_Trojan_Autorun_Gen_Trojan_Backdoor2_emJfaGT28okb_Trojan_Autorun_335

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Gen.Trojan.Backdoor2.emJfaGT28okb.vir, Trojan.Autorun_Gen.Trojan.Backdoor2.fmZbaKq9kbjb.vir, Trojan.Autorun_Gen.Trojan.Backdoor2.fmZbaKq9kbjb_13.vir, Trojan.Autorun_Gen.Trojan.Backdoor2.fmZbaKq9kbjb_2.vir, Trojan.Danger_Trojan.Agent.EICV.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_117_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_124_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_147_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_157_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_165_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_167_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_169_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_170_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_171_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_172_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_175_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_192_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_193_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_198_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_200_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_202_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_208_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_20_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_213_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_215_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_217_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_218_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_219_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_220_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_223_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_226_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_228_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_230_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_231_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_234_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_237_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_244_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_247_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_24_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_250_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_255_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_256_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_31_2.vir

rule _Trojan_Autorun_Gen_Trojan_Backdoor2_emJfaGT28okb_Trojan_Autorun_335 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Gen.Trojan.Backdoor2.emJfaGT28okb.vir, Trojan.Autorun_Gen.Trojan.Backdoor2.fmZbaKq9kbjb.vir, Trojan.Autorun_Gen.Trojan.Backdoor2.fmZbaKq9kbjb_13.vir, Trojan.Autorun_Gen.Trojan.Backdoor2.fmZbaKq9kbjb_2.vir, Trojan.Danger_Trojan.Agent.EICV.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_117_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_124_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_147_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_157_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_165_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_167_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_169_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_170_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_171_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_172_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_175_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_192_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_193_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_198_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_200_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_202_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_208_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_20_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_213_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_215_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_217_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_218_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_219_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_220_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_223_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_226_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_228_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_230_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_231_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_234_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_237_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_244_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_247_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_24_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_250_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_255_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_256_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.uGZ@ayM4QWg_31_2.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a10d407f1c4901dadfb143571fc36ba226e4b648b842bbca7b87e2a3f82165f6"
    hash2       = "a23cfcfb656768e6f3ba0faaf757a434886fd99d3bb8a1e358da015cdfc2dd38"
    hash3       = "735754bfd40bd8a998d81b358da7677687845004060e7c7f795b60136275fbc5"
    hash4       = "0f9761e7c908d859b9fac319dfd64da89388b63b8ddbe22f5c8bc7fbee4ca15b"
    hash5       = "ed602d697d88ff92ea93e475fe6778bf0d76cd852ff26e16c58ffa2a5d38546f"
    hash6       = "963715665fedc08c6600c8f6eb83aa2603bf941ee69ed0974db5f21113b55e59"
    hash7       = "55b5886fb463cae5cee1ee24a44abc120644ac1377e38c2234f4001dc9492167"
    hash8       = "e00d016542c5a3efb55b0ed4d64a7eec0c990225f5cbdeac2bea19c359ed0142"
    hash9       = "e223b6828e86bbf25edc747df03b538a9619dfa0a54d0e500e8cb930214f5c28"
    hash10      = "78cc9f514548e01fdca40f552013d11af4669d3ce2e26bd4e91090c0660ae8e9"
    hash11      = "775eaf2c3d842ea519a0c161e8a782c50269f16faa7560fd859682475f957bf1"
    hash12      = "5ae9799a975e22eab9ea28cbc9103feb954d7241dcd7c2270b72cc18c9201236"
    hash13      = "37865158a996519922eef811beee21cc6c12e2a710eefda22d2e1c2f20c91150"
    hash14      = "f4300e2bde96775c2847137c82b4735445b56710a2f50bb4d36f1046b4301c5f"
    hash15      = "57eb01594cee9b77224be52a0bfe3e8c5f5558dbdcd0c14fb2252dfa3885d87f"
    hash16      = "7a9a58ce52b184793fdf42e7f3823f8a2641e8ee3cbb72dd2c3c77f0c3c4632e"
    hash17      = "5be5db3e8dd98cd7beec90a0b7a718b3c524e0f8112bfa49d8e5781af357e339"
    hash18      = "e60e8579b6d8333afd043762df12502146eb3e67f4977fd608b9a0c1fff97dfc"
    hash19      = "6d0917dc3cda82c7eeebb09c41bf8d9e0cf3610c89fd8209449c04fa9f198fde"
    hash20      = "d26ee7d673aaf96d45bd4fc91fe709cc83078775dd629da4ff5762c29e7b17c1"
    hash21      = "58f88d1c98aa6ee12cae049760095b2a7c29a9b934a645bfeee113a7d7124847"
    hash22      = "db9657e33d0bbd1607667db444db64731d4e888cdefeaee410e72a2c41746a20"
    hash23      = "1423d4f50bc652fcf2a1c8ef58ae19c62a89c3276bb51579dedaa590371ece44"
    hash24      = "49fdd724d92ac04341458122715711ee0e095f9bb4a9478d501f4ff09ad98600"
    hash25      = "5355fc3cf5056adecc4e9f333676d8d89842b8bbcdb56c4c70c0ff1f4e672cb7"
    hash26      = "281e57d2d062df385bc422c5e7425c8f336adecdcb9c8c5f9574537cf6405a82"
    hash27      = "05e672f491a10f6b69de690fcc59d3f50050f8fdc7c0aa947523ab2de51bf9e5"
    hash28      = "67659ea8c66572f539b3a57f7ab7085829c542ee5f3f237e73339f6806a12f6d"
    hash29      = "87059e85651c3dfe92443097e86e38fc3c8c4dba4df0c9800f9be628578fa2bb"
    hash30      = "d98481ddc371c99c77e82442b2190a155e46e5b01aeb6dcdf8c1b018d7330f4a"
    hash31      = "0bd515f431645043da8eece0d0989c688f8ac6dd1e8eb7530a8f8903e71447d1"
    hash32      = "a6c579ca342c247e1e536ae270102a1b2360f0cc9eb4f9ea5541d72b61288b51"
    hash33      = "7950139fc8fecbdedf6424a57955cef9d967470ff6de87cedb34c99b2916d55c"
    hash34      = "df767faf2fac1e1d755461f047afa85e478ad4184c9046d6518fe0f955c39266"
    hash35      = "2a914114922776c61fe49fc8e9b95c1b8ca3ab17152118240fcdeda159eea09a"
    hash36      = "1168b0f7a9b799333f5b3dcc45e5060de83962a8f6a8ec42109673db69ac8dc9"
    hash37      = "978e87c79c1e4250fa041abc3cfec16f74251977720e5adbe76137f2eb61be6f"
    hash38      = "683ccbda86436a342b8dbe8c7f10643970b67280f8aa24a684a9976d99e103c0"
    hash39      = "534caf79873b5c5a61cb5c268d87c5c8d2b001d89cbb8715e45477e74a52f9db"
    hash40      = "e2ddf2b5cff166e83a4d70f9e7cc961c3bc6211f74bd895878e77b2ba1bea966"
    hash41      = "8974e14cfc880cd3abdcc77e7e2071483299293264ecfe3aefa05a7cc87e2ab2"
    hash42      = "88167ca31d4df5aeca1248de218a12264c384bd7d5dca0564f6903c13b39fe9a"
    hash43      = "b0bfc60d45ed7dd350b9c54d82bdc3e32e8e1249351bc3a41ebebf33e8e67cdf"
    hash44      = "7980b88ff55481b3c16f90d69eb2af02dffff5934dc6bf97be2c3cfa328993c0"

  strings:
    $s1  = "Usage: %s [switches] [- | shell [shell switches]]" fullword ascii
    $s2  = "[K{PID:%u} child process wating for SIGUSR1 (pgid=%i)" fullword ascii
    $s3  = "[%u;40m{PID:%u} Failed to run shell (SIGSEGV)" fullword ascii
    $s4  = "failed to run shell" fullword ascii
    $s5  = "input: query_console_size failed!!!" fullword ascii
    $s6  = "  -d, --dir <dir>  chdir to `dir` before starting shell" fullword ascii
    $s7  = "[31;40m{PID:%u} read(pty=%i) failed (len=%i,errno=%i): %s" fullword ascii
    $s8  = "[K{PID:%u} child process continues after %u ms (SIGUSR1=%u)" fullword ascii
    $s9  = "[33;40m{PID:%u} shell: `%s`" fullword ascii
    $s10 = "  -l, --log <dir>  write console IN and OUT to files in `dir` folder" fullword ascii
    $s11 = "[%u;40m{PID:%u}    tcgetpgrp error (%i): %s" fullword ascii
    $s12 = "[31;40m{PID:%u} closing log file (%i)" fullword ascii
    $s13 = "[31;40m{PID:%u} log file was already opened" fullword ascii
    $s14 = "Windows drive mount root: `%s`" fullword ascii
    $s15 = "[31;40m{PID:%u} Stopping our threads" fullword ascii
    $s16 = "input: WindowBufferSize (%i,%i)" fullword ascii
    $s17 = "      --keys       read conin and print bare input" fullword ascii
    $s18 = "[%u;40m{PID:%u}    isatty error (%i): %s" fullword ascii
    $s19 = "<unknown fail>" fullword ascii
    $s20 = "Starting raw conin reader, press Ctrl+C to stop" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7b963bac-5708-4130-b964-0dc43b5a12b8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion