_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_82_1_Trojan_Danger_Gen_531

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_82_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_83_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_90_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_91_1.vir, Trojan.Danger_Trojan.Agent.DCBC_1_1.vir, Trojan.Danger_Trojan.Agent.DCBC_2_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_141_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_222_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_291_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_350_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_40_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_441_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_470_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_55_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_201_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_219_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_26_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_8_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_21_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_29_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g0W@a4@lcVd.vir, Virus.Danger_Gen.Trojan.ShellObject.g0W@a4@lcVd_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g0W@a4@lcVd_2.vir, Virus.Danger_Gen.Trojan.ShellObject.m0Z@aq5b2kh.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@aq5b2kh.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aq5b2kh.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aq5b2kh_1.vir, Virus.Hijack_Trojan.GenericKDZ.103285_206.vir, Virus.Hijack_Trojan.GenericKDZ.103285_346.vir, Virus.Hijack_Trojan.GenericKDZ.103285_385.vir, Virus.Hijack_Trojan.GenericKDZ.103285_408.vir, Virus.Hijack_Trojan.GenericKDZ.103285_450.vir, Virus.Hijack_Trojan.GenericKDZ.103285_452.vir, Virus.Hijack_Trojan.GenericKDZ.103285_506.vir, Virus.Hijack_Trojan.GenericKDZ.103285_509.vir, Virus.Hijack_Trojan.GenericKDZ.103285_553.vir, Virus.Hijack_Trojan.GenericKDZ.103285_602.vir, Virus.Hijack_Trojan.GenericKDZ.103285_678.vir, Virus.Hijack_Trojan.GenericKDZ.103285_79.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_82_1_Trojan_Danger_Gen_531 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_82_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_83_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_90_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_91_1.vir, Trojan.Danger_Trojan.Agent.DCBC_1_1.vir, Trojan.Danger_Trojan.Agent.DCBC_2_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_141_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_222_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_291_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_350_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_40_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_441_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_470_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_55_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_201_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_219_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_26_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_8_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_21_1.vir, Trojan.Danger_Trojan.GenericKD.72597336_29_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g0W@a4@lcVd.vir, Virus.Danger_Gen.Trojan.ShellObject.g0W@a4@lcVd_1.vir, Virus.Danger_Gen.Trojan.ShellObject.g0W@a4@lcVd_2.vir, Virus.Danger_Gen.Trojan.ShellObject.m0Z@aq5b2kh.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@a4@lcVd_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.g0W@aq5b2kh.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aq5b2kh.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aq5b2kh_1.vir, Virus.Hijack_Trojan.GenericKDZ.103285_206.vir, Virus.Hijack_Trojan.GenericKDZ.103285_346.vir, Virus.Hijack_Trojan.GenericKDZ.103285_385.vir, Virus.Hijack_Trojan.GenericKDZ.103285_408.vir, Virus.Hijack_Trojan.GenericKDZ.103285_450.vir, Virus.Hijack_Trojan.GenericKDZ.103285_452.vir, Virus.Hijack_Trojan.GenericKDZ.103285_506.vir, Virus.Hijack_Trojan.GenericKDZ.103285_509.vir, Virus.Hijack_Trojan.GenericKDZ.103285_553.vir, Virus.Hijack_Trojan.GenericKDZ.103285_602.vir, Virus.Hijack_Trojan.GenericKDZ.103285_678.vir, Virus.Hijack_Trojan.GenericKDZ.103285_79.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "535e644c330917e045ed719d788ab98f8af30cd2705fb57d12d7f0467d04ebb2"
    hash2       = "484324b3f16cb552c325465783ec776a3ba326e7c8ea4722b166d05bd1dfa4f3"
    hash3       = "75f9d481088b69de89277d0c29bd09cb2fc54b74d5116639d46cdd3fd1b7fcf1"
    hash4       = "78fd439ab014e160e50348d2f027a9ce37c8db49b3bb8b5536322ebf393a708b"
    hash5       = "5af045958d88f985a62292eea8800a9828485b090aeaf6367976d1c9b96635fa"
    hash6       = "9438360385cc23028ee6f662fadcf817135b3d9306898ef99b4cb45221220ed8"
    hash7       = "4d685efee9dc7dcc412931491851fda4a1f73f341103c75d06a30e43f4715672"
    hash8       = "dc38a5030d5af5795232547ecd158b7d7b631e148f449e76b27c02befa464462"
    hash9       = "0fa5b1a4b4006bb9610b76324c5572225acd87a87cb4d693945c79356b714ef4"
    hash10      = "17f6a2b105d37c170fb7890ff89a832a34dc501b681a326a5b0a2962205745c5"
    hash11      = "ee873b974208d961e675b94e73a287ad64c2c269a64cb969530045be13e0f8b2"
    hash12      = "2fee6da0275a5d19a6d9ea06f8de4b37d6dabd722ab531f28d12ef9765d2ccd1"
    hash13      = "2463b6aa51643fbeb4994ad2f5c0a890ccd927e1f2bb828c6fb1ba0215dafbe5"
    hash14      = "5befee34ac3d4014ba4234924b36b2f6163b99605e56d3e2984e936f2164e60e"
    hash15      = "488b7e1b29908c4701e64cffe24c3cd234a719b4d9e200f14caf958097886942"
    hash16      = "ed7016289f1177c12eed23d3c8b83230b0d09bf55ace9f2a8fa52fa904994333"
    hash17      = "a8056541dc79c77714daf14a2b59c5545cde72ef77b9a9dc6439a2dff33e3462"
    hash18      = "5c6394c90963720d66793337f6ee1a9f61988b17d38ea4052f619c9b814cd633"
    hash19      = "1ba1a05443b098e05b3ed2a0188f1e1b9a997b9ca72c2d974cf52df7e2008687"
    hash20      = "9235044c4b38eae2587ec84214a98acd4ed48aab03b9dba8470efa2ab27789a5"
    hash21      = "759f8bdbfbcd9ed34f26162f2097adc0a182f71b54b55be5229578de0149fcb4"
    hash22      = "536571fbea57385fd585dca2f847874cb0bd613669005d7a5ff6e4dcef59d998"
    hash23      = "8f901218feea9f73438d359bae0d0a9f766d997d1d9f09fbb2c89fbc1b776277"
    hash24      = "71699a3cdc8872d2e5c2d6c7a369b8dcb698b5110197be5370d3f815c7eac710"
    hash25      = "260e63d4b9ccc32774afef599e2089b5b58ee21bb1bbaef5afc22bb0ff6dd2f4"
    hash26      = "7b7ff42e47dcad1d8d9fe14124110f5cce1acee3e93fe5ab9df0ee304c176976"
    hash27      = "45a40ee8c95d91589c2efadf30e3e1e5c9d389203ee379710ede1e3b5930875b"
    hash28      = "82761d8aa25e42365a51ec9ff74f500ad3d8f874deb0f7055bd3a653272bcf5e"
    hash29      = "de84c9ad93a61fdb39cff01e114abea2b848ee69dd47683d0ace76712c8426e4"
    hash30      = "7ed337ce20071c3d832bb4cad6aad285b87bd9e6be2f2e5086108cff5ac4efa5"
    hash31      = "eaec9206dc4b8e4b4fb1228fe09715e12ce430ee2801fcc8c0acbc5542a63ed1"
    hash32      = "0ad8df439199add7b452407b5c72f27ccd39bcf1e14822361e2e92ea7b001067"
    hash33      = "bde8c850a2c386f5d5e7a16edf8edb31f5ebaabdcc1bc0c7b867aab74005fa5b"
    hash34      = "31c868786e9653065a3a01983a66741e21d0b9298e567bbe74144308a5a021c3"
    hash35      = "864580a3d0fa6c53865451c417c9233a3d087d8435ff34d5b1d3b3e638454d60"
    hash36      = "a08ae7724a9ba3d6b35af00e1697c4692b6353ba3f3fa57164798dd2f1872fb7"
    hash37      = "8d053fcf413cc8977f532425aae913b2a2e2e5e2f15bb71aa8bd58e326e8899b"
    hash38      = "dd341e0a92a831c8ab0a0d26a8063eae44dcc9106d8af6f5555810ace8a426de"
    hash39      = "185eec8cb7a9af5c1230da09657f3a8bb206cac18d22b6cfe43badbd18c4e563"
    hash40      = "c6bace0f8b2596ef51453fc2d83167f5f47bd9720ab33850af3b4fdb3136f86c"
    hash41      = "489a4bf5970a16c06413c754e078d8a13ccbcf5ae31618d32a9aa3ba42c605e0"
    hash42      = "ac537797bcbdbe4f611b2b7183dbd6cfb72d8e280a97bd7a0123d339c459eb6f"
    hash43      = "6e73db2419ac680c919c61baf2ea8b5ec02c815a22ba0af3aa2ce7876ff7c4f3"
    hash44      = "f67004cddb1d63c9875da43747c27267267e17eee5814c697177f8150d9a60ed"
    hash45      = "5b1c2af4f819ddbc5f9a7ca9521d8e6122db94afb535bcb6d6c969ac144de8f2"
    hash46      = "4bc6e6da9163ccddbd06933c9d8b6d90ed490e1d71d03192cca5c695fc9a44e9"
    hash47      = "52c41a145686988a0effdcfa9db541e34ba44ece00c86e4496e074979d27a9bf"
    hash48      = "252089a3893adb55590d0f45990490c41e74f01e4ce2d107ded761c1151f4438"
    hash49      = "9ae7ad01b9b06cd7ee15a04a817b4404dc23ae88bfb43229a9802393362f3fc6"
    hash50      = "448120af85fffe8eff814148e2293a668b09d60a65a9cf06379a11fdc66aab48"
    hash51      = "d180af4eba8af407884ff920e365a7c3a419f422dd2bd17da2ad177a92f5ca7e"
    hash52      = "2ff5b80d68de43ab3a9fee17c90c6093d0247c6586cc5235c4659f5ccd2776bf"
    hash53      = "43454b3fbc9474b48a4340af092fd1641b638dc29654dcab02bcadeb72b57d91"
    hash54      = "9dcd1e3adca6024fa62f35a5758eda613b6396388342b95f85223fea3fdeb9ce"
    hash55      = "fef49e92cc4c97d5591e94f76480e51b5c5a317a65ae6e79ee17bfa7897e4c46"
    hash56      = "a15a435254a257e28e3df0c2952544be8a754a8cbb526d38c360e4274d51256f"
    hash57      = "010d1cc34dc2164c24db0aeef33280bf1cd0855bc0fa3862903dfe312b4befd5"
    hash58      = "051511b44562c83d4500647a13a6b38b2aa22c1302d70993ba63014813973a49"
    hash59      = "b0f664459bfde338e48d567d82a3160f74e366b2c465650143d4c63078401d2d"

  strings:
    $s1 = "3. Media Elements. Microsoft grants you a license to copy, distribute, perform and display mediaTHEN A NY IMPLIED WARRA NTIES, G" ascii
    $s2 = "3. Media Elements. Microsoft grants you a license to copy, distribute, perform and display mediaTHEN A NY IMPLIED WARRA NTIES, G" ascii
    $s3 = "Learning Credits: may be used to acquire education products and services offered in the Oracle University online catalogueK$" fullword ascii
    $s4 = "were disclosed; (d) maintain the TRMs at all times on" fullword ascii
    $s5 = "\"then current Premium Online Library or individual Online Course rate by contacting your local Oracle Education Sales Office." fullword ascii
    $s6 = "t be run in DOS mode." fullword ascii
    $s7 = "UA RA NTEES, OR CONDITIONS LAST ONLY DURING THE" fullword ascii
    $s8 = "), and used by the Recipient infringes itsz_" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "02288c4779ff47e35146deaf7704504d" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2a8337eb-bc85-4e6b-ba45-b066b92cbd5c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion