_Trojan_Autorun_Trojan_GenericKDZ_94847_121_1_Trojan_Autorun_Tro_453

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_121_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_141_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_169_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_201_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_266_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_312_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_365_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_424_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_466_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_54_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_88_1.vir, Trojan.Autorun_Trojan.GenericKDZ.95048_22_1.vir, Trojan.Autorun_Trojan.Ransom.Doboc.A_4_1.vir, Trojan.Danger_Gen.Trojan.FileInfector.mmJfa0A48Fd_1_1.vir, Trojan.Danger_Gen.Trojan.Heur.duY@HPIO3zfb_6_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_54_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_107_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_11_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_144_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_153_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_189_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_276_1.vir, Virus.Danger_Trojan.Agent.DQQO_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_9.vir, Virus.Hijack_Trojan.Agent.DQQO_16.vir, Virus.Hijack_Trojan.Agent.DQQO_168.vir, Virus.Hijack_Trojan.Agent.DQQO_176.vir, Virus.Hijack_Trojan.Agent.DQQO_184.vir, Virus.Hijack_Trojan.Agent.DQQO_198.vir, Virus.Hijack_Trojan.Agent.DQQO_242.vir, Virus.Hijack_Trojan.Agent.DQQO_254.vir, Virus.Hijack_Trojan.Agent.DQQO_26.vir, Virus.Hijack_Trojan.Agent.DQQO_267.vir, Virus.Hijack_Trojan.Agent.DQQO_349.vir, Virus.Hijack_Trojan.Agent.DQQO_411.vir, Virus.Hijack_Trojan.Agent.DQQO_73.vir

import "pe"
rule _Trojan_Autorun_Trojan_GenericKDZ_94847_121_1_Trojan_Autorun_Tro_453 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_121_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_141_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_169_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_201_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_266_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_312_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_365_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_424_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_466_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_54_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_88_1.vir, Trojan.Autorun_Trojan.GenericKDZ.95048_22_1.vir, Trojan.Autorun_Trojan.Ransom.Doboc.A_4_1.vir, Trojan.Danger_Gen.Trojan.FileInfector.mmJfa0A48Fd_1_1.vir, Trojan.Danger_Gen.Trojan.Heur.duY@HPIO3zfb_6_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_54_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_107_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_11_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_144_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_153_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_189_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_276_1.vir, Virus.Danger_Trojan.Agent.DQQO_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aq1NpPf_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.w8Z@aq1NpPf_9.vir, Virus.Hijack_Trojan.Agent.DQQO_16.vir, Virus.Hijack_Trojan.Agent.DQQO_168.vir, Virus.Hijack_Trojan.Agent.DQQO_176.vir, Virus.Hijack_Trojan.Agent.DQQO_184.vir, Virus.Hijack_Trojan.Agent.DQQO_198.vir, Virus.Hijack_Trojan.Agent.DQQO_242.vir, Virus.Hijack_Trojan.Agent.DQQO_254.vir, Virus.Hijack_Trojan.Agent.DQQO_26.vir, Virus.Hijack_Trojan.Agent.DQQO_267.vir, Virus.Hijack_Trojan.Agent.DQQO_349.vir, Virus.Hijack_Trojan.Agent.DQQO_411.vir, Virus.Hijack_Trojan.Agent.DQQO_73.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "37daf66e43c557e234544c251bb8fa94f5fe8432b163a8a5d159fc9a358e9f21"
    hash2       = "c37010f3be859019e33bc3e81f34e93af38f319f787555317305fe438a04ffe4"
    hash3       = "d6555cd20fb4f4f184416eb4a3af069b6302f2b9b88a814d939d420d2ef08e1b"
    hash4       = "77008ca0c0e927fc43fd4d17263b1a9ee180fb3e2cabb1500cc2bb13b732505d"
    hash5       = "f9e21fed0719ec0ee49ade9739644d7c8a9ced7bd0be3dd4e679152e663c50eb"
    hash6       = "76abac7e76a02945767fd55277b2a0c805785edaa76123c691025981378d2b3c"
    hash7       = "96de335092ee78b168fc6da8c291c7c7e10e2610d966b726cb1d8e87df238fc5"
    hash8       = "c224e360d8e38d5ecefa4030b6811aa6bb0e686695a1050a08973f439eb79adb"
    hash9       = "a07a3c2bbc18b67cb74dd0ba4f03fe23788c024962a98db0d4a9746ab1a45a5e"
    hash10      = "1072d546c3494ec52c81fc145b4a3fcb878ee2821ba79a13cf58dfeece4de9c4"
    hash11      = "9c6ad18020e8d36579f19fc777a0a297b13e8aefbd3b6dfad4650b7ed0672228"
    hash12      = "21d82da3a96189a784656dfd4b664993216a348e1c835088b8c14238c04bc750"
    hash13      = "77cb7ea30008760aed7556cbe6fb31f8836909a80d58d5fb2e99a1a539317040"
    hash14      = "dc121c49c60fd86d03cb3739a9e06a4e4c538bac8c0e3ef57d33ddb47987b4e1"
    hash15      = "519e0f9a5f3bea1d1d4aa8af041bb7e0088f28234265dd2dd85f5b704a9af6be"
    hash16      = "bac8079326884fc434aec10d914ae9a0a87dc7373e310fb3bcd78896818b8338"
    hash17      = "8de16e578324c22f723f5791964767a9216d3f20bdedf1e9f5fa0bd55baeaff2"
    hash18      = "daf3b24540f830e244c26e4ca1382c5bb6b4c9d2172e88454fa0d1251140a606"
    hash19      = "9a078550714c76a297687a2afef42f3532eff0e784a8ca961fa6bb9e59cf44dd"
    hash20      = "dc555e92429d71d3bfcee291d6404889bf2ea9fe084f3903b9f87ad8768d109b"
    hash21      = "cb74a71be78a64098e2cb0fbdfa5251cf4a547d42c5da9587b133fa5c6ea1076"
    hash22      = "1408effe0e9142d7866e7ac49da24977ec29e150ba66b796c78e00ee2d6d143d"
    hash23      = "46c6a576a84d084e8af49e080e50e2477e454a64708e423f119162e449396e46"
    hash24      = "61cdffd195f2ac1321525138fc350ecc4e5cc5589d951bb97772a3eeab3b9556"
    hash25      = "c9e18de4dc9b140297f98f92f8f8e9f606e5b2589302a5fb06fb1f72d6a16c1d"
    hash26      = "80b5ea59b06301fce77c7afe51728856fff9ea5a7b5175195b9aa2f774dc9e3c"
    hash27      = "c92307b96023da49576765c4f06fcbb718d874539a0b27f789fb2bc6195b5041"
    hash28      = "c78cc7e7b537a31f5cc908bd57662b43ef00728f437b80bbed2c7ce2fadbc232"
    hash29      = "bfea6ca3ee9698966668439f5f2becf9196631829235d096f7bb1387f87a9cfe"
    hash30      = "37a2221f960b6a678193ac8bbfc1ef349765566db7175d6df1dca3d7dcada138"
    hash31      = "abfa01ef5615c807d0334320b76aa59077c358eee80fc39ce7ccdd7d39bec274"
    hash32      = "80e1ae1d7f73431ea6d012ecd6666c34c7b3607fb0abd76038c8e1f0ba719a80"
    hash33      = "76c6b69edac497f6f825977595ab6d8c4ebad509ba6f48b5bfcf77bf95cf4328"
    hash34      = "b7f1151a259f77ab7624981d7adf8549d9b2fe0c7ab796104b0794beb8bdb9cc"
    hash35      = "c4dae5cc6179c64b9529e94b12b7344eff2751212ba3f92b01c056f415ff626d"
    hash36      = "f9881849790e28161bb225f159b4e2ecdc98f9af11c8d53a5a8b2fd1c98017d0"
    hash37      = "2c02c980a15766ebcca241b93192799485466fc7e425165e1e544fac4d68bcf9"
    hash38      = "96562672a8f6cdaabe987e3606d05f52cd5aeb3f3974ad30ca192a431cc8959a"
    hash39      = "8fcac1f302109297cf6702df73138ca426755e415c8da3920bdcf16af40cac56"
    hash40      = "94e88cdcbd2135f9d4d96d02016b8ea4355ba33943ddf6c7e8fcbdeb47d3ca91"
    hash41      = "eab285dd9393fff521b64ba0b8414f313f5af6824b7245ae56711f58dd7a7787"
    hash42      = "a59ac60e4a021de922d6478deff59fae877049ac01817706f15f61ae40a9e9ea"
    hash43      = "c796daa2aa68d128945c6f687b7d958eab9a6ae395b9822d919d6ced26aec50a"
    hash44      = "863177ae422227dff51889a95ebbaf2c3b0b3e227b90382a7fa302fb22208125"
    hash45      = "2d70db3ece7ba27aefd8e8e68c6b6e0b5055ebec09463091cb89926a0b8070f2"
    hash46      = "eb7ad7e84e094bedc7d96fe283d5585fccc46d5ef95201fea9494e35cd255e90"
    hash47      = "aa0e745afa5feaa7c4cd86eafe9fa4c05120457f1c2192c8534ced76d3ef39db"
    hash48      = "6945519d8242e736f55e4646cf7d54357787dc8bd8107c72c07ad01e490f4679"
    hash49      = "3f51591b32139e815616fdbc5dc693836ee4a476391de3b524152469fea7c076"
    hash50      = "20354704114e153714c250d8730b4f4506f616b6d8e9e1b7b6a762e65c5011ea"
    hash51      = "ff84953d0b48c45a0b122f5be0c4a32908bd07d4d805701ebe34bcf6f0e0510a"
    hash52      = "f57690e72f5c4be80b9c63921f292e2fec67c62bf2c9e94c6de4d616d43bbde5"
    hash53      = "605fef285a99fd32d3a4a89d9b7a348be0706de9f6244cafba4ce3e1809318ba"
    hash54      = "6d56d045ad1a764de4aa0e2bb5b536a3892e6605fa2d5870056a4eaa10a89ddd"
    hash55      = "15d2e6659f4fdd45531db846ed2b907af778d3ed0e38ccfb2f39e59d90d9152b"
    hash56      = "005b4d5f4abbe51854381f9adf14dc7974375462a4733c5e5f7adefe66d5d5b3"
    hash57      = "b8d86e3d4762273f7fd259a2b885c74956f5b81200c3a5585e34ea55daa36370"
    hash58      = "3e5ec444b8b9866879b6f8419e66713b0a436eb38f91d7d432a92dacfc097fc7"

  strings:
    $s1  = "date of the order and shall continue for a period of 1 year. At the end of the 1 year the programcounted as \"n\" processors. Fo" ascii
    $s2  = "98052-6399; or visit microsoft.com/info/nareturns.htm. Time, a person is defined as an individual who is charging time to a proj" ascii
    $s3  = "receive information. You may not always receive a separate notice when they connect. If you choose tossional Users 2003 " fullword ascii
    $s4  = "the Healthcare Transaction Base program, only the processors on which Internet Application" fullword ascii
    $s5  = "date of the order and shall continue for a period of 1 year. At the end of the 1 year the programcounted as \"n\" processors. Fo" ascii
    $s6  = "s use of them, or to try to gain access toou agree to comply with all such export laws and regulations" fullword ascii
    $s7  = "and you and Oracle agree to suannual report or the equivalent accounting or reporting document." fullword ascii
    $s8  = "98052-6399; or visit microsoft.com/info/nareturns.htm. Time, a person is defined as an individual who is charging time to a proj" ascii
    $s9  = "some features of the software may connect to Microsoft or service provider computer sy" fullword ascii
    $s10 = "5. Trial and Conversion. Some or all of the software may be licensed on a trial basis. Your rights to use in, the courts in Irel" ascii
    $s11 = "5. Trial and Conversion. Some or all of the software may be licensed on a trial basis. Your rights to use in, the courts in Irel" ascii
    $s12 = "Server Enterprise Edition and this program are installed and/or running are counted for th" fullword ascii
    $s13 = "date of the order and shall continue for a period of 1 year. At the end of the 1 year the programunless other terms come with th" ascii
    $s14 = "date of the order and shall continue for a period of 1 year. At the end of the 1 year the programunless other terms come with th" ascii
    $s15 = "and in any dispute arising" fullword ascii
    $s16 = "ether or not the individual is actively using the programs at any given time." fullword ascii
    $s17 = "3. Australia. If you acquired the software in Australia, contact Microsoft a single server or multiple servers, regardless of wh" ascii
    $s18 = "date of the order and shall continue for a period of 1 year. At the end of the 1 year the program" fullword ascii
    $s19 = "3. Australia. If you acquired the software in Australia, contact Microsoft " fullword ascii
    $s20 = "3. Australia. If you acquired the software in Australia, contact Microsoft a single server or multiple servers, regardless of wh" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "59a3c47c91dbf54ce83f3440840df3f4" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b21efcf9-a97f-4d3f-bcb9-1ba804b32e52

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion