_Trojan_Danger_Gen_Trojan_FileInfector_mmJfa0A48Fd_Trojan_Danger_480

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Danger_Gen.Trojan.FileInfector.mmJfa0A48Fd.vir, Trojan.Danger_Gen.Trojan.FileInfector.mmJfa0A48Fd_1.vir, Trojan.Danger_Gen.Trojan.FileInfector.rmJfa0A48Fd.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_110_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_111_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_113_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_30_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_38_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_46_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_58_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_59_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_62_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_63_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_74_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_75_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_83_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_84_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_88_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_93_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_97_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCXl7mh_5_1.vir

rule _Trojan_Danger_Gen_Trojan_FileInfector_mmJfa0A48Fd_Trojan_Danger_480 {
  meta:
    description = "datamaliciousorder - from files Trojan.Danger_Gen.Trojan.FileInfector.mmJfa0A48Fd.vir, Trojan.Danger_Gen.Trojan.FileInfector.mmJfa0A48Fd_1.vir, Trojan.Danger_Gen.Trojan.FileInfector.rmJfa0A48Fd.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_110_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_111_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_113_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_30_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_38_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_46_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_58_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_59_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_62_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_63_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_74_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_75_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_83_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_84_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_88_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_93_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_97_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCXl7mh_5_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "882582dbaeb47ffff27b47f45698163207d162e9ca4b9e850b7b2942c5a23391"
    hash2       = "1f2be54e2c871e7d4f924c2dd97a4de43e14646e63f28b297b64088c6eac9fbd"
    hash3       = "97506a60592d0e39f5c54e377cfdcd40462a87e3aa6fba628f469a32a5bf8717"
    hash4       = "b6a142ce70b0458a775ddc4e3332ae9e43058855ee63729002c8d300ac946717"
    hash5       = "a73629af9f2ed6b832477bbf8b0e5562f155f664cefaefad1be7e1143630a290"
    hash6       = "08d1b509451f00201266d1ca734cf8ae37fdeeedde7a1a4550e0750e9e3316a8"
    hash7       = "a8da8312c635607907b65885911dabbe8ad25d74208f0a022cf51f4e80dc0b7a"
    hash8       = "3cf928d26044a32ad5809b218534724f82a267eec3e4fc259a13d6ede6d58f05"
    hash9       = "4ec37ac989a975bfbe6a5da3573753a326ee660a4bf2d773157c997ae575919e"
    hash10      = "69e0e3f6b4fc2a0317f129a267ddc83af6e67344211a7c6fc288a2a483d50b9f"
    hash11      = "2b40f48e7d64c08b6a3ad320762c6cd464e5da7c43a009587ddd229c949c833b"
    hash12      = "4c24aeeced6dfa8b42c54c1141a929ff0448262dfe7ed5a0409ab876000c72ad"
    hash13      = "54866da6b82e8a6e528a5c5dca451b9650212df7eda89928ad2e2e7db1d54636"
    hash14      = "aaf81e9d2ed26f6f4742617225c64c12fa60b6b8f32c34be1433c42735cdb51b"
    hash15      = "edde7c2b7f98c16e1cf6881048de53220013c7c3a9b7d18f796ee49dde5f0302"
    hash16      = "5a0e0923c14aea4417d2196b713ca006f768dc2374fe576ec7af09d84e162d65"
    hash17      = "62019e5e7201ad4cd5e6cfdfade351359cb1925ce6a6338fcd77c2896fce3070"
    hash18      = "66c51a47aada5d1164dc1039e0d03e5f493ab7fbb53cf9ddcc861124109b6d7d"
    hash19      = "f9244f4b7a684124a102edfce891b89d734273a5d6071fbd117935e343f82545"
    hash20      = "d306b5fd3cdcca0b45bdf95586a7a0da369d543506d3f8a82cf89a626646716b"
    hash21      = "b376a5f00c064a21f3afeb6590cf01afe4f5cc7f5e7a687b122b9b1cc0488573"
    hash22      = "80f6adeff8ff98ba5a79e03d03858124102cb2f684913f966792a18882b1fd4e"
    hash23      = "4a23cb28fe1cd87e228be49b8e73fa6eda1475f427575b3f804b7f169f6731c4"
    hash24      = "2f1695847f534c8d1bd29b5b4fef3f9b1a358551eb8fc80319fea2c0ad790cee"
    hash25      = "02f469877277b154f4b41e0d2fa0a1f2961926df881210269612dca6bd6b80d9"
    hash26      = "b7ee4b7b12c6dfc8e90ae251bc9aeb1d20a4fcb0c5da0e879d273933728fce75"
    hash27      = "fb15d9454d5d86c887387284f97ddeb891dd32633b71c22ea3dc4840a82083ed"
    hash28      = "df112e32296232cbbee9e0da6b4d40659604b654de9f65500c97a7576c0a0060"
    hash29      = "d844995b47ab1f9d1a95b909e382380afa062a1f0521122870999b6bbdc90d84"
    hash30      = "69bd9416563472f6c30ecf98e0f5e54b0b4381fe116f5a0f115411d6add8a794"
    hash31      = "60976c3d92e1deafd81517f8425a7a29aa0aaa563fd422c6e2bcd728072470a2"
    hash32      = "31699dad0b72c779e2dc963652b61a052d26389015f44a601e9751f0b2e1eca7"
    hash33      = "63ba3767ff03f970b667891a101091818f7b4f6ea792bae3b40116e1f204c180"
    hash34      = "532ea3eb7e5bea7af20c10ad39e839381ae7b41c3170c798958a0b9f1f9521a8"
    hash35      = "153d86b47c4580140f5d6a4cac852cf51eb861351beb34652f337095c5be58cd"
    hash36      = "b575fd5b9fa3eb4cdf5787bec9d27cdf79214c6f8e8dec0964f1a83d66d5a071"
    hash37      = "b4404f0496e5108ce3d18b2eeaf6f8f975e64ddc74a369183d05f545f63e9b72"
    hash38      = "895eb70ceb98f21f7571958adfb4a3a87846c738cd4be3fac45d49fa2d86de0b"
    hash39      = "a81480ffec3626872fd4081b03a68e966c7479b3880f450f6f64d6fb67f79619"

  strings:
    $s1 = "End User License Agreement for use with Microsoft operating " fullword ascii
    $s2 = "system products only.  All other uses require a separate written " fullword ascii
    $s3 = "Roland GS Sound Set/Microsoft (P) 1996 Roland Corporation U.S.  " fullword ascii
    $s4 = "Copyright (c) 1998-2000 Microsoft Corporation.  All Rights Reserved." fullword ascii
    $s5 = "protected under the following copyright: " fullword ascii
    $s6 = "license from Roland." fullword ascii
    $s7 = "The GM.DLS file contains the Roland SoundCanvas Sound Set which is " fullword ascii
    $s8 = "The Roland SoundCanvas Sound Set is licensed under Microsoft's " fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

019c16f4-d2be-4aee-8547-f0d0b21bb841

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion