_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_468_1_Trojan_Danger_Ge_552

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_468_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_514_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_524_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_529_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_72_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_74_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_75_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_76_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_80_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_82_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_83_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_84_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.806CA81A_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.FF0C7235_1.vir, Trojan.Danger_GenPack.Generic.Dacic.1A7FA519.A.1640D45A_1.vir, Trojan.Danger_GenPack.Trojan.GenericKDZ.104643_1_1.vir, Trojan.Danger_GenPack.Trojan.GenericKDZ.104643_3.vir, Trojan.Danger_Trojan.GenericKD.67166905_134_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_135_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_136_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_215_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_216_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_217_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_284_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_285_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_286_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_343_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_344_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_345_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_395_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_396_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_436_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_437_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_466_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_467_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_15_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_27_1.vir, Trojan.Danger_Trojan.GenericKD.67993768_1_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_107_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_135_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_148_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_159_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_17_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_18_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_199_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_56_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_74_1.vir, Virus.Danger_Gen.Trojan.ShellObject.f8X@amgke!k.vir, Virus.Danger_Gen.Trojan.ShellObject.f8X@auLSMIo.vir, Virus.Danger_Trojan.GenericKDZ.103285_19.vir, Virus.Danger_Trojan.GenericKDZ.103285_33.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_9.vir, Virus.Hijack_Trojan.GenericKDZ.103285_134.vir, Virus.Hijack_Trojan.GenericKDZ.103285_141.vir, Virus.Hijack_Trojan.GenericKDZ.103285_144.vir, Virus.Hijack_Trojan.GenericKDZ.103285_148.vir, Virus.Hijack_Trojan.GenericKDZ.103285_175.vir, Virus.Hijack_Trojan.GenericKDZ.103285_212.vir, Virus.Hijack_Trojan.GenericKDZ.103285_305.vir, Virus.Hijack_Trojan.GenericKDZ.103285_340.vir, Virus.Hijack_Trojan.GenericKDZ.103285_364.vir, Virus.Hijack_Trojan.GenericKDZ.103285_414.vir, Virus.Hijack_Trojan.GenericKDZ.103285_422.vir, Virus.Hijack_Trojan.GenericKDZ.103285_490.vir, Virus.Hijack_Trojan.GenericKDZ.103285_517.vir, Virus.Hijack_Trojan.GenericKDZ.103285_528.vir, Virus.Hijack_Trojan.GenericKDZ.103285_551.vir, Virus.Hijack_Trojan.GenericKDZ.103285_571.vir, Virus.Hijack_Trojan.GenericKDZ.103285_580.vir, Virus.Hijack_Trojan.GenericKDZ.103285_679.vir, Virus.Hijack_Trojan.GenericKDZ.103285_689.vir,...

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_468_1_Trojan_Danger_Ge_552 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_468_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_514_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_524_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_529_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_72_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_74_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_75_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_76_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_80_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_82_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_83_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_84_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.806CA81A_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.FF0C7235_1.vir, Trojan.Danger_GenPack.Generic.Dacic.1A7FA519.A.1640D45A_1.vir, Trojan.Danger_GenPack.Trojan.GenericKDZ.104643_1_1.vir, Trojan.Danger_GenPack.Trojan.GenericKDZ.104643_3.vir, Trojan.Danger_Trojan.GenericKD.67166905_134_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_135_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_136_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_215_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_216_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_217_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_284_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_285_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_286_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_343_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_344_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_345_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_395_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_396_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_436_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_437_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_466_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_467_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_15_1.vir, Trojan.Danger_Trojan.GenericKD.67269844_27_1.vir, Trojan.Danger_Trojan.GenericKD.67993768_1_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_107_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_135_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_148_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_159_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_17_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_18_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_199_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_56_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_74_1.vir, Virus.Danger_Gen.Trojan.ShellObject.f8X@amgke!k.vir, Virus.Danger_Gen.Trojan.ShellObject.f8X@auLSMIo.vir, Virus.Danger_Trojan.GenericKDZ.103285_19.vir, Virus.Danger_Trojan.GenericKDZ.103285_33.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@auLSMIo_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@amgke!k_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@auLSMIo_9.vir, Virus.Hijack_Trojan.GenericKDZ.103285_134.vir, Virus.Hijack_Trojan.GenericKDZ.103285_141.vir, Virus.Hijack_Trojan.GenericKDZ.103285_144.vir, Virus.Hijack_Trojan.GenericKDZ.103285_148.vir, Virus.Hijack_Trojan.GenericKDZ.103285_175.vir, Virus.Hijack_Trojan.GenericKDZ.103285_212.vir, Virus.Hijack_Trojan.GenericKDZ.103285_305.vir, Virus.Hijack_Trojan.GenericKDZ.103285_340.vir, Virus.Hijack_Trojan.GenericKDZ.103285_364.vir, Virus.Hijack_Trojan.GenericKDZ.103285_414.vir, Virus.Hijack_Trojan.GenericKDZ.103285_422.vir, Virus.Hijack_Trojan.GenericKDZ.103285_490.vir, Virus.Hijack_Trojan.GenericKDZ.103285_517.vir, Virus.Hijack_Trojan.GenericKDZ.103285_528.vir, Virus.Hijack_Trojan.GenericKDZ.103285_551.vir, Virus.Hijack_Trojan.GenericKDZ.103285_571.vir, Virus.Hijack_Trojan.GenericKDZ.103285_580.vir, Virus.Hijack_Trojan.GenericKDZ.103285_679.vir, Virus.Hijack_Trojan.GenericKDZ.103285_689.vir,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "94d9ab46db32d9bbb2eed44190f8b0d954a14265c5d31da06fc9b4bb18585d82"
    hash2       = "9fe84fba88bf9b349c23053c8369b4a7ae1824d1d36f86710ed434f1fd993aca"
    hash3       = "7f8edb9d80a3a76bfb9eaf157e1c99ec364e494829d64c5bd01afa0d53b63996"
    hash4       = "6119ba1551cddc1ffbae6d0e8c93ac451140d746e2c9c3697b6faf89c5818fbf"
    hash5       = "be6f2a7cc5a43d6727cabac7f9215c4746f515af4255beed747ce8e7aa8ff4d3"
    hash6       = "ebb41707e5ec9cb5f49704f0ac9fef9e1db5a347794242258b3c774c0eac6895"
    hash7       = "7e20d3c17b214d4da32a42c2deca0352f5e115bc34625360a755e9585813c682"
    hash8       = "3fe1fd3bb32c0f0521686dd2f37ddb5d3060b118b00692dbc4048c1a1e906626"
    hash9       = "7355ff40a26e0babae3b32cb17cad4840bff5d3c074cda6a2287882d5ec3ecbf"
    hash10      = "46c9fd4b74cb79fd780ff6b83d7228b4065f90525b1b09577377b12747cf6785"
    hash11      = "0616504ecffa79195cdf44ae538a8b9ac0cee39a79ccd776cd0921dc9ce6245a"
    hash12      = "519981e85094dda5618df1b9c5e470f03dac81b69c9c43174e97af7c5534b02e"
    hash13      = "f12ec0cd5980fae17f8978e065fa3bc352cabe8216c9af3da60793bc8a702853"
    hash14      = "89ed192a661b855daf3be6fcfdf1f38ef35355f1c935817c90dd32ca08849e28"
    hash15      = "9558528b15a1aee62d0e41bc3edec565a0d8e4772c2eb3c9fb862d3ee07527de"
    hash16      = "37313a07da732c68d1f5a3ba6ada3cd1296850c8c60c9b7656e6e8b38e72ac38"
    hash17      = "7123571da129990226397ab4b3f87ba1d6a30afac2cd3e8644659034fb208b6d"
    hash18      = "b9abc559f666497ca32b2b201802354cc08fa36a83506a98cf8e5494666130d8"
    hash19      = "8f392d89193d744a5b0456686402f26ca11431c3edde6a27052b8ea7255a7808"
    hash20      = "7844294777ab27af4a4349143d42b9c40d0036f055f57f7e31a44b9dc11ad9cf"
    hash21      = "8ee62f5339aa617c7e5682cb3b08bbdc9ce1941551968856046515e298ac48fc"
    hash22      = "9db69a7307a0a21835a725c653636a78692979714d4300c9a33aa9933f69fc42"
    hash23      = "ba56904cc3ca583d8d089732ea2629775b71f993295894ee7260131d18b1fcbf"
    hash24      = "e64701d222a6f1c143fb295930bd7c29b14307c4d063fab2bd1a844477a482e8"
    hash25      = "553cde8ff7799143a92f328b6acb2f7fb390266ff390e393e5fd2f5d48894f9e"
    hash26      = "bddfb01fe61966d5ae5954b8f82795c876e669ef84f66a4fd9a9dae10ad78077"
    hash27      = "749082e3479c4677ddeddbf14696e8572c6d379f7b3d7c8fa4fa6f2c034e9172"
    hash28      = "d41348dcd0ce64c957ce9c55d77a54a7d23801b3185113bd7f7b813e672d0987"
    hash29      = "0633ffa7f33dc9a0fc536dddbb381f04977d3f919630466ea3a7d8eb831ee0d4"
    hash30      = "3138c26bfc909d844366e0b2170bd9f6070e2c525f3187fd4103e8eeedf16363"
    hash31      = "ec160930a9d15a14183f510cc39d78bed5e8e17beadb58d83eddbc95dc6f5807"
    hash32      = "35d0c7a1dcc7e0cbac242c6fecdba4bc330d5b26bbb5ce86c6a71d17ed02efa2"
    hash33      = "30ce95548c14ca71677a13772b858afc6b1f1e618195c95ca5e251f90ed17924"
    hash34      = "bb6fd339cdb9b3f0d0baac9f0e907ff87d4aa22d477644417f709b824a9bc07f"
    hash35      = "2e0f4a95abaa50a3f397e95472721f3a088b17f322a4197a0ea225a347ffb930"
    hash36      = "f9a0b966b5270857286175b670beb9d822c788ab21fbed63c3f3b4db3d4d8c27"
    hash37      = "4d17137d5304c00d52c73075c0ae56af04c7813fa03c67e206ad36f14f5b679b"
    hash38      = "8603d5751ea72f2c791cb6521cd40500c6ad86d7c3fc458702eda8e3f348b1f2"
    hash39      = "9605d862584c61c583b309d05189d111fc20d56ab4d6d3a0882cec1ea37d49f1"
    hash40      = "4a23c13db9bf48efaa1b10ff67db8e30c89d7e1aaf6b06a7241a316bea3c8abf"
    hash41      = "662fb93dba25d58985dd710b6ee5a9595242d79c7797fc3b5e2bf394df18c58d"
    hash42      = "88f1cf9d826c1ca93ca0e4285d833558afc658a7f0a5ffe90dd06d1b0175007b"
    hash43      = "b2575fd6d86214f82790b34c0a0538881cadd29994bc41317c4a76a7203eab8e"
    hash44      = "54a906ee2e180792b3fd1ebac0dca15b2f06c15673cb57153fdc3c68807e9c7c"
    hash45      = "07fa26aa819a063190a3144a901bf67adec3d4bd6c068cf4fc69e9d704e0ed37"
    hash46      = "9718956a1aceebfe3a59c7c5b31f1bf5d6ddc3c37dd1f4c84088e02b79d8f57d"
    hash47      = "ec0ade3230905eeaa21178c41edf5e64925c953b368e4bdb7fa566897c554e27"
    hash48      = "e636d2dbe58e37a04765135acdec7a07b915cd1f914d654e9246059eceb88365"
    hash49      = "6d9e28643ac12822adc13e81d411bce9f5ac214a13bdb3d03c69fd983fd222d5"
    hash50      = "615e13269ccf9c158f0f8b6e100f937d62246372703f21243c938f6c648594b8"
    hash51      = "257311759abe18d6d75cb5ab172f0bc1a3ae2aceb91130fbb64fe296da82eebb"
    hash52      = "4b37a1d8452ad42751e0556374e6f4d21b087faecf4c27f255a3b57091e91bac"
    hash53      = "1e2dc5db231960819ff5bd2d3ee781de7c156e8d131eb7e6110fa771d70c201e"
    hash54      = "1b29a0a5d43cf526a70929faf60be5441a0df205415619421e2c05b4c108b75b"
    hash55      = "a2af0b82410165657b87b755bdcf67626e1d46aee45a8507bcfef9517ddf35a1"
    hash56      = "58e42c61ad5f4b54bee0801216bdd7631d606fae11cfbbe6708ee4520a848298"
    hash57      = "094fff867c0203c2f567ca767b5026a6784c876044ab4afcf087e488b05b413e"
    hash58      = "2ebcbe8242907ceb230f453f208867eeec842a2f92eab2f328c0f6c7f605449f"
    hash59      = "f5dea0b8d343819e06705f12fd8fe7134a683a97e889c5a8cf9ad2f653e9f5f2"
    hash60      = "0417aaf0ecf295847b3a3fbbf588036fb588904597670a94ffa36a4edc3068da"
    hash61      = "79aeefc52fef01460c3988bfebed1fb203cb9cc207112071db0dd1a40fa4beea"
    hash62      = "716705c02f7dea5b4e231c64e18f73a7401edbf34ff57bde48c95a8b3cbd4321"
    hash63      = "e9bd4f494965a79206cf74685429f8c53d3c678f561466dade73449cb0374d82"
    hash64      = "d4eeb05b148807b6d311f3fb1af7aa59a33c390ceb4407c4c3757d465b359b87"
    hash65      = "499e4ba9631fabe0910a332d9134802f37a15f0e05cf6249bd995e62316bca5b"
    hash66      = "ecabdb66c434cb86190fdfac6498fbd5c8f868f053bdbf86e71ad847a7a1aa7a"
    hash67      = "a0f7c7231f8bb4318ba2f07f2a11e0c67c07617bc9f98289c814fe146ee96b87"
    hash68      = "d645ed558f89250f40d66e9005c3ced0bc4dc9d8c81f6d9cdf91e886b2803fab"
    hash69      = "f24f972c3ae4571ae7b5a879dec009951cfcce14c47fc382b7556fa96d4a19cf"
    hash70      = "66b4ffcbc1b8f5cc1fd2c680baf92a2aeeefa37f7812b7190975c1f30a01664d"
    hash71      = "99759891c0966c66f150f35ad756e7cef750aa266535eb32872d2014e5c3f151"
    hash72      = "8e22ab1f11af3088d9777d0f7e7546e3cab5b29c7324ac850e0dab52dbc4d2fc"
    hash73      = "e533a7b650ba042d7ea0ab0f3b860b7fc1442a0d2630fc69883cc13ff5e2e023"
    hash74      = "00be9cb24718e3684172344b2ab6f769bb622400fe413cb17a75e6b04792b8d2"
    hash75      = "303a79786e86af8d6718a846cdcf70aedaaac876a079fa9386259bf2c8dd6433"
    hash76      = "0de1951a0b554984f7e795627ceb136d7ff6453adb8594d4b9c012cced50697c"
    hash77      = "7687f9de006de6d9aed9b1ff632524a61172a17b42ed874feaa703afa2bd6aa8"
    hash78      = "473bbf9ef72f95bf7740149cc3e398add6355103ee0e1e8f7c04e6b3162f5438"
    hash79      = "ca6701e5f18a71b473212fd81ea599e94194d5779ee6268d7fcd80f168221dfb"
    hash80      = "ed19521c47d668da6059ef99aaff18b1fde4a46a042e65bb9cadf1bd83979114"
    hash81      = "442a82de78b74e5755d992a2e3a4447d654d54e8bad10f65b18f9d320e9ad0c0"
    hash82      = "76b7aadec1f7edf55029fc32820fa63b826f481a845421d34151746fc6277365"
    hash83      = "38c103261bf11cf67d496d5eccd0a41010b0eef7a59e4673e6656632de8a32a8"
    hash84      = "ca63de77b04284db36692f3b989d0485a64919ce63538d6701f74b54467731d7"
    hash85      = "6ba624d9afef0d3b08a037b5618af10a6889222a95c841c089465ff256bc39f9"
    hash86      = "fb3a68f318aa5599b20a6624e7200bdec479f805639b0dff0aff156bc48f6718"
    hash87      = "70767373268540d8e562c7bcdf87ec53878584570fb2ab5a27f7b055a22e3a85"
    hash88      = "a38652e4afec70102f866d5d6684e0313acb8310bbafdd5002bbf56a2650a85c"
    hash89      = "d1267ac3893905a9d4b91b7802d21a4c892bf21b3f4cfb660305a9f73c3d84c9"
    hash90      = "f5ab7cf542575313d65c3362699932f5d564758b788699eb6ca9994962cc4cb5"
    hash91      = "597debb2605739aa2925fcd72cb9d4570e325d8352ad8e55f711852b29ba7aaf"
    hash92      = "3fe35106e28d631c6b904af93aed78146ed0893e20cd04bb8edeb903c0e97049"
    hash93      = "0f62b9f3b7eb0e2af0b6b0cfd1983bfeb721c70f060c1a101ae85c82d96fbe9b"
    hash94      = "7c0127ee98a1dca031334491390739302e0d89fadfbddc1339cb7eccb293ed41"
    hash95      = "e5f6df7d2c3415ee84c691560cdf32904f0291dbf5ac80a8cfbd65a7aec3b7dc"
    hash96      = "b9fc19a3b483f72ef4c783aee888dc1f6edb835af66b11d3c20933b6a2540c83"
    hash97      = "e6763907c9b040394bb30f8b5adb2f0361f276e28514dcf018e130d315fb8795"
    hash98      = "2d0e09deb6230b4d339dff8c0dedf7e5da42df52d116b0ea7161f414c33f1b1d"
    hash99      = "b127cdf6e25fde12d8b702ab843887c84c37b03c7cd6653b9a6af8be8c2b833d"
    hash100     = "099cea3341f24f8078ea2dbf59114b8607ecec0ba7862620dec97f845e81cda1"
    hash101     = "7b6bbf2f6500b5123cb47aee8b4eb3bfa19ad21ea55994d6a4d564ee78653c26"
    hash102     = "6b69479d3a052d41a865f4ecde8f0143498db0a02567487be305051d07a3dff0"
    hash103     = "88282df5e5e4c20e26bbfbd62b887a7ce2128bae05610f06949f35ab9d9dfb5c"
    hash104     = "cd88ad05b662e7eead8acb0f3aba6f4ceca71d8f73587b089c8704d408476ed7"
    hash105     = "6a95000f4ee98e01e16dea1a220fb97bb9434f4bbd1bd7c475642a008ae493ef"
    hash106     = "c474cc6efc4f103b18eb13b16ad2d62fcdf5774a872005d4f906e0d07e21f41f"
    hash107     = "7c22b4a619173175b08b2186c90952d2fe1c95c721c65f78a5b2d68bc49a7e94"
    hash108     = "f38ae0cc8fb698ea5f58b9bc580c5866e29a3ec74dc8900dae552a7edfbef16a"
    hash109     = "e2d954f2e565d320030b1bc3a1f60d9e53fb8f54927f5127977103f08bb269fc"
    hash110     = "b9c99741e11d39b5cda151517b7478f71b6d58137af9fe6ccf70003ac5af708e"
    hash111     = "10c5f22493eea05bc48ab9dbba5a622a932ee58dff85bd392558408b74454044"
    hash112     = "502a1ae69760e0243edf5a4c4ccce25686abba1fa644e864e5edd090668ec865"
    hash113     = "ce4a9d6063121b6b09fb10ca36c7d829003ac7cc75603fc778fb131304530588"
    hash114     = "38774cea512d576cca19f511b8820a87da02544774a927631fc6cde96d45f16c"
    hash115     = "81326159827ba52853b0bebc2fa146054a2bfe3a82d42adf560ebe1009bbc667"
    hash116     = "8908fa842f947a4de232ca768aca72b4ba4890c1d7da4046fbaff7b69f928d6d"
    hash117     = "e218610090c2cf39dc4e7f4387a349874991cf54e1a3f551ed8392ed7789c1e2"
    hash118     = "cb272801208b454bc4ad677b059353d991ed2a8231081a51da723de266e25122"
    hash119     = "3d1fe5690e12329dbbc099700394de2f4460316cdf6b0a595cc421a36a4f93f3"
    hash120     = "2470e9be9876b1c6d1d23e52ce9a9c13f44f89b2f7c0639da734f87b93bb28e0"
    hash121     = "a00a8b32b804813d75829499e7790f836c353cd51faaabbe61cd032f86e50493"
    hash122     = "fabdc03eb8f8148ce9eed9a1675bdef8f06b00fa78e9a682f848d1584f86e989"
    hash123     = "fff51e30562ff3b699d6fd5659ab9f4efab6b49b9508a9bcbc918809c602beeb"
    hash124     = "d932b5562a6d91696438c7273a006530c9cb9aaef6f98d1e7a8a3ef8f31afd32"
    hash125     = "2bd12121c713aaab710d0b71c8b7ad442e9f0fda86b20b01d0bb7b8321425b9c"
    hash126     = "b99b23f2312ec03ba30001f2ce3b28e944b002dfe282c4ec39857437bb99d1bb"
    hash127     = "a996c1a3ba573812d0dfaddf46f3a47d1f541d18d02f4fb05ccf0c5a5577f189"
    hash128     = "9df2c5f14e58d1d8456385b96f6cab8668cbf2b6f399c1b0efdcedcdd0eb7022"
    hash129     = "0aea48f0b197b7f0f6b873310cb564185540c93873f238c923db60a5e2fe06e1"
    hash130     = "9a58f15e415c810c5e15c30c3c5a8277f4d99ed9955de9126a96503c381ee998"
    hash131     = "1547e101b4a9b34a9dc891dbd901d9008b96dc76e9662a0eb23de89ec0a8fdac"
    hash132     = "ecd124834501ae14ae8adc0ff83ba560a79920ff9b2e874f6694ca9cd3efafea"
    hash133     = "7ac87269983b273dfe5802b8928b9151e5574f178a4114baafca71688f736e67"
    hash134     = "b2e728077d9adb98869c09d4faa489a85dbbdea5306f106e44f81aeaa1ea8e02"
    hash135     = "41adc5151a653cc913bf2e7a2ab0fbe237aafe5c18096f75160962a8e5b55903"
    hash136     = "24825db2490e4ff7dfa2cdfd1342b01523ab60abcb52b9dad5eb5f8ab29af89d"
    hash137     = "b9a17835a307fba7b6a4bf1b1a6be3423d76a57895f7290817a3b0ebaf5e9c3d"
    hash138     = "6f68705666bff5766c07b1374e94e6ca4ca030e08d8df7a0c3a7beb5ef62fd59"
    hash139     = "fca0b0b8f581765d445e0cc734524836fc86165864923ae805bd362042d7042f"
    hash140     = "3e453f4c811c16d3466933defc22cb3d81c09a7230a133dfd5e16d1fbe4d7d34"
    hash141     = "d2cd50c3fb0ac745f9207325a4798abcd12abcc32bc9afb22675f38a71561dd2"

  strings:
    $s1 = "program license specifying a 1 Year Oracle Hosted Term must be hosted by Oracle.com via Computer and Administrationincluding res" ascii
    $s2 = "program license specifying a 1 Year Oracle Hosted Term must be hosted by Oracle.com via Computer and Administrationincluding res" ascii
    $s3 = "iduals, whether owned or managed for others, active on the program, plus (2) Book value of assets on operating" fullword ascii
    $s4 = "Online Hosting Access Policies. Oracle University's Online Hosting Access Policies are locate" fullword ascii
    $s5 = "retain any copies.0" fullword ascii
    $s6 = "YOUR LOCAL LAW ALLOWS YOU TO RECOVER OTHER DAMA GES FROM MICROSOFT EVEN-Ij" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "493d346616e95bbb2fea1139ef5fbc95" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f8d26fe0-b434-4e64-a260-a84f380067b6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion