_Trojan_Autorun_Dump_Generic_Dacic_BC58E3CC_A_00D7D229_516_1_Tro_466

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_516_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_561_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_582_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_583_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_589_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_591_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_684_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_691_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_700_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_711_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_730_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_740_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_747_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_783_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_809_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_818_1.vir, Trojan.Autorun_Dump.Generic.Mira.575DCBBE_15_1.vir, Trojan.Autorun_Dump.Trojan.GenericKDZ.95048_24_1.vir, Virus.Hijack_Backdoor.Hangup.B_144.vir, Virus.Hijack_Backdoor.Hangup.B_216.vir, Virus.Hijack_Backdoor.Hangup.B_231.vir, Virus.Hijack_Backdoor.Hangup.B_235.vir, Virus.Hijack_Backdoor.Hangup.B_240.vir, Virus.Hijack_Backdoor.Hangup.B_28.vir, Virus.Hijack_Backdoor.Hangup.B_312.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_124.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_125.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_155.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_158.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_166.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_171.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_184.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_186.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_220.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_256.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_275.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_314.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_358.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_366.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_381.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_398.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_44.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_476.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_51.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_54.vir

import "pe"
rule _Trojan_Autorun_Dump_Generic_Dacic_BC58E3CC_A_00D7D229_516_1_Tro_466 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_516_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_561_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_582_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_583_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_589_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_591_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_684_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_691_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_700_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_711_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_730_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_740_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_747_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_783_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_809_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_818_1.vir, Trojan.Autorun_Dump.Generic.Mira.575DCBBE_15_1.vir, Trojan.Autorun_Dump.Trojan.GenericKDZ.95048_24_1.vir, Virus.Hijack_Backdoor.Hangup.B_144.vir, Virus.Hijack_Backdoor.Hangup.B_216.vir, Virus.Hijack_Backdoor.Hangup.B_231.vir, Virus.Hijack_Backdoor.Hangup.B_235.vir, Virus.Hijack_Backdoor.Hangup.B_240.vir, Virus.Hijack_Backdoor.Hangup.B_28.vir, Virus.Hijack_Backdoor.Hangup.B_312.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_124.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_125.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_155.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_158.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_166.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_171.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_184.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_186.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_220.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_256.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_275.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_314.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_358.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_366.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_381.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_398.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_44.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_476.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_51.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_54.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "3559358e75e2eda9b720939e7e760a398ce9a0dd9136bc0d6b29f7182370bdd6"
    hash2       = "5f18effa53ca0d3dfaa7449e10a368afa24697da00a18f24297542b7b1d2882c"
    hash3       = "fafa7ba0cbf8a19f895ba7a8f80ec864eab03c13e3ff74b5a7ad3e118bf7f0f7"
    hash4       = "80ce852b03e7f902271c207e9b9b84f4643536a492257c2fc9ffc7f77f1937a3"
    hash5       = "66d3486e67cd12848bfc4264f53b6db75b0d34e25fe58e221e43237e5658bf31"
    hash6       = "99189460ddece1084275d432123f6219af669de847249ecc9b457a7bb5a87c37"
    hash7       = "2c45b7aae663ad30e98f5e64078ad1fff93d212bf0684e6e704d7e7d8196e2d2"
    hash8       = "7e13183e332305daa8ef30eb44053b8f6d0e3d1af4b6fc8d729f314d423e7859"
    hash9       = "467a35ec424c2dc852f9d89ae6dfd55b75e2dd0db6db117b58e907ae67f888a8"
    hash10      = "a818b3a258a381c83113f935f11a64ed67d67b4f7441538a8f26c7c1d7d2884f"
    hash11      = "04b5b090cbcd80e80c3d729126888590352dbb9dca4887096d3a47caa2f88e75"
    hash12      = "5b3f200e5525cd7115ca9f5b14b145cc41e356964ee4adffac6718d98ce82dd2"
    hash13      = "37e31fa11004a50f02649421c6e1de3d4fe047f63c0e57ca4ee5af9af62effb0"
    hash14      = "ff420f07df3fa14389104405d59aa02e26d1fdb75ebf34ee7f3c79f1a506c8d9"
    hash15      = "e81613df0d0661297cee2cb1c2cd967ceae3605993c7b4c634ed45c282665614"
    hash16      = "74971e388cc9af5f819d7283ca746e7401840e19f9a8b346fa0af859591e3f0a"
    hash17      = "a67c45693bff39177a904d546b12e96aafcb60896066b37fa61fbffe9194e5f0"
    hash18      = "654fc317a6cba8e0fe1f2e45ffa4957880f84ca4314586bd2d868650c90c541d"
    hash19      = "6306cf8874f11c39e79819a75e38059e2a88d68c9739557ec441713bfa083e93"
    hash20      = "81a3b147ab22d9324885ac26f521f63a2ea9fe08b1016be1bd27458ffe04dba4"
    hash21      = "eb31677aafae1eee654ac05ec957f7c8db4ec5951ffc25a4e3bae10e36640309"
    hash22      = "3b00fbd575aa53767906c4a667b506373b7641b705d48f5af48108a79bba8e22"
    hash23      = "2d35da86470d28ff63c233ef81035d9220cdbb03acd39f44a2e23c11dc82eb93"
    hash24      = "9862e1a75c97a3cdd9154f01f54f8d7d32aee43547c1d4e69dc50decf67ec01b"
    hash25      = "ed32d9cbceb58e49783576f82adf12a8b57fea8529193fc9df77067c0a76b891"
    hash26      = "7e08a25e898b0c861ff846a958cb899d7e2815ae185a492b4a153554571e8c3e"
    hash27      = "73f7822bc1797b1c23578075fc0ec775bc3eb6694551647774370ae025e34994"
    hash28      = "96ec382e13e248634293b092c8ce3a5788d29e4972f59bdb2ceb5f74825cecf8"
    hash29      = "8bdf871b5c53bfe02592f085429a4f0bbdb8fdef5945aa4db8fc0d4de5e19470"
    hash30      = "f76ff34e10b7675905a0b0d9877cfa7007b44a693a46f02cbedc8234f9a94c14"
    hash31      = "79ec8e644eab11f1a5e4a6aa2a60804b1afc986048836e5573a4e978c8b8c21b"
    hash32      = "d88852c0975fe6548572fd00b4bf4b013425aaeceeab6e16f3903d185d6ae844"
    hash33      = "caf9916009438837f1a5c8f2d101f9414e5290842f0d912b91d45b400ce6ca37"
    hash34      = "d5bbd4b7f2760404db8c72e842330f58705a0c5406670cbb9cdb245ba15197f3"
    hash35      = "f212da5fefef4112420a9423b747cf29e175d5a71fe69e3cc2a75566f52aed26"
    hash36      = "e8415d962e160caa3531b971acd92caebb21e1f75894b46a4199d10cb9597cbc"
    hash37      = "04c6fc3eb64af5cc2641cad4452e7d6ac1c44256fd8fcffe0192cace2c90440f"
    hash38      = "213ae9322c5821885a92466aed93737f0aaab18c86a4a552ba23a8d2fda36eb9"
    hash39      = "9b213a419639424aebfa0cabe83cf03b365502654824fabcde8cb319efe6de1c"
    hash40      = "f36d1fbbf5087ce84a7e09810bdc5dd9befa11c45b3be8948fec16df905879f6"
    hash41      = "5ed5b9d4f07a0fcb27e874dc492d18b0e2234642e8bc9f652a310955c7fb81a2"
    hash42      = "b2c3bd4cebb0f86363c3e6c11478dd43d2d08f42ecacb4c26076453e8192c9be"
    hash43      = "47f849dff928d9af14ec670da87ca8c5cbc03cddf6d20add41695cf7875500fb"
    hash44      = "867df317e743689e6faefe12fe2acb4b5e75ac3a85bd00d17c7e4729b9ad8835"
    hash45      = "4644ce7b3944e0b113b4be186b37f4afcb73ef23d961b3a9d88c60bac62384eb"

  strings:
    $s1  = "internal data processing operations for purposes of: (a) implementing applications programs, (b) in" fullword ascii
    $s2  = "r. At the end of the 1 year the program license shall terminProcessor: shall be defined as all processors where the Oracle progr" ascii
    $s3  = "r. At the end of the 1 year the program license shall terminProcessor: shall be defined as all processors where the Oracle progr" ascii
    $s4  = "TERMS A ND CONSENT TO THE TRA NSMISSION OF CERTAIN INFORMA TION DURING acquired and downloaded the software online, your proof o" ascii
    $s5  = "TERMS A ND CONSENT TO THE TRA NSMISSION OF CERTAIN INFORMA TION DURING acquired and downloaded the software online, your proof o" ascii
    $s6  = "order and shall continue for a period of 1 year. At the end of the 1 year the program license shall terminOnline Hosting Access " ascii
    $s7  = "r these licenses you may also install and/or run the" fullword ascii
    $s8  = "ams are installed and/or running. Programs licensed on a" fullword ascii
    $s9  = "the end of the 1 year the program license shall termindetermining the number of licenses required for the licensed program; unde" ascii
    $s10 = "am license" fullword ascii
    $s11 = "s not give permission for installation of the software on a server or for use" fullword ascii
    $s12 = "f license is the" fullword ascii
    $s13 = "Policies. Oracle University's Online Hosting Access Policies are located at" fullword ascii
    $s14 = "order and shall continue for a period of 1 year. At the end of the 1 year the program license shall terminOnline Hosting Access " ascii
    $s15 = "order and shall continue for a period of 1 year. At the end of the 1 year the program license shall termin" fullword ascii
    $s16 = "hen sold within the previous 12 months." fullword ascii
    $s17 = "order and shall continue for a period of 1 year. At the end of the 1 year the program license shall termin:~" fullword ascii
    $s18 = "the end of the 1 year the program license shall termindetermining the number of licenses required for the licensed program; unde" ascii
    $s19 = "Program Documentation: is defined as the program u" fullword ascii
    $s20 = "Oracle Application programs. For iProcurement, Purchase" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "02f889462d5b9d177381fc53107a7ccd" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

633428a3-4b40-4322-bec7-1233494655ab

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion