_Trojan_Autorun_Dropped_Generic_Dacic_06B5CF0E_A_3A6AA980_50_2_T_502

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_50_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_54_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_56_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_57_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_59_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_60_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_66_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_68_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_69_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_6_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_76_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_85_2.vir, Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_20_2.vir, Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_2_2.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_180_2.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_184_2.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_187_2.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_357_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_186_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_187_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_191_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_204_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_217_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_218_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_225_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_231_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@a4YD!Xe_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@a4YD!Xe_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@a4YD!Xe_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_9.vir, VirusShareTrojanInject36111_38_1.vir, VirusShareTrojanInject36111_46_1.vir, VirusShareTrojanPWSMSNSpy342_1.vir, VirusShareTrojanPWSSiggen33533_1.vir, VirusShareTrojanPWSSiggen33688_1.vir

rule _Trojan_Autorun_Dropped_Generic_Dacic_06B5CF0E_A_3A6AA980_50_2_T_502 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_50_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_54_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_56_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_57_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_59_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_60_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_66_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_68_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_69_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_6_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_76_2.vir, Trojan.Autorun_Dropped.Generic.Dacic.06B5CF0E.A.3A6AA980_85_2.vir, Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_20_2.vir, Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_2_2.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_180_2.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_184_2.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_187_2.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_357_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_186_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_187_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_191_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_204_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_217_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_218_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_225_2.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_231_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Y@amFE@@j_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@a4YD!Xe_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@a4YD!Xe_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@a4YD!Xe_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.LzZ@aWELKOd_9.vir, VirusShareTrojanInject36111_38_1.vir, VirusShareTrojanInject36111_46_1.vir, VirusShareTrojanPWSMSNSpy342_1.vir, VirusShareTrojanPWSSiggen33533_1.vir, VirusShareTrojanPWSSiggen33688_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "6c995db087c47293facd316b3aae0348829bac5282ecd7f08d3b59dfb1701ef8"
    hash2       = "e908818f83b2529d55c9079955b3c2192312ca4410b52efd0456019daad1ddd4"
    hash3       = "4fbb48f4a96eff7bb6643e29e57d6c9fb324f7f00849f87645d843a5abad69dd"
    hash4       = "fea992c752a12aaabf930103550cdf03dc9a97079211cb8e7f9e345c73eae4df"
    hash5       = "8e4f6b82aee747b662a9f88af10f828f5989bcfa3213e136d67d3418baae194a"
    hash6       = "cafeb5be4ac29b9ac7078e1aaa245510ddb734700d4a3b5e541805d99d5c8b84"
    hash7       = "7295f2d96ac3013c4a20a000616a04fd8d1e0ddfe1ec7520b6b31c7696f2b9f7"
    hash8       = "c4597ec6efdc517a761c3d9e0dab3d4e243003b933ef33bf2283cfbc4e70acd9"
    hash9       = "2e3feb8726d2fa679dd5958baacd7251ada0605bb3a7884aff2f564a8e8ed352"
    hash10      = "9ab5d45335d7e33c9432d5dd36ccfaa9098d1c2e91841c655ac9e27be0bfb386"
    hash11      = "918d5123e77e6f0b7189ec8b0da7ba63e06a882fdf6a48210f6c84dae5a2d18b"
    hash12      = "d7015f5f4d0e14814d0a6250c775e9516e4920f1b049448eeeded47eb2fff552"
    hash13      = "951eee62f9678f774f46b2b452ecf66cea62a8bee377fedc9c787ec50e339170"
    hash14      = "ad8daadd898e47da8966ca32d90cd6bbd910a53d89b981aa434e08448b0d9645"
    hash15      = "22ce5c4c7ac68256b9aa6805a89c2e8a91124929183e8428cd87d8faa6cef1cd"
    hash16      = "364347ce5826a20988540caea0596f003ca50e55ed102d0cb848c0dc49d32a5e"
    hash17      = "6ab7801a80f78c2586d0bd611807f3f8229300a32efc7b6793d7b2a8d1d28371"
    hash18      = "f873c1a418170113f79e3356c5b8285beab0cc44428c1887194c268615ff19d3"
    hash19      = "53bda7d1a67c8450c48e65ce381304832284fee73a8ec3cfae817ce86c0bcc68"
    hash20      = "3b479f843c06d445a4370fea820a5fc1c07cdd25aeef0ff6630b52cb56d58733"
    hash21      = "01fff546c7618ba006ccc036f042527eb5eab22b7700c66db61970d79a7942a7"
    hash22      = "86eea5405b09a3100a40691d3e2ad7b1d4f7a9f0796e14b8ecc5c381bc80d3ca"
    hash23      = "faf0657a5febd4dcbec532ce86d4404fd9b2970189e5f8cb6dbfcbb59833f072"
    hash24      = "929becff05110e05a4e850afdf8c60ef29e26b44fa0bc38adbb62d4a96ef49a8"
    hash25      = "6b057b128b1429ba9438f1101fd00d68171940538d47fe959831a8cc97165c67"
    hash26      = "ed763af779b24f8b2375a8d8f99092c23624df35af622b7d0fc2ff02713d4c38"
    hash27      = "27dd2e1a58647dc4d53667d73d28ac8e78e6d470f72ff39124545685053b5a65"
    hash28      = "1103afd5227acee00608a684ff9bb6e03204fe276a329b91be213496c1c920b7"
    hash29      = "430c78d59f78e7829fd7fe28bbc203cd8bbc650a8fc0590e690f52cf6b656f46"
    hash30      = "dd3ad8c278e2a5455b28b04353ee3ed879595c10ed06589370061280570927a3"
    hash31      = "cf6038ba1a20b442716b27bfe818e184c6c1b7f431624175242933d27582c7ae"
    hash32      = "e6f81767f186f80d665a2ea6f81aab869a529249610e42b003909c07ac81ac49"
    hash33      = "d8f0f7e72ebdb4a798f643a4638fcdc03cce942b492c20694107c1114f2a6b60"
    hash34      = "3c2e90a49086440409bb2d73343f33f2e8f16b2b916ab5670ba8afae8ad740f2"
    hash35      = "a988a9524488eed7cefe9b5dbe4f71dc039e24b42840b95cfbaa27cffeb0af7c"
    hash36      = "07cf1a8664d05ce7f62767d3af137d5bab0e48ffd461b4a0aed3e2149d291d7a"
    hash37      = "61a5abc25ea5501dc4d6fe9113f93ccbebd199a76d0429afa0fe040ae4a5b15b"

  strings:
    $s1 = "C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\xutility" fullword wide
    $s2 = "C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\vector" fullword wide
    $s3 = "C:\\Program Files (x86)\\Microsoft Visual Studio 10.0\\VC\\include\\memory" fullword wide
    $s4 = "gvector iterator + offset out of range" fullword wide
    $s5 = "std::_Vector_const_iterator<class std::_Vector_val<class std::basic_string<char,struct std::char_traits<char>,class std::allocat" wide
    $s6 = "std::_Vector_const_iterator<class std::_Vector_val<class std::basic_string<char,struct std::char_traits<char>,class std::allocat" wide

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

be9faeec-1bf4-4152-ba4b-c1de821a5ef3

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion