_Trojan_Autorun_Gen_Variant_Barys_121928_Trojan_Autorun_Gen_Vari_393

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Gen.Variant.Barys.121928.vir, Trojan.Autorun_Gen.Variant.Barys.121928_1.vir, Trojan.Autorun_Gen.Variant.Barys.121928_10.vir, Trojan.Autorun_Gen.Variant.Barys.121928_11.vir, Trojan.Autorun_Gen.Variant.Barys.121928_12.vir, Trojan.Autorun_Gen.Variant.Barys.121928_13.vir, Trojan.Autorun_Gen.Variant.Barys.121928_14.vir, Trojan.Autorun_Gen.Variant.Barys.121928_15.vir, Trojan.Autorun_Gen.Variant.Barys.121928_16.vir, Trojan.Autorun_Gen.Variant.Barys.121928_17.vir, Trojan.Autorun_Gen.Variant.Barys.121928_18.vir, Trojan.Autorun_Gen.Variant.Barys.121928_19.vir, Trojan.Autorun_Gen.Variant.Barys.121928_2.vir, Trojan.Autorun_Gen.Variant.Barys.121928_20.vir, Trojan.Autorun_Gen.Variant.Barys.121928_21.vir, Trojan.Autorun_Gen.Variant.Barys.121928_22.vir, Trojan.Autorun_Gen.Variant.Barys.121928_3.vir, Trojan.Autorun_Gen.Variant.Barys.121928_4.vir, Trojan.Autorun_Gen.Variant.Barys.121928_5.vir, Trojan.Autorun_Gen.Variant.Barys.121928_6.vir, Trojan.Autorun_Gen.Variant.Barys.121928_7.vir, Trojan.Autorun_Gen.Variant.Barys.121928_8.vir, Trojan.Autorun_Gen.Variant.Barys.121928_9.vir, Trojan.Autorun_Trojan.GenericKD.67169344.vir, Trojan.Autorun_Trojan.GenericKD.73059942.vir, Trojan.Autorun_Trojan.GenericKD.73132495.vir, Trojan.Autorun_Trojan.GenericKD.73132495_1.vir, Trojan.Autorun_Trojan.GenericKD.73132609.vir, Trojan.Danger_Trojan.GenericKD.72677122_195_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_196_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_197_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_198_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_199_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_200_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_201_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_202_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_203_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_204_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_205_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_206_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_207_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_208_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_209_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_20_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_215_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_216_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_217_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_218_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_219_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_220_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_221_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_222_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_223_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_224_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_22_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_2_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_174_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_175_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@a0DbbBi_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_2_1.vir

rule _Trojan_Autorun_Gen_Variant_Barys_121928_Trojan_Autorun_Gen_Vari_393 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Gen.Variant.Barys.121928.vir, Trojan.Autorun_Gen.Variant.Barys.121928_1.vir, Trojan.Autorun_Gen.Variant.Barys.121928_10.vir, Trojan.Autorun_Gen.Variant.Barys.121928_11.vir, Trojan.Autorun_Gen.Variant.Barys.121928_12.vir, Trojan.Autorun_Gen.Variant.Barys.121928_13.vir, Trojan.Autorun_Gen.Variant.Barys.121928_14.vir, Trojan.Autorun_Gen.Variant.Barys.121928_15.vir, Trojan.Autorun_Gen.Variant.Barys.121928_16.vir, Trojan.Autorun_Gen.Variant.Barys.121928_17.vir, Trojan.Autorun_Gen.Variant.Barys.121928_18.vir, Trojan.Autorun_Gen.Variant.Barys.121928_19.vir, Trojan.Autorun_Gen.Variant.Barys.121928_2.vir, Trojan.Autorun_Gen.Variant.Barys.121928_20.vir, Trojan.Autorun_Gen.Variant.Barys.121928_21.vir, Trojan.Autorun_Gen.Variant.Barys.121928_22.vir, Trojan.Autorun_Gen.Variant.Barys.121928_3.vir, Trojan.Autorun_Gen.Variant.Barys.121928_4.vir, Trojan.Autorun_Gen.Variant.Barys.121928_5.vir, Trojan.Autorun_Gen.Variant.Barys.121928_6.vir, Trojan.Autorun_Gen.Variant.Barys.121928_7.vir, Trojan.Autorun_Gen.Variant.Barys.121928_8.vir, Trojan.Autorun_Gen.Variant.Barys.121928_9.vir, Trojan.Autorun_Trojan.GenericKD.67169344.vir, Trojan.Autorun_Trojan.GenericKD.73059942.vir, Trojan.Autorun_Trojan.GenericKD.73132495.vir, Trojan.Autorun_Trojan.GenericKD.73132495_1.vir, Trojan.Autorun_Trojan.GenericKD.73132609.vir, Trojan.Danger_Trojan.GenericKD.72677122_195_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_196_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_197_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_198_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_199_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_200_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_201_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_202_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_203_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_204_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_205_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_206_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_207_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_208_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_209_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_20_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_215_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_216_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_217_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_218_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_219_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_220_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_221_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_222_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_223_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_224_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_22_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_2_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_174_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_175_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@a0DbbBi_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@ae3yXvm_2_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "5a60c73c3419e18abfa65adfbed655ab3b62881a43265bd7eb0d3c712bc91d8d"
    hash2       = "3fc29e3b618859f01f4a4c96542e17946e082c7093072c62e078ac5709235fb9"
    hash3       = "8723066cc120e713ae118a3312505bd97abb5b4c3c7b7012391867a04fd6cfe0"
    hash4       = "f5dcf2873eb5d23b572ecd2bcdcf365a3ab25c3e11d1114d0ab832b4772682f6"
    hash5       = "11dea553618070bac4bf33ada24be252bfd34c56add8d98bc8d649999e4c7c09"
    hash6       = "a030006f1c981a7d356229c1024613c9862009d7d36b9de7253f016304f1d9af"
    hash7       = "4ef8b0c19f283d1394e103c0c7ae5fda09ae83d825af2bc8a962a71a2c3b8b09"
    hash8       = "291b7b014e5d3b084484836e42946a71955da5c31485f203342842b00e1cb712"
    hash9       = "6a04379ab89150bc16e7c6f583fb674b4987c5dbca28dec5e895a031a9577363"
    hash10      = "0cd9b41cdc857f5e6cb1e30cb8c3bc130fef391b479347098a0e96221d420ad7"
    hash11      = "d94bc6c733ea93dbde8ba007a2dd616e1ce16347324e1ecf7b8722e5ac8e7156"
    hash12      = "e987a5151cfdfe5480d66748cdd7e8ddcf20542d4ce9fedf953926e10c3c9105"
    hash13      = "3b87a1db940f9d29535d67501273419448d15f85d6540f5988f60e95e4da2efa"
    hash14      = "f54d8cacf2edddc1ced0e5d1df49631e24c8b309332f2663ccaf86356070e8d3"
    hash15      = "ab2ebd2da928782908edb7e45534af9d296b3ea61cf936a9a9d97c8628595975"
    hash16      = "10621ee2851138977a8d392efc0fa6d6655acd7493c8ff2673204ac1b1b7a7a2"
    hash17      = "c78551ca8541b202efeb52c6751f69d14598704a7171a051e9b7210b916aa181"
    hash18      = "7891e42a2d097353bfca777656bc247b111f3b4e7c07c4f3d24e2520f5b46148"
    hash19      = "94020f3023f7adf307e0892fd79c98a80925993591be469b5be16c18d9bc6ea5"
    hash20      = "2d20d302187c9657bf7f9085a948f29572f40f323d1a0e13caea691a20344fa3"
    hash21      = "172a2f3e9c1de7b5b80bf0ee4d557b57e79a345747c47c5389f68767b0a8a98c"
    hash22      = "01a32fcd1fb0aa602af704846ec851a51858f575b357013066169afbcb5b7956"
    hash23      = "cbfaa2fec80edf51e22d5b045a513c6014b7986cfb17b2f462fa2bdd37478f6d"
    hash24      = "e296c6a2b0dba1c3e897e9bd494c6eae2cc790e261568960a308aec68d1626e3"
    hash25      = "719b819b5b01542925af1cde2cc6b905ea00b22b99dd32613d65760fac1f17e2"
    hash26      = "8a8c0c0c47366bd60ff448d35ca90161eed681ac6124797b12dd81828137cfee"
    hash27      = "ecd723f9adae8caafd975925cf830fce173a5599411408330bc3b6bf3d83b4f6"
    hash28      = "1e3c2a397859e40ee96f534f94d5b7038202f545779dc950b188bc4b06a1ff8d"
    hash29      = "95ae1d889b33535a9198d80fbe44d1ea9f989da25653c44c042059738b225396"
    hash30      = "ebfcd1c5536504e7216485bed8b55f74753b7f1b285267eaab19e94190a8e8ae"
    hash31      = "9d463fa1f5c3e0affc58a230b664892805ff72ec499067272bd31329da4628fe"
    hash32      = "c3393f2904b46e9eddc34fcdb82f7e2ba7bf1c29ddf3a32d967f4704e9efcff5"
    hash33      = "12be3052a528e3bce84f11cdee2ccab333e5d85779c770612d2375ea05e5dfde"
    hash34      = "4a8442aff019a5e81d3b31c28574f796ae2ce318e8f333c96564edfc002c3d41"
    hash35      = "238929505454aefb4d69704203634b95ebfebcc446cb10a7a1ac8c13b6e6e521"
    hash36      = "33b7f9a485cc7a2c3d98607a525632e1373dfd378fe2fdc5f035d56ed73d5d3a"
    hash37      = "e04f8093ecf58a539c0cbf6caf31d43abebe0c05bb886df72849bcad5433fbe7"
    hash38      = "63048561d8017a06fd1e5459b5a458679c24563b54108390b7b6a565b5794b14"
    hash39      = "7bc0e2e95d349dec3a8833a431f4aae9dbff6764155df3364a2ee38bc58406d7"
    hash40      = "465e4a5dfd61d15a5224013f399c6a872a728bd8e1befe4fd22283f9d83eab3a"
    hash41      = "c1f51ef65b4385b87a48b996c0efb7a5572e9b2f6b4382434a409ed0d388bbe4"
    hash42      = "6a250046cf56a98f17d6e55826504638725831d59bec0d3fa172c576ce0f6076"
    hash43      = "9163656d769716baef7403241a656f37c330de33e1afc96e9d7486cf48ae7874"
    hash44      = "00115e4b0116529cb6a76e9cda162d2d1d386e4c4a9c37e40411b23b62ea106c"
    hash45      = "85bd319154227627f7012d7c2f9a11ae862ab25a5d1010cfd054959381334190"
    hash46      = "e519b2f25f4d4508cce62f0773a0793067b0386cfb7c3a358b6e0a826e640e2c"
    hash47      = "ad2cf691ee21b61ad670c150bbaba9203c02c78da45b0dbeaf9c58e4636331a3"
    hash48      = "4bb64d4b281d9f4a390372a7f2c1ee0cc9be6ca984f65876d815cf8eddc82ef6"
    hash49      = "83b4ec31b48c9b5c8e9453e7f704b0b55fb0a2f285a0c1d51818169267d96dea"
    hash50      = "a37a31a3ba0f739c5f1896eb3d1304a059996f8330ce3d84c8dc0347981fd9f3"
    hash51      = "b7ed16377c782efc1c40dd33935a3e404494185449ed018ef14b85f71ee56224"
    hash52      = "16ae326ffa317838a9db93df09c274e95a8abf2133d22b613d360b74cc10b3da"
    hash53      = "6944b35ad0b4a910dc0fc6fd91654d64d974d4f597381f056a36b5278f60698b"
    hash54      = "dec24a6e003f647568c9197f3ce2cd4510befb518fb783f309ae00ee6bcc9aca"
    hash55      = "98f52cf60d8206235ea028e84a9f3184c71b00cb0d1b6691ea8bd109b3145677"
    hash56      = "89a7da2618f68d79eaf88bc05a56ee87fabbcc42df2dd665ac0197fca47c7dd5"
    hash57      = "38e151430f05ef3c3a2c113a34b7756d175ff3653157364b022e3ea9a7a169cf"
    hash58      = "efa3dc02a3f30eb909d30690ec2e748022a0820a42f58191f4f61bf867708dab"
    hash59      = "9ed212abadb39c64b5de76c98f7424b6a3dda277c3c7bb4434f299010cb6e818"
    hash60      = "dc5b3c4a53575bb981f55c14588cb479cbe1fddab1188683a05fc9d78469ef9b"
    hash61      = "691da1b628e6f4a4319d01deaa23eba9bbcea10431dfa5e2af79ff844ec895ea"
    hash62      = "f837998831c7edbc26ab2e441213e07d7197f146eafbb00ab5a12105105c7a10"
    hash63      = "34c8e30ed4419ab4788e944bf06f06a39138e58d547816174fec684f881994c4"
    hash64      = "3f79aab7b03c076a4fe6639d11df0e3769e486e4415c46fe99919e2738f41ad2"
    hash65      = "0283152910ea50db89fd3852dc6f3cc42a7d5c3342437fa4a585bd6567c3ce80"
    hash66      = "37ebf70ce6905df6a3ef91e126e9ca5e01c599b8aafcd17a01a422c3644428ca"
    hash67      = "e45ebf960b1c44dc56763f871ee8aff00ef53b930fab352bdd0ba745787f8c3d"
    hash68      = "eda1543fd8249f6a9fd955e568337d7e78020312ce12372e5d7186f86bbb4e53"

  strings:
    $s1  = "Opera 6.01" fullword ascii
    $s2  = "There was a general Exception-Error" fullword ascii
    $s3  = "SLDT word" fullword ascii
    $s4  = "SMSW word" fullword ascii
    $s5  = "LLDT word" fullword ascii
    $s6  = "VERR word" fullword ascii
    $s7  = "VERW word" fullword ascii
    $s8  = "LMSW word" fullword ascii
    $s9  = "The program will now be terminated!" fullword ascii
    $s10 = "LTR word" fullword ascii
    $s11 = "STR word" fullword ascii
    $s12 = ")BOUND" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

27da0b4f-b9ec-4d6f-81b6-950e6222daf3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion