_Trojan_Danger_Trojan_GenericKD_72677122_128_1_Trojan_Danger_Tro_397

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Trojan.GenericKD.72677122_128_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_129_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_130_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_131_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_132_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_13_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_152_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_162_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_178_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_179_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aCEmdoo_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aCEmdoo_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aOWVavp_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aOWVavp_20.vir, Virus.Hijack_Trojan.GenericKDZ.105924_165_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_166_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_167_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_168_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_169_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_170_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_171_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_17_1.vir

rule _Trojan_Danger_Trojan_GenericKD_72677122_128_1_Trojan_Danger_Tro_397 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Trojan.GenericKD.72677122_128_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_129_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_130_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_131_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_132_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_13_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_152_1.vir, Trojan.Danger_Trojan.GenericKD.72677122_162_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_178_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_179_1.vir, Trojan.Danger_Trojan.GenericKD.72853156_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aag1Gcl_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aCEmdoo_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aCEmdoo_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aeWgNZc_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aOWVavp_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eyY@aOWVavp_20.vir, Virus.Hijack_Trojan.GenericKDZ.105924_165_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_166_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_167_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_168_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_169_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_170_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_171_1.vir, Virus.Hijack_Trojan.GenericKDZ.105924_17_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "14eb55a62a7900ad32c191a99324f762eb88d9181caeaa502d746c00d7794e5e"
    hash2       = "12fe895e3c7e3f5fad56dec960c4c83a676dc482fdbff2a78a6bb0a7e867b3b2"
    hash3       = "a725c64a3105333e537c9ae31138f36792b4ab9d062ec3f5a47911612ba0403c"
    hash4       = "adc86e273a6ddf9a1c5ad6ec315da6b35b948dac247c338559fa0402a9be785b"
    hash5       = "9ae142c53894eefd47ab16a1c12f2969830170da82d05219bc08a3b2ab244567"
    hash6       = "8d15160a9c2bd51c09d2da197095546363419b0d3ca2278da92e0e632b2363f1"
    hash7       = "8acb7ac878fc08b6d8bbed8e8ba89e389c390f45f1251e73c47a635a6ac92f2f"
    hash8       = "145509b08ce98342a6ff6a50a0819d4f345fe16f8b97f0725a2dfbe80f3eb52e"
    hash9       = "de6a296461922cebcbdeb1f15f2f96808da929b8b72a70d53f2ab7b9ff9d1d29"
    hash10      = "40eb0713b541163d17c1a9bd36abbe1475b7f0d875648fe70383047c43b62b5e"
    hash11      = "46e8bc43311be48f9d4e5ef022b412b34c95966b6acff1e08bada9601b217aa8"
    hash12      = "fba0471a808d5a007d1b94ef065be42f01e88ac0dcd09ec1ba81c1d3e2dfe48d"
    hash13      = "98f298d26f8347863b29c790ce09a464ff7ac1a5d482d6aae440f528188d5404"
    hash14      = "7a81f6889223ce5ad7ca656a8944d4854d918ff7b8a0c255d866a081cd89186b"
    hash15      = "db7932c8558a4bda92c9eed4cf669bcf1c3bcd36991ae969022b6f953747937a"
    hash16      = "154d75601c6696781ef1e73d6144fdf61e8bddada13bfdb5567ed15a156829b3"
    hash17      = "50224f68e19dc50d265224a3d9bd1a3ffac77b54482e9e4ac68a3b8c4874489d"
    hash18      = "f6c143114dc31942091d7043004224090be8981131270f1799882b1f3e7e2910"
    hash19      = "925f36ffa22b99a2860a058a9ea1625f3805df0b3be142b3dcb4c6344afb09d8"
    hash20      = "319d1ac7396ba459aeddf269ee20fbec359d5a0ffe4824a7d0ba5e259184fc26"
    hash21      = "c326478c4e01a07e93d2e84ffd6f461865ff9835ba340b2234ffa48a6e445fe6"
    hash22      = "a24159a5de57c8a2be4ecb6f84739d3cf3689a084f3238f2f2607b75646f455a"
    hash23      = "79d73dc563bb709c9e3c3ee14edc19462e5ae36d9ecae1225e301733d288f7af"
    hash24      = "ec60be9a38cbd30270fc66c7cca32223d14c36c759feed4f51e6beaa2943b51c"
    hash25      = "f486b1e01500ffaec2a954a8e0389a296911948510f526ba4bcec50bdedbcd11"
    hash26      = "4624a664bdbd8383a31c384740a3ff2f5c4463c5fc0149b3fbb1e6925c8ba33f"
    hash27      = "39b0c914c0f5b4544757416d2c2fc2d81e156987a1c278fdf7d678562ea57777"
    hash28      = "bcc5a8730210e4e12e7ccc608da3356b5d6765c0d104da5d2412f552fd0b6080"
    hash29      = "a7b5e26cdd81fa65d0f3edb6fac8e60a66003f96cee453fef7629ddfeedcb9fd"
    hash30      = "e6d7d26167f78672061260e3a519265f38b3b9392379908bd268bf4521a048c8"
    hash31      = "fe2083b282db209e0748fe13c006f491c068c9670d982a5704bb49ccf41c1014"
    hash32      = "0942bd7f440bf06a2d55bff9867cb4f4d75f2a5a2396dc35d105fe0a4cb8b349"
    hash33      = "992c59b313b383e32f6aff175537dab1f97084935b7dcb4cac0fe3bb4a11e8c1"
    hash34      = "adf779ee2df2f27ea0cca676115b366100b6a65623b6be5cd4d26e55b672bf92"
    hash35      = "e0b7d38dab6ecf8e4ba7df8ac1d8f18dfa6ce3c76dcfa3591675d6195e5ecc37"
    hash36      = "e851214c4616e7c2d67a8b5fe94b32c4d190977b4ff734f69fe78e8e30bbb6a9"
    hash37      = "495b015fc6369c9f409c2ad27751273c05d5789e3364f322201a7a85b29d7a12"
    hash38      = "b4d68b93167a7b2e2ddb276ce036ad4a21edd6a6c2fe05475048c947e7d03af4"
    hash39      = "78c7b78fe7ac090ae2ca185ffe5137a66b4fd2cc0b72c3abd0d91847229dcb68"
    hash40      = "849e587f1feb53b103ca48073172fea055a033a0291ca41863cc315360e293bf"
    hash41      = "5041982976b74233dad98c840c9408b0779a3901cccff6e32693d449c8d2804a"
    hash42      = "f536d08443317d9295d8c9121a5ca170555f5e262e9f0ff04eca40e7d6c72ae3"
    hash43      = "b925e79c160b8182f76f49e60556d1517a1b45d374379fa28a5350b653dec0e1"
    hash44      = "a335b0b1e4e093e11e1afa38d2f532d48a67daff53d7d75b9c071f3ece8e8faa"

  strings:
    $s1  = "winlog is already executed" fullword wide
    $s2  = "SendMessageToServer: Server = %s/%d, code = %d" fullword ascii
    $s3  = "Last Error Number : %d, Handle : %d" fullword wide
    $s4  = "RecvFileInfo failed from %s/%d" fullword ascii
    $s5  = "DeviceIoControl: start =%d, count = %d" fullword wide
    $s6  = "delete previous version" fullword wide
    $s7  = "GetAgentInfo, server %s" fullword wide
    $s8  = "Read dwPmsStoreMark " fullword wide
    $s9  = "self update file" fullword wide
    $s10 = "Write dwPmsStoreMark " fullword wide
    $s11 = ", size = %d" fullword wide

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8baf8670-3a8b-4101-b862-2181b51e13ac

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion