_Trojan_Autorun_Dropped_Generic_Malware_SF_dld__BF6D7908_11_1_Tr_506
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_11_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_104_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_105_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_121_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_170_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_17_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_183_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_250_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_262_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_298_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_338_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_37_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_394_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_443_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_459_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_45_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_466_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_499_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_510_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_549_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_578_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_57_1.vir, Virus.Hijack _Gen.Trojan.ShellObject.e4X@a8K8N6h.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h4Z@a8K8N6h.vir, Virus.Hijack_Trojan.GenericKDZ.98388_183.vir, Virus.Hijack_Trojan.GenericKDZ.98388_209.vir, Virus.Hijack_Trojan.GenericKDZ.98388_240.vir, Virus.Hijack_Trojan.GenericKDZ.98388_41.vir, Virus.Hijack_Trojan.GenericKDZ.98388_48.vir, Virus.Hijack_Trojan.GenericKDZ.98388_49.vir, Virus.Hijack_Trojan.GenericKDZ.98388_59.vir
import "pe"
rule _Trojan_Autorun_Dropped_Generic_Malware_SF_dld__BF6D7908_11_1_Tr_506 {
meta:
description = "datamaliciousorder - from files Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_11_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_104_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_105_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_121_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_170_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_17_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_183_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_250_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_262_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_298_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_338_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_37_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_394_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_443_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_459_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_45_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_466_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_499_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_510_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_549_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_578_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_57_1.vir, Virus.Hijack _Gen.Trojan.ShellObject.e4X@a8K8N6h.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4X@a8K8N6h_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.e4Y@a05ilOd_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h4Z@a8K8N6h.vir, Virus.Hijack_Trojan.GenericKDZ.98388_183.vir, Virus.Hijack_Trojan.GenericKDZ.98388_209.vir, Virus.Hijack_Trojan.GenericKDZ.98388_240.vir, Virus.Hijack_Trojan.GenericKDZ.98388_41.vir, Virus.Hijack_Trojan.GenericKDZ.98388_48.vir, Virus.Hijack_Trojan.GenericKDZ.98388_49.vir, Virus.Hijack_Trojan.GenericKDZ.98388_59.vir"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "cb4b4d3b4acef01f901ca8dec32211e4a49a9b1f7ebf74fa568b34a6836b0977"
hash2 = "5e324c2892cad1d628282537b49f0959d4214419192029acd338010d982143a0"
hash3 = "8102f749f56804752293bbfe3d412c0ea068758883f4533e762908c9473a3735"
hash4 = "ff34d8ec4ed7cc0b21ab401363e56d25eac3b60f3711e3a2d446e5cf6040c0d4"
hash5 = "02f65084c43333310810c969f1c2bdff38f72549fbfb764852e5f8abb4dd1852"
hash6 = "dd50e65db8b2f6f9b641f0a20e6476c8776847cdd759de50d83d0bb55e2102b9"
hash7 = "8e70e462e9b853441a60aaf0ba583ea829318efeae6bd0654ef9d78e571d5d88"
hash8 = "2fcfb11e3e40d48addbd800c458e0f9170b0b034cf84a77cc9a6a8cacc90dc6b"
hash9 = "40fb5dc60e4114f9dad9c27c8f547f437f1da7cd513d42459deeb5013dc4cd7b"
hash10 = "f2207a1faa790d6a2c5f1f41e3c32e7375112599df489cdfe1fbf03b135902e0"
hash11 = "5ad584a9384421bf2450dc1c9221ef4d0283fd1367891ea84bb3f9d67ba41cbd"
hash12 = "3eb33db024c10863ba8193955105a9579b08e22a72903fee43011ceaf132586e"
hash13 = "084539e41b3ade1830f062283f34bba6975079ce1356d0ccfac753a1a22ca687"
hash14 = "a212579c4fc6d246ecdb60952ea598e996bcde66633b5b29801902ac7138812e"
hash15 = "74ab34630d45c284203c78a053c5589ec9fc7db5aed424ca924fea4aa0cec93f"
hash16 = "0c0b3ad75c3bcdbebec9ed27d2a8adecca0a9a4e5186aa8a3dd9180658a21587"
hash17 = "98cee5107a5fab42c84a3c71129c9e42a1d4545f56afd6a48ef1a37bcbf3d291"
hash18 = "15098e7b2e051c774f5f0d554f07b188d73293cf4b9a74a49ff36c7ed5840069"
hash19 = "27e7c26684d8b1f13f94d63610a3ab979d3ad142513b17e949601bc843000e2a"
hash20 = "cc2f3c4ce62b4cb3f6c3131f2744e3ba67e3277425be0adee1a3fe2866e344ee"
hash21 = "d97dc40ffb1da718910d5c55a4c7693053be7e99e8b8385ea38b39c9f1c99d76"
hash22 = "2be934f20f98dda4590285b19446123165070baa88178158112621f64cdca482"
hash23 = "34c8f6007473fae764867104300dcdf4d186d2864ca1737bf1e4fabce14eadba"
hash24 = "ac0a44cdd615c66a2e8f76b3434fc47bb1427b2cfaff53eae47f788821e4d113"
hash25 = "60b0924874460028dc08bcca17a0671f41f9b4c5ab8799fd77a3acf545940dbf"
hash26 = "b1a3e463cb3db30ea20498428e4d043d10108fa8378679d6f55912a825cdf4db"
hash27 = "fb3195779ccb5915ca94924493d515cb8dee27178197cb1d3748be11002b5a5c"
hash28 = "9a553d62c3d65ca645a168eea406e4f7c6403ba623ca4fbce34c22b594ac11ce"
hash29 = "531b753f61a25c9062c592b7879910f9067f66f42479d4b75384238595e5e4e1"
hash30 = "4fadbaf7020e8c8d834270aff5dacefe4f1274d88ec46afd0d7697c60a3e2a07"
hash31 = "52ae6a37e5ba2d1fa29ead349fa4518d767fedf228997297d12cab60affc75d1"
hash32 = "10abba74bd88f16edd15b988e7d7cbc9d98a9923cba2afe8fccb4b39f4a02141"
hash33 = "0c3de93e7b87866f9bd68c31b2b2217cce1717a28de9ce5522b0a7172ae44048"
hash34 = "deea1e957d2e3611b20441b093d575a88bd376930b7a64e4fe26b004c842dd32"
hash35 = "a1ba6025bdb91f53b7afb8c900d4fa2bdbf89a735c06cda7edf124b9b68e9427"
hash36 = "c7a9b9b54175a3c29a0a52f83ed389ba9c64ea995b3beec18d082b9a048628ab"
hash37 = "e593e34ef7fdeeb0ceae892213fc3214391fd9715d678bf0c5f6d4e9008a4be5"
hash38 = "e685e50fd470be7caa5cbeea60b97dbac5a0fbb60ba50a5f1172232f8f4cfe5d"
hash39 = "59cbeb3bdcdd054c8034b595fc24ca17504524e3b6ca5540af3effad7c967f01"
hash40 = "c38cfa8259671466b807879ae242085d7587f0ffa618e96efb1b5285ff33691c"
hash41 = "f3ef8ae4732bb9192ed81de146238e21c5d48bb105323522e977d970e3be62c7"
hash42 = "267e646c0d237823cabe87cf52246c7bb46c3ec6128056f955236bb232713c02"
hash43 = "49e3fa9304f584ee5cdc05dc4f5720b2d6ba12a13591e9c7f5e02b2c7e800699"
hash44 = "eca3dea2832d350b94f090bc6d93f330c2a0efe698f500fbb2bf8b442707efc0"
hash45 = "25d61bec7ee3e6f07431a4ef95d608730a473b3285d9c92dbff32d52292ac43c"
hash46 = "13e4701858eb5bf5b1de4382bcfd4309e53ef6aa57913f0f3e880570d29509cd"
hash47 = "419ddfdc6e7a06cf0b18d292897e829b620326b87d2b83a804a1b0fd9e55be2e"
hash48 = "5355cca3b120cd03a4aa059cbb0b36fcb0d02b83698958b18a5624214df8a0f8"
hash49 = "7d2ed21dee15f43d0711be34c9898708736da44567f66cdb0eefd1bc9d410629"
hash50 = "02b08df030e6063deae7d85b3d937df0319e4956c4bc70a4524f7e1b869bf23a"
hash51 = "86e9670e01576e79e08b962de3851bd9dbf28a6b193d9c68dc28e3fc29652fd5"
hash52 = "4899f254348e7e9ea29cd7bc348f2fe3e1b8d7e09039a68a08117a0f8012f052"
hash53 = "d3eba985f3fb74fdc90deeda51a6c1e27f9c593f5fde689683840f50212f816b"
hash54 = "55398f8163baa4d498a76f3ed87ef67ec192a2db55ea544ba53985e98e20ada3"
hash55 = "aa516b76e16551f5d4a7f238e85d3fabb995591f3b575b63b5e52550dd4678a7"
hash56 = "85ab3c9666596f65306d41b214af1120917fda984a01bb2c813d8cf1de47e84e"
hash57 = "7ed81413c75518ed5db149930cc23f99ab50ad2ac7e4b1d27d479db9edd937dc"
hash58 = "3a0d63649703ac9aa588c57a1bfab7126d9bc805c4c8c6c248a761237f0db576"
hash59 = "a7ea37d23ed66b67cf7d0566c75bb068dc517d2b4737679c314f48461f7c240a"
hash60 = "e21b881fd72a7ae3d3402bafb383ed352e88b510353635cc21ead6ec2dd749ea"
hash61 = "c1b760aaea00b15ba00c662a58db24c7d73b716d306716607fb4e8c4caaa68c4"
hash62 = "b217966d2924e9be3cc94e48afb98a23e4abd8fa158cc49190710a49627d0136"
hash63 = "998de9bdca0d39d7369ebcb03ab89497e1a7cca17f8f554585183d5fb3cfed8c"
hash64 = "1cf5dcb412c6c83fa5f64923adb14c550880fc991b24c836e5c07145b19d46db"
hash65 = "7045a184ce1bd719ab111e7e68c53c0aca4c3815b3d846fefa7b3030301a3aaa"
hash66 = "d7b89864ffb7e7314f783e0b1dfd0928eddced2318c3c16677c1b9db01895255"
hash67 = "53635eb8eb6183f52419383cc8e4fb9eef8db33ec708d81399b506018da3234e"
hash68 = "dc54635a3211207c368ccd2eda74639bee1f0811c15c6b62756e6442dbc35228"
hash69 = "d6f49a889fbc33edfbd51cf02326d6a90923469eaff5031e4d1cb27caa8cd70c"
strings:
$s1 = "s if we have it, or otherwise to your e-mail address." fullword ascii
$s2 = " your address if we have it, or otherwise to your e-mail address." fullword ascii
$s3 = "You may acquire under a separate order the Premium Online Library or an individual Online Course for a term of 6 monthsTIGA TE (" ascii
$s4 = "he software on a server or for use by or" fullword ascii
$s5 = "tion. The total number of" fullword ascii
$s6 = "ly license it." fullword ascii
$s7 = "touchscreen. It does not give permission f" fullword ascii
$s8 = "uchscreen. It does not give permission f" fullword ascii
$s9 = "You may acquire under a separate order the Premium Online Library or an individual Online Course for a term of 6 monthsTIGA TE (" ascii
$s10 = "OR PARTICIPA TE IN AS A PARTY OR CLASS MEMBER)" fullword ascii
$s11 = "Education Sales Office. If you choose not to renew the membership, all rights to use the Onlin" fullword ascii
condition:
(uint16(0) == 0x5a4d and pe.imphash() == "3f31a7866f74667f87832eb6a3bec06d" and (8 of them)
) or (all of them)
}