_Trojan_Autorun_Trojan_GenericKDZ_94847_250_1_Trojan_Autorun_Tro_494

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_250_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_351_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_455_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_80_1.vir, Trojan.Autorun_Trojan.Ransom.Doboc.A_1_1.vir, Trojan.Danger_Dump.Generic.Dacic.1A48D031.A.3287DE35_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_63_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_139_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_171_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_193_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_213_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_267_1.vir, Virus.Danger_Gen.Trojan.ShellObject.s8Z@aGRF3ml.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aGRF3ml.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aGRF3ml_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_9.vir, Virus.Hijack_Trojan.Agent.DQQO_328.vir, Virus.Hijack_Trojan.Agent.DQQO_429.vir

import "pe"
rule _Trojan_Autorun_Trojan_GenericKDZ_94847_250_1_Trojan_Autorun_Tro_494 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_250_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_351_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_455_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_80_1.vir, Trojan.Autorun_Trojan.Ransom.Doboc.A_1_1.vir, Trojan.Danger_Dump.Generic.Dacic.1A48D031.A.3287DE35_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.14_63_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_139_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_171_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_193_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_213_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_267_1.vir, Virus.Danger_Gen.Trojan.ShellObject.s8Z@aGRF3ml.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aGRF3ml.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aGRF3ml_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.s8Z@aGRF3ml_9.vir, Virus.Hijack_Trojan.Agent.DQQO_328.vir, Virus.Hijack_Trojan.Agent.DQQO_429.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "fecf4c746138b4667e988a88a54e7cf0c7ca37f266dbe1621cc783621c7747e1"
    hash2       = "72daeb1ec7398848c1666db7e5e68b99f96c873199facb33a9be1ce632b5fdf4"
    hash3       = "3e277a38abf864b096c9a64bfa9d55902ea7f53b4ed3f51cf82662ef5f46d337"
    hash4       = "2b49d97af0a62d766d6579ed08d691ef2409613b767e8b0f9e71cc3d86a377f2"
    hash5       = "3dbd22b62800bac31e8f74aca201a25514adb19d4b188c65939c1e690f799345"
    hash6       = "f85fde715c2f7efa246eb815b8c2af0949e9a0f243d60a0add165eb1a6f6e3fb"
    hash7       = "9cda9b8f60d9c182694b843700e0422895cf94a2820e2b0439b884d4c8b2bb4b"
    hash8       = "dbb610eedff30be6f393350821bb0ebc2afdb5c8349bec912213bc3ff86f399d"
    hash9       = "4824d371d906ba83652d10f3c1e100ff161adf69f0d5227a8fccc1574de1d359"
    hash10      = "9e8f78f93f440634a9138c5e89b7832e096205874ef81f5c2e1d239c68d8e5bd"
    hash11      = "8fec92e20b34b2cde018c6300ece00253b768bea2b59d84fb3aed0114bd12546"
    hash12      = "72cedcff00198e79fba15c5ac0730a80b9ff1b6db94f60489fd241e8c8fd87cd"
    hash13      = "57bb1161710c664e4ec4d6e164fca2ac75a59b00b99240b7825891b812edc2d3"
    hash14      = "475b05722d14c0baad338452a5ab74bd65c19f1d9ef705ebc2d39fa69ac61a57"
    hash15      = "5729411325d856b4ba15012614123ec3410fc4fa40dec1b4a1a3f49ec6155a87"
    hash16      = "a0c354f39a93f8625bd74a33b2a432f0ad8fdf7dff5c3422b78e97f3c16bc54b"
    hash17      = "aa594f70a8d91803d89d98a8a2615caee3dc4e68066db5059dfa5ae6e8e9598f"
    hash18      = "b6f5ea22d69d0b9b927fa0a042387e1c42e9194e3b6e31f8c102415d8dc54562"
    hash19      = "1d739697dd4d60c9867b0dd653284f44dfe0ac18ef55ab7631c39836a31ac745"
    hash20      = "5ff58266c1782b39a9bed08c660fb24227b72a8bbfbbc4c0cd27075c5b2c99a4"
    hash21      = "ad0016ec986db765d2ac1c408db7eeb3e0caf3c5bd2c5ee8fc8e10c912576eb2"
    hash22      = "c3aeee1821571cf3b37e3af33870ac6a0b9445f9067f16592a7f4103201018e3"
    hash23      = "eeed9686bd5b0fa7f914463fb23077fe54400a3b73b56e0f87bc37116748ae6c"
    hash24      = "871aa7aceeb1e635b298a5a277dd41e5c5942fa20620229d18bdba7d14767805"
    hash25      = "6aa7a856c1a0cb760282e00435c9209ed90131da348d80c8bcb4e6e8e7f8a0a8"
    hash26      = "2834c7c36da94680e57085ff112cac1dbb2855fee64135ab2e4d8aab69ab0bed"
    hash27      = "0b6e4a9372099b54ced216dea2308f3a39f14f266077e5e290086ec07c4ad00a"
    hash28      = "a5b6104a840359a418c328e87fd057e103192689d4b4ba56575070bebf120cf5"
    hash29      = "5d41d8cda366535b36a2e448757ab880d2162b131f361967992f0f116941ba83"
    hash30      = "7bb98e1670be19cba8727481802dfc5421cbc2dfa8a63886556735fc16ed0a2d"

  strings:
    $s1  = "Cortana::Sync::SyncManager::RegisterPeri1 Year Subscription: A program license specifying a 1 Year Subscription shall commence o" ascii
    $s2  = "Cortana::Sync::SyncManager::RegisterPeri1 Year Subscription: A program license specifying a 1 Year Subscription shall commence o" ascii
    $s3  = "MICROSOFT; via mail at Microsoft Customer Service and Support, One Microsoft Way, Redmond, WAthreadId" fullword ascii
    $s4  = "lineNummust be measured at the multiplexing front end. Automated batching of data from computer to computer is permitted. You" fullword ascii
    $s5  = "$M in Revenue: is defined as one million U.S. dollars (Seven hundred and seventy-two thousand four hundred euros) in allallbackE" ascii
    $s6  = "order and" fullword ascii
    $s7  = "$M in Revenue: is defined as one million U.S. dollars (Seven hundred and seventy-two thousand four hundred euros) in allallbackE" ascii
    $s8  = "s confidential information. You shall use the TRMs solely for yourontextName" fullword ascii
    $s9  = "How does Microsoft use your information? Microsoft uses the information it collects through the&" fullword ascii
    $s10 = "orders during any 12 month period.t" fullword ascii
    $s11 = "Microsoft Corporation, A TTN: LCA ARBITRA TION, One Microsoft Way, Redmond, WA 98052-m" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "3a6767c6f133c8168def335226f86424" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b5400554-5137-4afa-8c0a-9dce7e3094e0

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion