_Trojan_Autorun_Dropped_Generic_Malware_SF_dld__BF6D7908_20_1_Tr_459

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_20_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_144_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_156_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_278_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_2_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_320_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_36_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_388_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_406_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_42_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_457_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_476_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_484_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_493_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_518_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_520_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_697_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_704_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_722_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_175_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_27_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_315_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_383_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_415_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_455_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_488_1.vir, Trojan.Autorun_Trojan.Downloader.JQXM.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_148.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_162.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_9.vir, Virus.Hijack_Trojan.GenericKDZ.98388_104.vir, Virus.Hijack_Trojan.GenericKDZ.98388_140.vir, Virus.Hijack_Trojan.GenericKDZ.98388_148.vir, Virus.Hijack_Trojan.GenericKDZ.98388_186.vir, Virus.Hijack_Trojan.GenericKDZ.98388_194.vir, Virus.Hijack_Trojan.GenericKDZ.98388_208.vir, Virus.Hijack_Trojan.GenericKDZ.98388_36.vir, Virus.Hijack_Trojan.GenericKDZ.98388_79.vir, Virus.Hijack_Trojan.GenericKDZ.98388_82.vir, Virus.Hijack_Trojan.GenericKDZ.98388_93.vir

rule _Trojan_Autorun_Dropped_Generic_Malware_SF_dld__BF6D7908_20_1_Tr_459 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_20_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_144_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_156_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_278_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_2_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_320_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_36_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_388_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_406_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_42_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_457_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_476_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_484_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_493_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_518_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_520_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_697_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_704_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_722_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_175_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_27_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_315_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_383_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_415_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_455_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_488_1.vir, Trojan.Autorun_Trojan.Downloader.JQXM.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_148.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_162.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@aKrr!2b_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@amCvSwc_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ame9q4b_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.u8Z@aqsS8zj_9.vir, Virus.Hijack_Trojan.GenericKDZ.98388_104.vir, Virus.Hijack_Trojan.GenericKDZ.98388_140.vir, Virus.Hijack_Trojan.GenericKDZ.98388_148.vir, Virus.Hijack_Trojan.GenericKDZ.98388_186.vir, Virus.Hijack_Trojan.GenericKDZ.98388_194.vir, Virus.Hijack_Trojan.GenericKDZ.98388_208.vir, Virus.Hijack_Trojan.GenericKDZ.98388_36.vir, Virus.Hijack_Trojan.GenericKDZ.98388_79.vir, Virus.Hijack_Trojan.GenericKDZ.98388_82.vir, Virus.Hijack_Trojan.GenericKDZ.98388_93.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "49276086918cb3a71c7c4b13984b51aaa5684bdcf6f81728be7c28d77b32b49c"
    hash2       = "859bb8400e38b6ee4c97a5648f38c25edcdc6e11f36540a7338d6132b3306e48"
    hash3       = "336be512a8bf625cc7b3f7fe21df9c1e519e4367fa4f2d9ad61c1677c8257045"
    hash4       = "cfc52ed530070606dee7c8b4fd2b6c0ae3f959660da5a25a2a27f337435f2d6a"
    hash5       = "59e199c9be7a27f93150dee7b9646a705af96afdad79d0f55b0c98e9cda298e1"
    hash6       = "9b2e1b5cbff033a098d05b141adc1b3c67d38c06ea0691da8e56c6e890ffd9a8"
    hash7       = "083187176ff0da482b60ffd37fa5e0d6b1f0248dc229ec4b964da3a3ad6b5b1d"
    hash8       = "9274649d777364a9389af7994991bb81c7ebb4f31c8370f885ba9d3464227410"
    hash9       = "9cbbd49b25dc6adbb7d34af85664783d0e73614c42198e65722147cbc779d554"
    hash10      = "e0c0c8a8af4fb511597aaaa5688cd60162180a6605216db97d5f3db5532e4f53"
    hash11      = "fedc19a7d07850c0de8921f5a7bdff34b3395c3324a07199fa89f9f81e9f388a"
    hash12      = "5c7315997f77586945eb4c35d8d94553c8f9477a1bdb56c4f64593b14581eaa6"
    hash13      = "0597ee0df39586ae33b3e230141c7086ae0c4da541ad597f70d5f3cd42689318"
    hash14      = "28819342d57ee1438628bcacd4d9b418ac38af114053d4121ffff7f205fc3612"
    hash15      = "8135697db3d13e24c44cf136a0952144722cd5580a4dc5b8047a502102555a2b"
    hash16      = "dee372c9f1fff2571fa179415a8cf53e1b6d3a82b82d977e6625e46a274eae9b"
    hash17      = "4de3bf884182d96d04dac09f32c2073bcc6912781269913c7f068b3dd31d93fe"
    hash18      = "d51b6d77270799ba9e54293995086beafc734da40fd8fcc307dd6fac3b443dfa"
    hash19      = "20954ba2c4df94704dd4aed7907f3616cd776707c7c88779fe5e3e4bb9539b6b"
    hash20      = "ee92473e0b7187b7cbb454cd8dbb5e9107c237633dd5f0fce0f5a9b7fed6aaac"
    hash21      = "a2449b1b9d27b01e5919b0b415c24ddc42808d69f965ab83e852c554ca3f56fe"
    hash22      = "d6b1a30f7d8d66feb5b5d1cec9e59556a3ca633f79cd7cf6d0e01ea1118cf2ee"
    hash23      = "a74b6719d52ad65a2d104aa0f4eecfb481eb00b0069c23726f66e2f2ec4b70ab"
    hash24      = "aab17d2bae747adf7bc36893c3e26e41f8a9e6d68c147e6974486fa981b0a953"
    hash25      = "878b63328797082ef1aa537e5c7a0be8e797fd28bfa971d4cc7fd50e58ed640f"
    hash26      = "590086400dfc854cdffb90356787d31bcb97c661527af469419553d9017b668e"
    hash27      = "5a324dd3391d191f1063dee9cd4021e6c86392f6887f1c362095e00b75b59989"
    hash28      = "91a72f10b62a373ecca9d7b2abbc9d77a2028ec8f362e7f700958c3f3a2c5c29"
    hash29      = "64bc56347feb9c5b8ac7681c582130454df49a66b512bcce5d4aa2045bc23459"
    hash30      = "6246dac00f5a3efea1bf85f57e2e5e91c1bd75a67f00e8532fd67b607761d185"
    hash31      = "bb9d943c9cb050f2616c46fb87978c88518ea33f9a7f23237a10df0354bf8f1d"
    hash32      = "e7a0df63f67c75d0423ceee3f85f892b828a8bb624aa5833698d2309e23a8546"
    hash33      = "30b3527b4a9fdaed123f917be73c6388e6d0f940d536e7efdfc7aad404f2de61"
    hash34      = "ff8d58018d8052bc905a4f8b7ba18d0e53a6df6303f0e0398c526a71b66bed78"
    hash35      = "bd11416d33c3ed69754974398f0d44a91e60eae2f5dc5055299d41b0de94e577"
    hash36      = "1b7bdb1b6158624ceb54a83d3015e789110e704066d1be458e61f5d4a9b05a51"
    hash37      = "b965f301d6ccf3d0f0fbb0725dc0fea447e9e93f2ee7f55f7e426519007b368f"
    hash38      = "30af87aed59063bea740eba603cef0092e9c0e69d47ad297795f7de9aeb127da"
    hash39      = "9bef7e94dfcae79e54fa5055cb610489cec49a0cfd89d58d00abbd657c194a22"
    hash40      = "9aefc100c8cafcaa8592b19658d05078f9fc93765628e624028e75d6d6803bde"
    hash41      = "7892b46256f3a626e9777528a53dbd583b919d2f9aab52262ac1b066759a123e"
    hash42      = "a103e37c4ccb759768d1bded7a7ff6dbd6de1d21f9a0cc6142d1d89fd37be333"
    hash43      = "2f9f34836e74f256a2d7224ae035ec1275bda9073c5ca2317619b8e091272db0"
    hash44      = "6adffdba6151744a3124d828d31cfed99da7099b08306f8de88199918a0fb600"
    hash45      = "bdba8a5741f8794c31d852b57b1bdd3150b4f8d75161f20945d7af17dde961dc"
    hash46      = "e82af267c0317f99ef1bbcb793de73877cba3a86b8ec2198ec95f8417d5806ee"
    hash47      = "19a87982831fa09ab588a8b0e92fca13fd3d1092087cc218f929c7bddf3a048b"
    hash48      = "81bca33a3e016e8bd433af900d64d0dc2315e8711956543f1283f38f63abec54"
    hash49      = "59a1f6757f6bc15737f6106973250d696130bdfae8c30e9272d3eeeeba9e362e"
    hash50      = "3ccb6b5686d7d61059ff23a9b65c8c433d552dde41291b422daf2b8a8c078a27"
    hash51      = "95d1025c53f59f8172dcec0509c7318e1256c98a81ab5d855831e688f262588a"
    hash52      = "0903e087359ddbd3731c0799de3bb357ccea6fa880bccb26413f0a59fac85cf8"
    hash53      = "729b391902ce60eb06383da2706f2313ad2b2d2f7a16a99ccb07afc86934056c"
    hash54      = "788d99780fad1360cd4953d919571749b8ed933ff79ca6836987e5550a38f572"
    hash55      = "90612a6dff43a7b32f1973e562f98eb82990943b07c989a36659266f35cb692c"
    hash56      = "635dc45b2bdeb38b357b8ca2648f940b9ee7f6f8959c48d76385b936072c93e7"
    hash57      = "6c3c0c2bb514a79fab500a9f2afd50f9576602cb16a93ae2b7ec21cf4cdd4449"
    hash58      = "4b4adb8274f2c993e21e51b80a647f41158b23beb2811d8042d7aeb93697373c"
    hash59      = "00303d73e2ec37b8f8ab1f5d0765d46860de8ffb8b95f84d07d9d731bc1e9a10"
    hash60      = "b02676ad80e132d644bfff538f9608ffd88119742f882f1dde5091d962d4fa79"
    hash61      = "54181f59487e96ec45a40ef29bf45c961e058934ef8812a7cd10efdfcf69aa8f"
    hash62      = "84e1d03a51fbf8f12743a30fe729f44b3d008a1359c3cc3b07a03af105ba1148"
    hash63      = "2ffb291af30b7f59559c596ebd652d3f841f489bd2ee55371ce3fed420ea4c13"
    hash64      = "0fe37f90b76915517d87bf29fe9e2a499b0e0524a80b6dc8e20ce4e86413f955"
    hash65      = "6da7dc84fccf1a1e4aa005dafe8b41a906656d99557359030d5aec4287d9986a"

  strings:
    $s1 = "Buddy Version 11.0" fullword wide
    $s2 = "Game Over!" fullword ascii
    $s3 = "About Buddy" fullword wide
    $s4 = "Buddy MFC Application" fullword wide
    $s5 = "Buddy Application" fullword wide

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

90573626-9db5-497a-af72-40ed281fc894

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion