.103285_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_6.vir, Virus.Hijack_Trojan.GenericKDZ.103285_330.vir, Virus.Hijack_Trojan.GenericKDZ.103285_439.vir, Virus.Hijack_Trojan.GenericKDZ.103285_448.vir, Virus.Hijack_Trojan.GenericKDZ.103285_474.vir, Virus.Hijack_Trojan.GenericKDZ.103285_537.vir, Virus.Hijack_Trojan.GenericKDZ.103285_567.vir, Virus.Hijack_Trojan.GenericKDZ.103285_576.vir, Virus.Hijack_Trojan.GenericKDZ.103285_653.vir, Virus.Hijack_Trojan.GenericKDZ.103285_688.vir, Virus.Hijack_Trojan.GenericKDZ.103285_708.vir, Virus.Hijack_Trojan.GenericKDZ.103285_757.vir, Virus.Hijack_Trojan.GenericKDZ.103285_772.vir, Virus.Hijack_Trojan.GenericKDZ.103285_793.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "55a737d0744edf8762b7988128d9b30b284b0458bc212e7e644c862f896288db"
    hash2       = "288016f7ee422311f7572b11882c3544b47be70c42f14e68937770c2919e00ff"
    hash3       = "3c0ec8d76884fd986eb9dfcaf79de1cb0f3c0cd4c0ea4fb0615f6e59bfb9f1b7"
    hash4       = "c1c30617ebfe56b8d67ffc068f7e632cdc5601fa1d30a549d4efd189f7f92bc7"
    hash5       = "8e8d7b7b4030a11cedc6d0ff8a455c36e48d9ce6e0a29990e84b255250bbbb7b"
    hash6       = "42d648c2e7be6e308a778a1b4181450af0b7a76d6dc89baf57912448ade62f70"
    hash7       = "90d0041e87974a9c3c6e471487cf731fd0577032d250b0c06b2beea78a610d28"
    hash8       = "6b85b836d3b839a571d5bb20389002ec8a49db31cf8452975d0d7382b7c4c6f4"
    hash9       = "09d73cb5dcf4e85708042fa18838b5124c0c1fe6e3930ad3b18341d580b9da3a"
    hash10      = "8573d029f48e40c4e95416dd9b4ee26cc30338ce91c69bbb46961d5095151b07"
    hash11      = "a30d12470a4acc300ebca7ef5a2dfebf3b135e8c36b619820efe615e68c669c2"
    hash12      = "8c4f90bdfa08bfeffa9e24af90c843335d2949e507d103a981ccd85119a83e58"
    hash13      = "604fdd4f4d069130bdf9afd31e77932601f9c67ef00a7a04e1c7d5ce3f74a39e"
    hash14      = "3b1a43ffb763367dea0f3de3a0d8d01a358f25577d6cccbb0e0d8de45b72e1a7"
    hash15      = "5c07bc5c20e9b3fcda5f7c7da040463387408ed112fcfe41d1a2fe3b1b0e8e31"
    hash16      = "049facd97b90c2d4f4e725a9b0ae4d8a3c9e4303e7caeab0cd0c83d6a263651c"
    hash17      = "b252d4afa6161b04cca21db89cb368eb349081d24fd3eaa2659c2ae7aea984e7"
    hash18      = "a9fc6476d31c6983f2c40f58f21658f72cbcf3d9158d6b86a3c7c16fcdc07427"
    hash19      = "1f6f9cc551e871e4ba1add1ea45cf6100ec846a4d3c73815ef1c137ff2772d04"
    hash20      = "caab56170636bbdf6cc7e9f1aa1fdfd5137291de998f9816ea02abee35d7e622"
    hash21      = "488f056a912cb4531bb076a2be4d81b001733031c6e57637c6f25c7eaa80e4a5"
    hash22      = "46dafb467538bb8755ac848119c865f5a87d3cfa2e958ddb7d1ad49e65ea1ec3"
    hash23      = "ecf21210c3eba63e252312495b12b6a52b2d251fba4d51cd2b359df8e5abf3b8"
    hash24      = "a99b4f393ca92091f5b015cd738e783419dcab54e47c49e7300293a30bb019c3"
    hash25      = "10406a7865f6ec710f6b3bcfff38db20bf4a6414ceeab77354d87339aace1baf"
    hash26      = "a2662ed7a34c3e33524133e2a37a236d049100aa1c8bd2500c434e916362cba1"
    hash27      = "698da50a8b8e4ba30e40a263fcd58f6d6b27ecfc2259061d4696c8f9ff94ffe6"
    hash28      = "76765c05b3bc0bedda3b0bc12efcfcd5917c4032dfeecadda531d4dfea3b533e"
    hash29      = "a25b136efe759d81c0c2bcafd5e643cace3cb7284fa5afeeef87c6de5fd6016e"
    hash30      = "f526254243cdf09c83cecdc5cbd0ab2bb1e2301f0f6097d158301a301c106f66"
    hash31      = "291ae40b8fae6dc54f290ad6c6c08eab0c7b5c698c01cd864e21f207d109bc6a"
    hash32      = "434d12d38963dfa804bd83f97690df4d3f9bb939bd7a82365915da0cf5aeb17e"
    hash33      = "d144f4dc25426e0f5ad377acf7c358da15b8fc462c5609ec19e9c11934325451"
    hash34      = "3e05241793abdd8d51c61ac5f24944beafde8b2cc8d264a00cc45e908181c8f0"
    hash35      = "d8f1da0e0d615f455176ab9f03710d91714c09727ad6c8aaaef32f277177d4d8"
    hash36      = "a1588a4f7d4585a9fd56e566f2c59ff59b0d637921b7d5cc8e5c1a5ae255b1df"
    hash37      = "1c42b151c6f3826d00f58332cb46e81f4a5ea22d8ac1a6d98d9ab425173818b3"
    hash38      = "1bee04ac9f8e98d8f66ff742f451efc4fa804a04e617663505c843e37e8f4982"
    hash39      = "02ee55067af18118536b6333f836dc5728a7442e7a687dd8ff00888ddec04553"
    hash40      = "1e9a5d498960faf2dfd4abbf4dcf1f868f110e4e1685f9d3544cc019787dfc86"
    hash41      = "2f6343d673a1b5962636e47110a2f8df88f7ac863084595ff3124da793247663"
    hash42      = "5aaf9aefe65f02d9097a44bc7e5e51c7ef5410bf37f11bb8d0bfc9dbfa4015c9"
    hash43      = "81ae77091ae9dfb39d8b8abdc7cf2c50f2b43c25d1d9e500f7e724e8ee37f8ac"
    hash44      = "dcbf7595b6d5325ba9b83840a2d644d0ec459a2c0bed5ac7ae5b3f3898404fb0"
    hash45      = "161c3219525a82b13a8e67ea3de05b08b8c603783b548dd709d92150c1172f31"
    hash46      = "6c9428b320416e7e68e4442e391e90e2908e88b3da2725ffc6abb85cf0df7855"

  strings:
    $s1  = "[G4you have created using the template. This information is used to provide you with content you request" fullword ascii
    $s2  = "Non Employee User - External: is defined as an individual, who is not your employee, contra" fullword ascii
    $s3  = "that party must agree that this agreement applies to the transfer and use of the software. You may notComputer: is defined as th" ascii
    $s4  = "e computer on which the programs are installed. A Computer license allows you to use the" fullword ascii
    $s5  = "that party must agree that this agreement applies to the transfer and use of the software. You may notComputer: is defined as th" ascii
    $s6  = "Aemployee who has one or more benefit plans managed by the system or continues to be paid through the system. For Time and" fullword ascii
    $s7  = "s confidential information in confidence for a period of three years from the date of0" fullword ascii
    $s8  = ":RELATING TO THE ENFORCEMENT OR VALIDITY OF YOUR, MICROSOFT" fullword ascii
    $s9  = ":number of order lines during any 12 month period." fullword ascii
    $s10 = "out of or relating to this agreement.," fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "71011cd1d39206bf1a19a4da6a3acda4" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6126d1e3-0bfa-43b1-96e1-7c5249b3a0fd

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion