_Trojan_Autorun_Gen_Heur_Mint_Murphy_3_340_1_Trojan_Autorun_Gen__73

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Gen.Heur.Mint.Murphy.3_340_1.vir, Trojan.Autorun_Gen.Heur.Mint.Murphy.3_34_1.vir, Trojan.Autorun_Gen.Heur.Mint.Murphy.3_97_1.vir, Trojan.Autorun_Gen.Heur.Mint.Murphy.3_98_1.vir, Trojan.Autorun_Gen.Variant.Barys.121928_21_1.vir, Trojan.Autorun_Gen.Variant.Ransom.Phobos.169_20_1.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.6E3514F8_4_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_106_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_137_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_163_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_184_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_2_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_71_1.vir, Trojan.Autorun_Trojan.Agent.CCPK_4_1.vir, Trojan.Autorun_Trojan.GenericKD.70348374_1.vir, Trojan.Autorun_Trojan.GenericKD.72517131_260_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_5.vir, Virus.Hijack_Trojan.GenericKDZ.98113_241.vir, Virus.Hijack_Trojan.GenericKDZ.98113_264.vir

import "pe"
rule _Trojan_Autorun_Gen_Heur_Mint_Murphy_3_340_1_Trojan_Autorun_Gen__73 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Gen.Heur.Mint.Murphy.3_340_1.vir, Trojan.Autorun_Gen.Heur.Mint.Murphy.3_34_1.vir, Trojan.Autorun_Gen.Heur.Mint.Murphy.3_97_1.vir, Trojan.Autorun_Gen.Heur.Mint.Murphy.3_98_1.vir, Trojan.Autorun_Gen.Variant.Barys.121928_21_1.vir, Trojan.Autorun_Gen.Variant.Ransom.Phobos.169_20_1.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.6E3514F8_4_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_106_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_137_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_163_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_184_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_2_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_71_1.vir, Trojan.Autorun_Trojan.Agent.CCPK_4_1.vir, Trojan.Autorun_Trojan.GenericKD.70348374_1.vir, Trojan.Autorun_Trojan.GenericKD.72517131_260_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@am90FFp_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.lyZ@aOgx1ni_5.vir, Virus.Hijack_Trojan.GenericKDZ.98113_241.vir, Virus.Hijack_Trojan.GenericKDZ.98113_264.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "d0303c2886847cef56e64fb43709b5f148412037244a9c962cd8a551dab797a9"
    hash2       = "a47927afa1a01f76b9277fc62a23d079b900af7017bd661d826ff14a9e23280f"
    hash3       = "7aa8cf46e1832f7f3667b8e1e3cc085d8da91556db04463d50083aaccced8c56"
    hash4       = "50ff6f761178a5a6249dd54216fca467f2e05e3158b1b379a715973812239265"
    hash5       = "eb33d4a1fcb58938b569b1b29a155e1751d18cf83cc752d747f11ecf7eb84bbf"
    hash6       = "4595586b9d3e835bdbdd6f41fb602ac57aa63595ffe301b34e1870711c728e3c"
    hash7       = "164964e034185d4892e64f965054458aa4b5f3bb52e3d17424c35940e7bd2c2d"
    hash8       = "797ffca01c76a84521fcc79e2009fcaad2bbbf1d3512e74bd2047a194714583d"
    hash9       = "4b9b3c44a5c2e87605d35e4d21a8ad7e5a3982e8f8b4b655a1b2ca7e19a1dfc9"
    hash10      = "934d184b54b996ba727b59c23cb90c3d876da6f33084c5a027a1dacb2774d839"
    hash11      = "3b374fdc0d1dfa91972bad5dc3792ff334699fc6fba9c2278f014a123199e4b2"
    hash12      = "94b03e5ff1b784883334bf4f19c0373afd4d5bc20b306f0441a20b1276b8b58e"
    hash13      = "c9ef2ffa79d01285246e0f8e86b87b2f420fcc1d0224215fb87ffc207cd8f7c3"
    hash14      = "e8eaa9c2f7eb7da2cec2274281a6cd5e9bbd4a35e7616a22d0eb168e937871e5"
    hash15      = "15cb8c54f11484fa76015b7ee0e0a533c3dd77c5935646614586c088df02d3e4"
    hash16      = "a8ff6c301c7e1655341b3762a9cd6c671175b2b3db4cb02cff6f81dd314bccbf"
    hash17      = "ada0f96033922027f170a64594d92ba6766518a25f84b20a489032eb21565311"
    hash18      = "a74d270911f07f0540eef382453c95734d2c84f1efec052ff50126c93d61c1a5"
    hash19      = "cba5d8528f4b816c391dfa91cf75650e8ee39549d8569c9c93b65ba87cc43c83"
    hash20      = "4b37ad109c76c41d09d277f3872f99d820e29c726e5fb17a70c335ce43b0e5ba"
    hash21      = "f5c473c8cb2cf951b4a69b650f54734a09b131d4477cbfcc1b2cc93680473ce0"
    hash22      = "83a40373b368fd81c75101cae4b64fe6bb2150355f716d94e6bc8df6d944e8fa"
    hash23      = "50ded15ebf8bc5c57b0298d4bea5f98564d0398e5cd63aac693857f9fef4ddc6"
    hash24      = "2c3cfbef1fd35707a437dcaca92d8508d1520340b5dede8a53cd36d3731ad13d"
    hash25      = "e18de7f6f9c4671862818272658824d006fa3343dbda7272f6be96295698684c"
    hash26      = "49ec86a9b841904d00429a729371da1de0438f1d87238d215097be44224082e3"
    hash27      = "2c796d2ab3cba66d9f482999bc60cba02337853f71cf1a73a94c4de12fd33a9f"
    hash28      = "9490f0bcaded2e819ce14c6bffa7f8b732d9a4e8ee5ad2056a888fe3c4f40175"
    hash29      = "40ac768ff224aa43ad079c6a2d81b2ed3a2ff18ba016fdf1dcdd7bc4baf79ac2"
    hash30      = "85dbb3063710d297efd41f6e274fe5dfb1a6af6cbdc7c2f27b97e16a024ac950"

  strings:
    $s1  = "entation@Store@Microsoft@@@3@V?$shared_ptr@$$CBVLoggerFactory@Core@Experimentation@Store@Microsoft@@@3@@std@@" fullword ascii
    $s2  = "rimentation@Store@Microsoft@@@3@V?$shared_ptr@$$CBVLoggerFactory@Core@Experimentation@Store@Microsoft@@@3@@std@@" fullword ascii
    $s3  = ".?AV?$_Func_impl@V<lambda_7a388e57bf198e5ee526b6f9310ef53d>@@V?$allocator@H@std@@V?$shared_ptr@VICustomEventLogger@Utils@Experim" ascii
    $s4  = ".?AV?$_Func_impl@V<lambda_7dd6f41d732bfde0f1c594808ed31bd2>@@V?$allocator@H@std@@V?$shared_ptr@VIStoreTelemetryLogger@Utils@Expe" ascii
    $s5  = ".?AV?$_Func_impl@V<lambda_7dd6f41d732bfde0f1c594808ed31bd2>@@V?$allocator@H@std@@V?$shared_ptr@VIStoreTelemetryLogger@Utils@Expe" ascii
    $s6  = ".?AV?$_Func_impl@V<lambda_7a388e57bf198e5ee526b6f9310ef53d>@@V?$allocator@H@std@@V?$shared_ptr@VICustomEventLogger@Utils@Experim" ascii
    $s7  = ".?AV?$RuntimeClassImpl@U?$RuntimeClassFlags@$01@WRL@Microsoft@@$00$0A@$0A@U?$IAsyncOperationCompletedHandler@PAVPushNotification" ascii
    $s8  = ".?AV?$RuntimeClass@U?$RuntimeClassFlags@$01@WRL@Microsoft@@U?$IAsyncOperationCompletedHandler@PAVPushNotificationChannel@PushNot" ascii
    $s9  = ".?AU?$ImplementsHelper@U?$RuntimeClassFlags@$01@WRL@Microsoft@@$0A@U?$IAsyncOperationCompletedHandler@PAVPushNotificationChannel" ascii
    $s10 = ".?AU?$IAsyncOperationCompletedHandler@PAVPushNotificationChannel@PushNotifications@Networking@Windows@@@Foundation@Windows@@" fullword ascii
    $s11 = ".?AU?$IAsyncOperationCompletedHandler_impl@U?$AggregateType@PAVPushNotificationChannel@PushNotifications@Networking@Windows@@PAU" ascii
    $s12 = ".?AVFTMEventDelegate@?1???$WaitForCompletion@U?$IAsyncOperationCompletedHandler@PAVPushNotificationChannel@PushNotifications@Net" ascii
    $s13 = "entation@Store@Microsoft@@@3@V?$shared_ptr@$$CBVStoreFactory@Core@Experimentation@Store@Microsoft@@@3@@std@@" fullword ascii
    $s14 = "Result@Engagement@Store@Services@Microsoft@ABI@@$$V@std@@" fullword ascii
    $s15 = "ement@Store@Services@Microsoft@ABI@@$$V@std@@" fullword ascii
    $s16 = ".?AV?$_Func_impl_no_alloc@V<lambda_0a66b09e892bb4d4bd3d4096e788185d>@@XV?$ComPtr@UIJsonValue@Json@Data@Windows@@@WRL@Microsoft@@" ascii
    $s17 = "tore@Microsoft@@@3@V?$shared_ptr@$$CBVStoreFactory@Core@Experimentation@Store@Microsoft@@@3@@std@@" fullword ascii
    $s18 = "Decorators@Net@Experimentation@Store@Microsoft@@@3@V?$shared_ptr@$$CBVStoreFactory@Core@Experimentation@Store@Microsoft@@@3@@std" ascii
    $s19 = ".?AV?$_Func_impl_no_alloc@V<lambda_0a66b09e892bb4d4bd3d4096e788185d>@@XV?$ComPtr@UIJsonValue@Json@Data@Windows@@@WRL@Microsoft@@" ascii
    $s20 = ".?AV?$_Func_impl@V<lambda_8e22ce4c3a18295fe2b0910da1502077>@@V?$allocator@H@std@@V?$shared_ptr@VIUserTicketDecorator@UserTicket@" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "62ec3dce1eba1b68f6a4511bb09f8c2c" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

bb74279f-1c90-47ae-86f2-e41a655b62b2

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion