_Trojan_Autorun_Dump_Generic_Dacic_19E38D3B_A_AAF775A0_124_1_Tro_499

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_124_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_186_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_265_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_31_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_35_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_38_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_439_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_445_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_543_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_55_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_563_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_599_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_603_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_617_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_9.vir, Virus.Hijack_Trojan.GenericKDZ.98388_15.vir, Virus.Hijack_Trojan.GenericKDZ.98388_153.vir, Virus.Hijack_Trojan.GenericKDZ.98388_19.vir, Virus.Hijack_Trojan.GenericKDZ.98388_20.vir, Virus.Hijack_Trojan.GenericKDZ.98388_214.vir, Virus.Hijack_Trojan.GenericKDZ.98388_216.vir, Virus.Hijack_Trojan.GenericKDZ.98388_65.vir, Virus.Hijack_Trojan.GenericKDZ.98388_73.vir

import "pe"
rule _Trojan_Autorun_Dump_Generic_Dacic_19E38D3B_A_AAF775A0_124_1_Tro_499 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_124_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_186_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_265_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_31_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_35_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_38_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_439_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_445_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_543_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_55_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_563_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_599_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_603_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_617_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@amB8wPo_9.vir, Virus.Hijack_Trojan.GenericKDZ.98388_15.vir, Virus.Hijack_Trojan.GenericKDZ.98388_153.vir, Virus.Hijack_Trojan.GenericKDZ.98388_19.vir, Virus.Hijack_Trojan.GenericKDZ.98388_20.vir, Virus.Hijack_Trojan.GenericKDZ.98388_214.vir, Virus.Hijack_Trojan.GenericKDZ.98388_216.vir, Virus.Hijack_Trojan.GenericKDZ.98388_65.vir, Virus.Hijack_Trojan.GenericKDZ.98388_73.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "2688a9dbd9b1bb73ca0b51a086a110afdda49bda69578db57105b95b710a4d4c"
    hash2       = "af5a199abe029061a54efbad3f4fea74492926ecbed1cf9ad72a34b13942a6d1"
    hash3       = "67c50fbb2485cf0317ef2e6ceef076d3f36bed82487daf922398f1dbbc2aa9da"
    hash4       = "2b2f91ccec4a64b95db022e7168be83a9e6649e5d5427f95f284d3316d302663"
    hash5       = "9eb271d473604439aa1d4cf618c12f026003992f8e425564d713914ec72c61f8"
    hash6       = "f54f1e9ddca78e385e3db2f71a54fc6daac9f12b1b78c55e1ecdd17a5d4c2732"
    hash7       = "120b0a5884236aa6f2588395222aa343a3361488f0d14b4cd1b7c156064c3a53"
    hash8       = "1cfb52d3e9c84206169ffc0bf1c7a4f4042ef7f35aec2c7385d03ffcbd3fc4f4"
    hash9       = "62af171a989df6115f2b647dee195cae13d78e941a463090a17197531266a5b5"
    hash10      = "97e44a8575b352fbc80f4619e40ab00f75aa978c295a1c8cdd2e205c36e537ff"
    hash11      = "139d9a412aa53b8ec05161575d012af0be4390eed023cf243ae6ff3eb66ce3bf"
    hash12      = "25caed096ae04085ad2c1ddec6f5c18f85179d2d6d5ec3bfd432959e03184e07"
    hash13      = "8e75e43eb160dab362f9c2a5ad7994912a99baedaf29412a235f353cad12b9a9"
    hash14      = "9abdd1bd8b2c68b54d217fe7c105c0ee3ca8ca4072e0562ea045cc8576aab9e3"
    hash15      = "3d87e7f6c975dc9158f1ee731b738638c3305335a68fb1a3f4aa77adf04db307"
    hash16      = "00738912c31d14612b9da3535fa0a1ada749608538f3ab28b1e6ee531b41c97c"
    hash17      = "003b2fb78d787b089b307c2120f9b0ca0d53a59f9258551c6bb5a2849e5eed69"
    hash18      = "2e3a8e881ef588301581654e72689f8fbc53edc03879c4cc15d7acd6d0ea67dc"
    hash19      = "10e01e08efdc858b7792752b986b3c5a7d723e557bc2defe7c9ba9203b987ffe"
    hash20      = "d4c05a99770c9e3db79daf30d1cb30cf39ccea7f901008fb717ad4ee5d97df63"
    hash21      = "a84b9038ad422df5dd86638dce4f5a4d691c5f0cd583ec5744e5cdf17741eab8"
    hash22      = "31eaf65b32571b782e47d4ba30ca52fd91929525870feb4f7d3cdad1b939493e"
    hash23      = "54f91896c703904682ff6cc68e4d2086c4a8a005d9dcca3e9a4a823b47f61c4e"
    hash24      = "6a8cdf87ad026c46b3c5c351089b44de396040e6a89a435d50a3d4e68d97167a"
    hash25      = "4832154f55d014804c8e1117e042d0dae3052145973ab87e515d96fbefa64c72"
    hash26      = "f6a598ade659fd8370f5abac66e70f9be09985b91454d8d806bf9edbb2af0e07"
    hash27      = "0fb861dd14d797ec5fab7413197c8ffc9d22db2b47b8771ac9e741ab8cc1020c"
    hash28      = "80b6bde547e7352f0d2e80229cbf17a111e01598267b227df2e0747593848495"
    hash29      = "beaf28b82801da07848fca11f2d44789bcfcf5ca0f7e159e3f04ad2ee16bd29c"
    hash30      = "1088d998858edbe07483987c4624a717b05a949be45ff11ff922288c56139d93"
    hash31      = "b63bc326b385e84ab777ad10b7cd2d07cd36ae2a0be8b53c672968413995f398"
    hash32      = "5cfa3c50090c98bcf7fd7109684d2666c2876451f6b679cf3fade40a8fa043a9"
    hash33      = "739da33c8231e254eb20ae93ff2e3591aa436d543d3bc3c3f7b5983af1bcc04d"
    hash34      = "bda1fd11bffc5ac80da797b4e73a03ac6e7c8ee4d502aaf1ee20f4109258c61f"
    hash35      = "8e0b38d7d25f4311c0441b7760b8b08fa988a3147186995de2a209bc661e4dda"
    hash36      = "28a5d5d60a855e3b9ce2cb5a4aab0c98dc52109444082f90112a9f3e26368830"
    hash37      = "46f227a4bb6777ec9c14952e0a3f9202e4b0a1f2388084b5af7a810bbcf28ed9"

  strings:
    $s1  = "ALL DISPUTES IN COURT BEFORE A JUDGE OR JUelectronically (not manually entered by licensed professional users) through EDI, XML " ascii
    $s2  = "ALL DISPUTES IN COURT BEFORE A JUDGE OR JUelectronically (not manually entered by licensed professional users) through EDI, XML " ascii
    $s3  = "ALL DISPUTES IN COURT BEFORE A JUDGE OR JUboth individual Oracle University Online Courses (" fullword ascii
    $s4  = "or other electronic means including" fullword ascii
    $s5  = "of these laws, or will be used for any purpose prohibited b" fullword ascii
    $s6  = " will be given the broadest possible meaning allowable under law.from the effective date of your order. At the end of the term, " ascii
    $s7  = "otice of Dispute by U.S. Mail to" fullword ascii
    $s8  = "d terms. There are also" fullword ascii
    $s9  = "1. More on How Activation Works. D" fullword ascii
    $s10 = "ise provided in the agreement." fullword ascii
    $s11 = "MICROSOFT WILL SEEK TO HAVE A NY DISPUTE HEARD AS A CLASS ACTION, PRIVATE dispute, and the relief requested. You must send any N" ascii
    $s12 = "application program for which you have also acquired non read-only licenses.s are managed by the" fullword ascii
    $s13 = "MICROSOFT WILL SEEK TO HAVE A NY DISPUTE HEARD AS A CLASS ACTION, PRIVATE dispute, and the relief requested. You must send any N" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "6d8fe72cd59e552b6ad8b2a0f8595ffa" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

03ec8447-7328-4ecf-bc12-aa70cfbeb478

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion