_Trojan_Autorun_Trojan_GenericKD_72517131_93_1_Trojan_Autorun_Tr_26

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKD.72517131_93_1.vir, Trojan.Autorun_Trojan.GenericKD.73131881_1.vir, Trojan.Autorun_Trojan.GenericKDZ.72348_4_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_163_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_260_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_36_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_461_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_85_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_157_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_191_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_196_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_553_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_63_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.E79F8D7C_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_123_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_204_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_274_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_102_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_108_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_114_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_164_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_96_1.vir, Virus.Danger_Gen.Trojan.ShellObject.!CZ@ama2@Cb.vir, Virus.Danger_Gen.Trojan.ShellObject.!CZ@ama2@Cb_1.vir, Virus.Danger_Trojan.GenericKDZ.103285_34.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_9.vir, Virus.Hijack_Trojan.Agent.DQQO_386.vir, Virus.Hijack_Trojan.Agent.DQQO_72.vir, Virus.Hijack_Trojan.GenericKDZ.103285_173.vir, Virus.Hijack_Trojan.GenericKDZ.103285_177.vir, Virus.Hijack_Trojan.GenericKDZ.103285_216.vir, Virus.Hijack_Trojan.GenericKDZ.103285_270.vir, Virus.Hijack_Trojan.GenericKDZ.103285_365.vir, Virus.Hijack_Trojan.GenericKDZ.103285_392.vir, Virus.Hijack_Trojan.GenericKDZ.103285_413.vir, Virus.Hijack_Trojan.GenericKDZ.103285_812.vir, Virus.Hijack_Trojan.GenericKDZ.103285_861.vir, Virus.Hijack_Trojan.GenericKDZ.103285_863.vir

rule _Trojan_Autorun_Trojan_GenericKD_72517131_93_1_Trojan_Autorun_Tr_26 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKD.72517131_93_1.vir, Trojan.Autorun_Trojan.GenericKD.73131881_1.vir, Trojan.Autorun_Trojan.GenericKDZ.72348_4_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_163_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_260_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_36_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_461_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_85_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_157_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_191_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_196_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_553_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.7_63_1.vir, Trojan.Danger_Generic.Dacic.1A7FA519.A.E79F8D7C_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_123_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_204_1.vir, Trojan.Danger_Trojan.GenericKD.67166905_274_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_102_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_108_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_114_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_164_1.vir, Trojan.Danger_Trojan.GenericKD.72304918_96_1.vir, Virus.Danger_Gen.Trojan.ShellObject.!CZ@ama2@Cb.vir, Virus.Danger_Gen.Trojan.ShellObject.!CZ@ama2@Cb_1.vir, Virus.Danger_Trojan.GenericKDZ.103285_34.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.!CZ@ama2@Cb_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.uvZ@a8bSq4i_9.vir, Virus.Hijack_Trojan.Agent.DQQO_386.vir, Virus.Hijack_Trojan.Agent.DQQO_72.vir, Virus.Hijack_Trojan.GenericKDZ.103285_173.vir, Virus.Hijack_Trojan.GenericKDZ.103285_177.vir, Virus.Hijack_Trojan.GenericKDZ.103285_216.vir, Virus.Hijack_Trojan.GenericKDZ.103285_270.vir, Virus.Hijack_Trojan.GenericKDZ.103285_365.vir, Virus.Hijack_Trojan.GenericKDZ.103285_392.vir, Virus.Hijack_Trojan.GenericKDZ.103285_413.vir, Virus.Hijack_Trojan.GenericKDZ.103285_812.vir, Virus.Hijack_Trojan.GenericKDZ.103285_861.vir, Virus.Hijack_Trojan.GenericKDZ.103285_863.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "b6a357e523ed6bb8fbd373578de488ebe39e700186f4f4ed8a7092be6b13593a"
    hash2       = "dd18c3e61e9b6ecd58a6c4197727ed9fa3520cf7aa34db53cf4bdbacdd3d8858"
    hash3       = "bd6ef55c97c4e362cb909205f130485768fa8aeb0ef4c8bdb812c4744b15ef1d"
    hash4       = "87dfac7d24ffcd868d98b8517074e2c075d4abf43297de31f6bda6587868cb86"
    hash5       = "f08581c2bd3b965fbff6af620026b7b7bb5777c8747f148a829141c2086914a9"
    hash6       = "25fafbd8e6c5444208c8b1f7040fe42be5b06b3aef2cc72547c5e0ab1f4d5f8c"
    hash7       = "78992f1e2f6db49b54f0da45b556e4fcdd5bec85c166b15f8d05857d54794fa8"
    hash8       = "d52e58de8daffa2e44f19d2be01aaddefd1ca50b4ff8a98ffaeaf31d19f4f487"
    hash9       = "ef6b68986f8d138aa37cf07b4b468644aa19a95d9b50b1479e7a43df864281b4"
    hash10      = "a7fe3f930889c77972b5a84f70e3bdb1bb3f6c7be0a2c4042ceb938b64d656ab"
    hash11      = "a84bd1555434c6fa9c1b1be52372035801ad68dd7a3b3200cc2aaded3bac9a96"
    hash12      = "853a518512ba2219e0ef2ab6c2603a3fb4635b7f9f16f766ac84e850fca8f4f1"
    hash13      = "1d355682988712545945eecc94945174510a25dbf669637a92ae22e20c60875f"
    hash14      = "8d5ef88353d57ed5e08860009b6bde9a2ba5adaaef7a72b591d0a861fbccae84"
    hash15      = "9decca871535920756b9a631e1295ab56b70e7c548cde6986897989c86065146"
    hash16      = "2031e16414445e1a6791a78f2cc1a09a09632c382dc8560c6841506d4b3471fc"
    hash17      = "ccced85d2633c950ad4e53e507faa1e88510933b6e90d2360f1ddba57cd07a10"
    hash18      = "468845daad4416da4b21e6177bfe41ec71a2a7dcbbcbaa597e5dffba44311585"
    hash19      = "bbb2b69cc5c0c4197f22920cffa6e5e681840efbc4e3c5c30e4ce03a5697e140"
    hash20      = "0eae618a68546a0014652156b3a718e856aa60a421cd4dae8936f05f47d89ee3"
    hash21      = "1a8b4e44766bc98e2d72c5f4aa47085e870126dc6bf5005aaddd2e36b7cb07e0"
    hash22      = "cd060e82fc60b7335cf0d2d0a08cd2102b41605e385e87a253731e15c63590f7"
    hash23      = "6fbb90d973bd63b67ebfe7649264bcb3038b48cfc5975b3fdf5fe473f6bc3fdf"
    hash24      = "76662646e19a18fdb81b805a69aaddf4de0121701430d912c314d4d9a2e6a3ca"
    hash25      = "0aa5dfe96892e1a4c1193a0411a3b4f7c0d570f116345ecdef956c42f3eeac41"
    hash26      = "0b6ba38c36248300f8c95d2dbe3a842d597281a822ef6e1b54667e8e66684797"
    hash27      = "582caa312c759fb34c8e5098fefae79847c8ddf5f1a349acb5291d0205b6b7e6"
    hash28      = "aab7e8521d8225cc40067e96b722dec873011db16c6e349fdddc3ab763d99d8e"
    hash29      = "03de8a6c1d42678ed4ee11326f8b543851b63fe2bc1177fc06f746eb7b4d09bb"
    hash30      = "57f9789d4c976f27f70e835f284e18eb4db6d19d618c219413be070990a02a48"
    hash31      = "b8e1ec49f8127fa73ce516a258037deed464120e08e3a263f9931531f6ce6ea7"
    hash32      = "667677cc27c7292a4ed059254ca4dfea9812c6025c83d4acea64a89b2b24e0ba"
    hash33      = "a2e9a9895bec4ffc808cfaf9bed091caf0e8f8a750faa5c7bca7d027f172cb4a"
    hash34      = "01e9e30303e8dc9a465a84d92cf349cd4288d2820befd40e48af968d51692c95"
    hash35      = "c6731942298344544ba342df1e391e1194fdfcf158b4315089d4b95f60e50d4f"
    hash36      = "1ce5dda2ccaa7c758d01af7876783a30d07ad96f076918605ec3b89d3a37eb0d"
    hash37      = "31a8ca038447ce3d238ea55cdec6174def2829a082165687090f22de2658fa24"
    hash38      = "c6b1d05d3f022128a6fc02cd3426d245beb2c29f2d18b0016c54727193877e4e"
    hash39      = "0411299e716107829e60c870357415dbd72fe51b8abbda7d199f1381e323ba12"
    hash40      = "b0df927958b9aeaf098422da0e4938f8a221e0a7d225d56bf22135f2409d4f1d"
    hash41      = "131012a62818ac9451df26b106417d50c9e5928155e5f98708f149b627e7613c"
    hash42      = "914a52725ca277abfaa3463a1537a951b15386dcad369a1c13ad41a170d7ab8c"
    hash43      = "98b689a8f35fe754dc0e93f0db0be48282f56ee4ac8254fad39444cf257c6974"
    hash44      = "7d6746a8fe8fe372ff8789a99297a5e6474bc0d7590f6a5a201aecf3b26b7e6b"
    hash45      = "5c966987e45e753a355d89815c105056abe128e531223911a887ec7ca6d54e3b"
    hash46      = "73f2d456b43a7811133d7ee3a105dce3412eb85f962688b779d2731de3960314"
    hash47      = "bce127fce33727575b85319e7d7654b1121c8900f942af3c760272eec0461670"
    hash48      = "8b3a82caf1a78aefce09af74072dc10f10d3c79f74e5ef386b5332127c2b5d2b"
    hash49      = "f09a4562d8397d3eca707334bbf49c3afc3d74b9c2ad84a14312e5968de9e135"
    hash50      = "11ab6ac03506f57798ef327edfb40aefac5b970d610ac2de5a2d80e147357e33"
    hash51      = "5527428173ae8d80d6972a85a0bc7cd8be51b09ce06b96fc7732c8d84897e690"
    hash52      = "34ea5eebd52c9604d6df0bd5a26bcd00c1892006d410afec8d10faf35dcbef63"
    hash53      = "b2702d9549af7babed7f6b79d3c8eed4973e8035f8d9f3595bbd0e66c0502838"
    hash54      = "eca91c3006e8e56528abc6aaefa827190d11249199cf2cb91292a9643e5d3049"
    hash55      = "06f5b8dde4792a1c1a578b4ee4dfaf58fd61eb914c20b4163f9481da7f83983a"
    hash56      = "85de95fead76fb36c64a878abafc1cbb7afb67ee89bd8381847a2e1b4704ce96"
    hash57      = "79a3be0f317f372c7bd3c5b17768113efc53f47a2c2d8091fb9b4b2aa612677e"
    hash58      = "b66ce3f8bf19fe7ff425680324c0942288fc9eb2f5536f449192df063e27fc47"
    hash59      = "d905227f369a816e857f3ab294f691eb69ce8ed357b3348724f28a0d4cf34ccf"
    hash60      = "42edfe43c2261c51ba6eb5cb0bf4c7dd9134810b7d3707d80427b255b930e261"
    hash61      = "d27a91ba377b35468bdebe243fc448972450fca5e20f9c3a79e8ef42f68da205"

  strings:
    $s1  = "Unknown failure during command execution" fullword wide
    $s2  = "commandToExecute cannot be null" fullword wide
    $s3  = "Error occurred during preprocessing. Simply navigate to default page." fullword wide
    $s4  = "Can command be executed: {0}" fullword wide
    $s5  = "Unhandled exception in CommandFlyoutService::ShowAsync" fullword wide
    $s6  = "Concurrency.details.?$_IAsyncOperationWithProgressToAsyncOperationConverter@P$AAVStorePackageUpdateResult@Store@Services@Windows" wide
    $s7  = "Platform.?$WriteOnlyArray@P$AAVCommandWithLabel@Framework@Entertainment@MS@@$00" fullword wide
    $s8  = "Platform.?$WriteOnlyArray@P$AAUICommandWithLabel@Framework@Entertainment@MS@@$00" fullword wide
    $s9  = "Platform.?$WriteOnlyArray@P$AAUCommandDataItem@Framework@Entertainment@MS@@$00" fullword wide
    $s10 = "MS.Entertainment.Framework.?$LazyVector@P$AAUCommandDataItem@Framework@Entertainment@MS@@" fullword wide
    $s11 = "MS.Entertainment.Framework.?$LazyVector@P$AAUCommandDataItem@Framework@Entertainment@MS@@.LazyVectorIterator" fullword wide
    $s12 = ".uri: {0}, command: {1}" fullword wide
    $s13 = "ICommandWithKeyboardShortcut must implement ICommand" fullword wide
    $s14 = "Command does not have a shortcut keystroke." fullword wide
    $s15 = "The given target element must not be nullptr" fullword wide
    $s16 = "functionToExecute cannot be null" fullword wide
    $s17 = "Object type should be Video. Invalid argument passed to DownloadManager::QueueDownloadForItems" fullword ascii
    $s18 = "ObjectType should be Track or Video. Invalid argument passed to DownloadManager::Initialize" fullword ascii
    $s19 = "Object type should be Track. Invalid argument passed to DownloadManager::QueueDownloadForItems" fullword ascii
    $s20 = "Invalid token passed to DownloadManager::RemoveDownloadProgressHandler" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7d6dfc91-1d0f-4a3a-9719-a758d508f950

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion