_Trojan_Autorun_Dump_Generic_Dacic_19E38D3B_A_AAF775A0_625_1_Tro_214

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_625_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_629_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_637_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_658_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_710_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_717_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_80_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_121_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_129_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_150_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_161_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_169_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_183_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_203_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_230_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_253_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_278_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_366_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_368_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_410_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_448_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_102.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_104.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_12.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_160.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_190.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_215.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_316.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_324.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_364.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_405.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_408.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_446.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_456.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_499.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_510.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_545.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_550.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_593.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_598.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_692.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_737.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_81.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_91.vir

import "pe"
rule _Trojan_Autorun_Dump_Generic_Dacic_19E38D3B_A_AAF775A0_625_1_Tro_214 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_625_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_629_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_637_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_658_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_710_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_717_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_80_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_121_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_129_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_150_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_161_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_169_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_183_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_203_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_230_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_253_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_278_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_366_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_368_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_410_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_448_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_102.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_104.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_12.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_160.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_190.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_215.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_316.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_324.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_364.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_405.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_408.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_446.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_456.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_499.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_510.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_545.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_550.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_593.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_598.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_692.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_737.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_81.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_91.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "0078241cdb8a2e5bc5dba2120d5b75be0f434e7fd1fd2012b43c92ea32214626"
    hash2       = "785febb96d4c1f6a012d3399175b2e50e859ab253f9fa6339bb0cf0def1a3d96"
    hash3       = "c1f9440af240bda2dee95116242ef4a60336a115d5449f6a6a7974bcf1f3b2ae"
    hash4       = "a3776ba561d425fe6fe89d2124c73a946016b344dc088cf4a0dc16d41dbd8c39"
    hash5       = "48bf6bd2c3e2ccd4373b6f3ceab0ca6850c961d7ffa4fdfbb9439ff9fea1b72d"
    hash6       = "caae9d9a67046938ae10e3bdaffce4bb14458013ddf466ec8bad2ff06db85581"
    hash7       = "6c6af264a05b4d3218d8e8a285bfa2a364c2388636ea2297755eae6c615c7ec2"
    hash8       = "b6d912c098c7c60c7689421ef97892786b5aa2d1a020ab2563252adb7be891c8"
    hash9       = "30f088be1fda7b136ba9d359a232eee25b6327e7f4b0b05cc1a631e8c9078643"
    hash10      = "da1e0443018cd9c7d4088863bf6b5d87a3f8064d2335e043a28d13b4e902465e"
    hash11      = "25a4624a50fd8e61553a1cf1e67fb594d2877bdbd644087dd06ef5cc542ef8d0"
    hash12      = "6ab53aee8193d7a501d368967e9506d3e764bb901858ffaba82914c5fe25293c"
    hash13      = "0211f7b030db25911ca8759d914c1d4d91d2928e25dfeb3134b530bf8a674f8b"
    hash14      = "d878d6d6ed7d96d8eccb0084661fb46d0e96904c1bf313310052c3fa6fcb8cf0"
    hash15      = "04e3771554bc4e674bff0df6d38f16f0bc1c08a057043087f73def3797de7baf"
    hash16      = "fd010cd0aa6ae1eee0403372991ef5b2febcad117fe89f0e0f079daa1df7090a"
    hash17      = "b6b5ac4ac8e82064737389867f14acf27d7c8e27e9e9e70ce2a0dc67990e67e7"
    hash18      = "f002d6b22933835e20a74540581cb14fd9be2774a0a9d2befd4a41660ba19976"
    hash19      = "aac7fe1706feab43f50e68563c2a062f9e0de2bda6cdf51be07a8e0bac0f6859"
    hash20      = "63b92543e93ac72d1890595c64f2798f674d1b3f7d1eddce04253289c665d0e7"
    hash21      = "3106d8a358e4d14d32ebfcdae9c7fa542f81a3774ec077584c01b824c98f8108"
    hash22      = "0bb9f6a430b961281a32d7d0bb0c8c77b4dc9fca2e4ba236828dec74bd4f6870"
    hash23      = "ac5c035cc10960b251d8e57c39cf4c7319fa2e975555e4119a2f2543b1fb79fc"
    hash24      = "8d78004b4e2956f0eb756c7a4938e0e47fd68a372cda1aeafdd70d5496d56261"
    hash25      = "531b2e0c9ca1c1eb2446cfdc4c7e8fa6170453b99578e9294f0f00bdac7dec4d"
    hash26      = "4414d8d16ec3b1f4c2596a661ca0f7f45f52ff236e2978c9b40348a7bf33d39f"
    hash27      = "12e3f9f3546ef334df9d30729d8b6a6cee001b2d60ed646e330b32ad935c0435"
    hash28      = "88c617f0a092573ccb0cb3431e09fa2786276a2c656abe7ed04af19a27054b73"
    hash29      = "a80fdaa2fa8d9747c4f63cbeb88146baa9f9b7de1be5e29c8147d3dd825e1f6d"
    hash30      = "33ad27f81726371d3f78d11e7b3ccb2d43a00ef550899eeca890ac1b38c2de80"
    hash31      = "ad5a85813ea898238c996725084ad59fe74cf249aa2506074f5e89903224ae56"
    hash32      = "f8596093fad339aaa3b4fbac0d4009586c85b86375e4f42ddfd2c7aa64722898"
    hash33      = "e9d27f49b8e11edb12ba2cab17ad5582f83aec785e3369c8d7cb54d5237da2ae"
    hash34      = "10e531ecbb71c9514097bed470710538b5605b9d263cc0f40c59076d50beccfc"
    hash35      = "c9e0be0c0bd37c297829c469b1adea7abf4d9301a55d78bf34664519da12379f"
    hash36      = "023e72035b8ad5a22a1456f197bf87d3fd2ce90db0c7973fd3264345a3a86430"
    hash37      = "f74f19f258be7fa23ce0172239583ae71431da17a8b4d9de652e935899934dc1"
    hash38      = "a7b53a4300a62ac2ce65bfd005e4f4301a579739e9e76d08e9131652c29e9b2b"
    hash39      = "3ed4c1660e888c706f8e13d652f776ffaad2940bc88f42e0a5f29a2e2154ff04"
    hash40      = "158aff47f029025c6c0798168ee7917741da9853a27a978ff668171348d06405"
    hash41      = "469ecd1db4b9e8dde2a6ca7967606823adc90bd65c28280c76ff80e5a18aedd3"
    hash42      = "75bec504ffc6ac2162abaf67e2eeffc8fa8b75510875aa2551eb57b51cc21dc5"
    hash43      = "417998a4d3a40e68baf49e6ec010a8c323b9f418ae80d58340c52cdb4a5ca098"
    hash44      = "e41747ce8f9b04ce8f46d6016864c025f7893a1daf76f112f95e1479e2f75661"

  strings:
    $s1  = "[%I64d] MusicDNAPreprocessor::Utils::DSP::SaveComplexStftPgm[%d] Error: HR = [0x%.8x]" fullword ascii
    $s2  = "(internal::UIntPtr(array) & (15)) == 0 && \"this assertion is explained here: \" \"http://eigen.tuxfamily.org/dox-devel/group__T" wide
    $s3  = "[%I64d] MusicDNAPreprocessor::Components::SourceSeparator::CSourceSeparator::Process[%d] Error: HR = [0x%.8x]" fullword ascii
    $s4  = "Tempo Processor" fullword wide
    $s5  = "[%I64d] MusicDNAPreprocessor::MusicDNAPreprocessor::Initialize[%d] Error: HR = [0x%.8x]" fullword ascii
    $s6  = "[%I64d] MusicDNAPreprocessor::Utils::DebugUtilities::AnnotateMusicWithBeats[%d] Error: HR = [0x%.8x]" fullword ascii
    $s7  = "[%I64d] MusicDNAPreprocessor::Components::AudioProcessor::Loudness::LoudnessProcessor::DoLoudnessDetection[%d] Beginning loudnes" ascii
    $s8  = "[%I64d] MusicDNAPreprocessor::Utils::DataStructures::Wave::LoadWave[%d] Error: HR = [0x%.8x]" fullword ascii
    $s9  = "[%I64d] MusicDNAPreprocessor::MusicDNAPreprocessor::LoadAudioFromHandle[%d] Error: HR = [0x%.8x]" fullword ascii
    $s10 = "[%I64d] MusicDNAPreprocessor::MusicDNAPreprocessor::ProcessDnaOfTrack[%d] String copied!" fullword ascii
    $s11 = "[%I64d] MusicDNAPreprocessor::Utils::DebugUtilities::AnnotateMusicWithBeats[%d] Done" fullword ascii
    $s12 = "[%I64d] MusicDNAPreprocessor::Utils::DebugUtilities::AnnotateMusicWithBeats[%d] Saving annotated output to [%S]" fullword ascii
    $s13 = "m_row<m_xpr.rows() && \"Too many rows passed to comma initializer (operator<<)\"" fullword wide
    $s14 = "m_col<m_xpr.cols() && \"Too many coefficients passed to comma initializer (operator<<)\"" fullword wide
    $s15 = "((m_row+m_currentBlockRows) == m_xpr.rows() || m_xpr.cols() == 0) && m_col == m_xpr.cols() && \"Too few coefficients passed to c" wide
    $s16 = "?Duration in MS for Core Processing: %lld ms" fullword ascii
    $s17 = "[%I64d] MusicDNAPreprocessor::Components::AudioProcessor::Loudness::LoudnessProcessor::DoLoudnessDetection[%d] Beginning loudnes" ascii
    $s18 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/[%I64d] MusicDNAPreprocessor::Utils::DebugUtilities::EncodeAudio" ascii
    $s19 = "Duration in MS for Segment Power Processing: %lld ms" fullword ascii
    $s20 = "Duration in MS for Energy Point Processing: %lld ms" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "0b36fc85e0cb5e337c80982db5210969" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4413b8e3-f6c2-43e4-8839-3e1f4196d79f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion