_Trojan_Autorun_Dump_Generic_Dacic_BC58E3CC_A_00D7D229_239_2_Vir_308

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_239_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_38.vir

import "pe"
rule _Trojan_Autorun_Dump_Generic_Dacic_BC58E3CC_A_00D7D229_239_2_Vir_308 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_239_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_38.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "8f649269ce6896569f565d6c3e045c6e09bfd989683f42dc2740db47330de409"
    hash2       = "b63261716b1e781beb56b37cd2d44a9c336e7b420652aed09044fd43247a1b80"
    hash3       = "fb81dbb936499b8c5f5aaa64be8e36f964bae687f03298eff7e856c3ac0ea22c"
    hash4       = "80c7c965b9fa6731d6fde32a8a2f9c03cfb13f7ff3eb68360adab6acf32ea4aa"
    hash5       = "75daef5818c03f31bc4aac93fd9cadeb30501c70d7063c65b72dcaed13e08b2c"
    hash6       = "27f0c0c257fbcbc09ce0ccb232929816269bf9a671dedc6f31ca5ebb3d7a3f23"
    hash7       = "2e05bc03f3206d6798faf85790a6659d9c35e01958c35a45f56edba0f8c193ec"
    hash8       = "0e50297d00725ac44669baf5af6d6edefb0e5685e8062c9e383f46bc6f0a7132"
    hash9       = "35343871869b50c2cba5ac827b1a7201c5adcb1dfb6cd3098d4f245ba49ceb58"
    hash10      = "0d148290c478dabca79975a77a5c2a5ae47f12c0c72c40e8fb93fdcb31c5c71e"
    hash11      = "608e74643884b5e54701cf0e7a15dbf18ff2a86676f94b118ff1dafa3b4e03dd"
    hash12      = "de5b63f4ffe84d34885e76b8f29147ab33106eeb4b3800d57c0e1edd23866fd8"
    hash13      = "9f863c400c0f7ef5153fd38edda4137b13143278de8b06de05b9323e91c974d4"
    hash14      = "b9a01c0ba42f421f92f42e36cd88755804eb43d75b3b614ee46e9cab09c0b0b5"
    hash15      = "e25be2c8b81539da9105c5bb4243ed37a8ded3cd6a1d15e2afec79418ebcfe85"
    hash16      = "3663a717b1db3fa0c4b27bcb4b238177ac940fa157232a3742a76808213f77c4"
    hash17      = "a875883ae189aed76e62166af5b5e4ba8acfbac9712fa80b165455015aa85dd0"
    hash18      = "a28314c9bf3aefd41c9bdaf8531d4516c0ca6ce4d269cda1dc992fac6e6f0c93"
    hash19      = "eb1787166fb170e5c3b3c0761d22b2263bb86361bab75d2cad1ebf1d8395a1dd"
    hash20      = "ff8236a838496d7e7ae1363fd45db6207023f6d8fc26a7ddaf2f1f4f40d2397c"
    hash21      = "a9e7c2dc8fbd35ddb3a0c05cf48287689069060fa04fd5116587333f16db114d"
    hash22      = "294febb0636dcf53d32330934aa29d4f072be1c5f3318b8bef9e3da7e42f42fa"
    hash23      = "0805f0cfb915df921fceebff50ff549de99099d743f0caabfdd6d1dc49eee010"
    hash24      = "c4f52f084ead43c02434a0cc01589b1ff470e57b5d67e1a551569f670f4283d9"
    hash25      = "4302ab0f740b3950f47a0cbd76e75681a6d3118ac97154450a2daf258fa70db5"
    hash26      = "68354b72cbccc7ef28c4d8835469af5c3b572760667295ccb60d1d7f1060ef8f"
    hash27      = "e8309fe398b789d3706ae732c85cdf0aeb1fc7731a478cb60eb4a75b9641d9f4"
    hash28      = "b271f15120e69ae544c096b528961dcb21eb06dab1044973bce2628b2b9e2eaa"
    hash29      = "e772c52e81eb93cc4fd86978428d8f734f9426b4dbe312bc1f0bb868b388a2bd"
    hash30      = "bdbe7ce4d599a31a0eca49c7a95fd3bec0478195c693c9e9ba5ee85f7c06ffdf"

  strings:
    $s1  = "Error: The password must be 140 characters." fullword wide
    $s2  = "Error: Failed to bind port" fullword wide
    $s3  = "Failed to bind Message Port  Please make sure it is not in use." fullword wide
    $s4  = "Error: Failed to bind port 9999" fullword wide
    $s5  = "Password too short" fullword wide
    $s6  = "Please enter a password for the conversation with " fullword wide
    $s7  = "Password for conversation with" fullword wide
    $s8  = "Local users:" fullword wide
    $s9  = "Failed to bind Broadcast Port 8888. Please make sure it is not in use." fullword wide
    $s10 = "Start encrypted message" fullword wide
    $s11 = "Error sending message: " fullword wide
    $s12 = "Please enter a username!" fullword wide
    $s13 = "Username invalid" fullword wide
    $s14 = "Please select a username:" fullword wide
    $s15 = "Welcome to the LocalChat!" fullword wide
    $s16 = "Ending chat." fullword wide

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "f34d5f2d4577ed6d9ceec516c1f5a744" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

fb83aff7-717d-4e2f-bc7e-10f451b1670a

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion