_Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_64_1_Trojan_Danger_Gen_565

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_64_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_72_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.F48C7B75_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_128_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_278_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_145_1.vir, Virus.Danger_Gen.Trojan.ShellObject.CwZ@amBwvTb.vir, Virus.Danger_Trojan.GenericKDZ.103285_38.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_9.vir, Virus.Hijack_Trojan.GenericKDZ.103285_198.vir, Virus.Hijack_Trojan.GenericKDZ.103285_253.vir, Virus.Hijack_Trojan.GenericKDZ.103285_299.vir, Virus.Hijack_Trojan.GenericKDZ.103285_885.vir, Virus.Hijack_Trojan.GenericKDZ.103285_889.vir

import "pe"
rule _Trojan_Danger_Gen_Variant_Ransom_Xpiro_2_64_1_Trojan_Danger_Gen_565 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_64_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_72_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.F48C7B75_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_128_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_278_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_145_1.vir, Virus.Danger_Gen.Trojan.ShellObject.CwZ@amBwvTb.vir, Virus.Danger_Trojan.GenericKDZ.103285_38.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.CwZ@amBwvTb_9.vir, Virus.Hijack_Trojan.GenericKDZ.103285_198.vir, Virus.Hijack_Trojan.GenericKDZ.103285_253.vir, Virus.Hijack_Trojan.GenericKDZ.103285_299.vir, Virus.Hijack_Trojan.GenericKDZ.103285_885.vir, Virus.Hijack_Trojan.GenericKDZ.103285_889.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "ac3b9482fd275a6ef99c1abadd7840ffb9e215e116d310e5b7e9ae4d377ebbf5"
    hash2       = "ae7f4122b09f74b8023028d294741cd8a7f5618bb23442a837e2b12333c4c88a"
    hash3       = "2430c81eb0a058fdf58e913f4a262a8c97c354e1ab59ad9642b1c3584def978a"
    hash4       = "e07cf3ab343a24991be44170892fbbe33f3a101db54262581c468efd434faf63"
    hash5       = "926d5d226bf35aafb3ddf15d633c913f5474500a9fd8f22bf089c3f8e83795f4"
    hash6       = "1a71b122847da54a0c6dc8c37219d1b2228d0ca4941739bec8074ecc1ee5b2e7"
    hash7       = "8225ac1e8cd6ff7f9a51503718ee4f246c40dfe2584d3246e7bafed71ef76ee2"
    hash8       = "1cc2fd16d126a440d712beaebf172de35b77eeba1efbca6379a0ce5a44ec6c9f"
    hash9       = "4b7dbca89f6f9b4662c59e35c7e7376a06aa084c1313729b37fef8d420c15399"
    hash10      = "8c355d6de3f7d060cf92874160bea7045da61ca39caffc4e6c4c73d4d6cc61a4"
    hash11      = "2271198269b7cf9c363107d37278436eda512f0f18e3abd9cd52a4fa3719d203"
    hash12      = "737ba60baee979131552b11f77e0e06ff027ee9b2409f8c4764188ccc16fd069"
    hash13      = "6ea1afd36be2fb014d132d10cdff1167241e691201e3a2f988b670211028964f"
    hash14      = "0ae6b794c3f2e09633dfb8903092f4d3c85232097890ac9cfbd0a71bd53ffb7a"
    hash15      = "e361eceb92465260a1b009b5e1ca8bd41536ba21e063d7eb661d8634422056b6"
    hash16      = "d7cbfcd6bbffdfa2fb233722c936c4c90c84b01e059c1e515446bac5a5812120"
    hash17      = "fe6b77e414d0c1f197cb8a568a2510f81a16a21438ebb98d366cf7d2bbb587ce"
    hash18      = "4a7adec1f5754dccaedfde5e54309bc99eb4d215c1df5fc04b4d5ce8be1d9729"
    hash19      = "2192bbb8d226d4a76a34530c580ea5576e606cb8f87bfecde6a7cba6ad4e9b8c"
    hash20      = "c877983da22956d54a44fb939d039286531d9edd42fab97c98c71e9ef15db97f"
    hash21      = "b9d17c758205738c80a5c99c7a52d382f582865b28b5212c36284cc3f065d39c"
    hash22      = "5c4cdd4970671a80efbc909e0b3498c9755938f2306943b839d20a8524696eb0"
    hash23      = "7ef507a849656f5257d56f342915fb17b83c7d0a46c5ca893c038eb2193ce60c"
    hash24      = "6afe1ea813da9b45cb5dab6016e63b09708251bcce1f44f7cd369d13678bf761"
    hash25      = "a1ac897be1667921c1a52657f0263ff3082cfbc0536f147c17441e43b897813f"
    hash26      = "e30e5760a097953ebcf56afba370937f9b3823f3d015d690d2dc8dc87394efd5"

  strings:
    $s1 = "@@?$task@P$AAUIAggregatedContactInfo@CRE@NativeComponents@People@Microsoft@@@Concurrency@@" fullword ascii
    $s2 = "tInfo@CRE@NativeComponents@People@Microsoft@@@Z@std@@U?$integral_constant@_N$0A@@std@@U_TypeSelectorNoAsync@details@Concurrency@" ascii
    $s3 = "ontactCardData@NativeComponents@People@Microsoft@@@Collections@Foundation@Windows@@V?$function@$$A6AP$AAU?$IVectorView@P$AAUIAdd" ascii
    $s4 = "ressDataGroupingEntry@ContactCardData@NativeComponents@People@Microsoft@@@Collections@Foundation@Windows@@P$AAUIAggregatedContac" ascii
    $s5 = "ontactCardData@NativeComponents@People@Microsoft@@@Collections@Foundation@Windows@@V?$function@$$A6AP$AAU?$IVectorView@P$AAUIAdd" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "26babd76bbb7f9c516a338b0601b4c9f" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

46982641-f8f4-4b13-bd5f-7c03242b2fac

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion