_Virus_Hijack_Dropped_Backdoor_Padodor_BJ_746_1_Virus_Hijack_Dro_182

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Dropped.Backdoor.Padodor.BJ_746_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_748_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_750_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_751_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_752_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_755_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_756_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_757_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_758_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_759_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_75_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_760_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_761_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_762_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_763_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_764_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_765_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_766_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_767_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_768_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_769_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_76_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_281_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_282_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_28_1.vir, Virus.Infector_Trojan.Agent.DQQD.vir, Virus.Infector_Trojan.Agent.DQQD_1.vir

rule _Virus_Hijack_Dropped_Backdoor_Padodor_BJ_746_1_Virus_Hijack_Dro_182 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Dropped.Backdoor.Padodor.BJ_746_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_748_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_750_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_751_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_752_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_755_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_756_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_757_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_758_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_759_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_75_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_760_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_761_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_762_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_763_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_764_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_765_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_766_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_767_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_768_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_769_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_76_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_281_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_282_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_28_1.vir, Virus.Infector_Trojan.Agent.DQQD.vir, Virus.Infector_Trojan.Agent.DQQD_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "8410378e646581d0967c835a66e1b8f692667b89b39af897a2aa09d4a93fe67e"
    hash2       = "ca86eafa12a938be00cccb79aff79c4e91d72064668de952cff0cedcf55fc17e"
    hash3       = "df97351e88f88063b787b75d8abafae7e800ba01b1e9a4647004a365a953a7c7"
    hash4       = "504b943b5160292ad0768839b14871809e62b37aaa87fe809f7bd8662c44787d"
    hash5       = "3cba52d8982a58f23e8d91507e3291641ba04933bef363aa90fda1e2ed2323e0"
    hash6       = "b3c14b4eec22efa2f0a00e668d9f6602700aa53bd3b425c83cb37e71cedc4740"
    hash7       = "f726ca5daca0d6fa93313e5ce41cf1a76a11dc9b9cd8ec7cf6c5b3dfc80e5fb9"
    hash8       = "9c17976991f9ad9c3c5b1b45f804c269ef6016a330c9c66f14a49424a7d4824d"
    hash9       = "60b57bad47b3a45c7def8bc0257fb9fa2c9de205f956d55d5fdbf4d666218f20"
    hash10      = "d04acbcd49654baada10e26aeb972dccede9902b863d2171d0f8a9f3ad912def"
    hash11      = "f17cfe3a30257c72fd21801d563df2c2fb0e26486d7386e7b3aae22516c9d2c6"
    hash12      = "1e9509b68abfa13b04c5bcbf092ede28c9b2fdfd5f93ef81ce9a7b4220e71dca"
    hash13      = "6a776edb6a016424c54e175ed67a262e5587a029d69728c0ca2c36fc8a006770"
    hash14      = "c9d864f964851191a8ffecab331d0c2fa157e0d58fab2e7f116d102cbf9404da"
    hash15      = "f507ef7a2732c5fa0825ed551daf6197cf73ff1c60fbb111cd315c51cb2818e6"
    hash16      = "5d1eb7b4aad27a29a8ee1b84886b2ca7a85115c54bef3108e5049893a6401d93"
    hash17      = "673780b1187b629aa0b0e2376706414271690852557a5ec622d6dff643398bbb"
    hash18      = "158ff7fedf9301d2fd223294ceb51ada03a8f731b54091f97c5553800500a3ed"
    hash19      = "cb91a8d12a180bb9c819dea9fc795ec43e1a2dd252aabfd5520d10e3b037d652"
    hash20      = "5da8d43d95db943c850e1e4870358d4f6f110c00fad72dfd42713d1adff9091d"
    hash21      = "f31deb07a99c77b3d1186b4bbadeaad10c1cb99e07a6309baee5b127888c64ad"
    hash22      = "7da0d3d3d1aa49073105c654e6eaf9179e2d0d100d271603b845351638769759"
    hash23      = "56c8f8d20b8af2de276868076b4a88dba84e53b88ed41640c9554bb033bbad42"
    hash24      = "156f276b8f252f669aaf57851be098570ebd7b1317f9571d495a707edc33fe25"
    hash25      = "cfa09b3f7e9c54ef6d4f147dc56daf7f528a69c0255fcc57fd3b36374c51b511"
    hash26      = "000569d0f8a31fc63e02bf9cf2dfca8e597465f5d7bc5542fb05ec5230d11938"
    hash27      = "731af2959f022e1712fd071e575c23549a47ea59a2648f4adb07391e026128bb"

  strings:
    $s1  = "JOIN #HelloThere" fullword ascii
    $s2  = "\\DC++ Share" fullword ascii
    $s3  = " :to get this, type !xdcc_get " fullword ascii
    $s4  = "NICK [share]" fullword ascii
    $s5  = "NICK [zip]" fullword ascii
    $s6  = "NICK [mp3]" fullword ascii
    $s7  = "type !list for my list" fullword ascii
    $s8  = "NICK [xdcc]" fullword ascii
    $s9  = "NICK [rar]" fullword ascii
    $s10 = "ACTION " fullword ascii
    $s11 = "LIST >4,<10000" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f6bc4498-aa61-4856-a081-86274868f64d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion