_Trojan_Autorun_Gen_Heur_Mint_Murphy_3_325_1_Trojan_Autorun_Gen__512

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Gen.Heur.Mint.Murphy.3_325_1.vir, Trojan.Autorun_Gen.Heur.Mint.Murphy.3_84_1.vir, Trojan.Autorun_Gen.Variant.Barys.121928_11_1.vir, Trojan.Autorun_Gen.Variant.Ransom.Phobos.169_11_1.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.440C5A1E_1_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_101_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_132_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_16_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_213_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_242_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_74_1.vir, Trojan.Autorun_Trojan.Agent.CCPK_9_1.vir, Trojan.Autorun_Trojan.GenericKD.72517131_155_1.vir, Trojan.Autorun_Trojan.GenericKD.72517131_188_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_8.vir, Virus.Hijack_Trojan.GenericKDZ.98113_131.vir, Virus.Hijack_Trojan.GenericKDZ.98113_141.vir, Virus.Hijack_Trojan.GenericKDZ.98113_150.vir, Virus.Hijack_Trojan.GenericKDZ.98113_201.vir, Virus.Hijack_Trojan.GenericKDZ.98113_347.vir, Virus.Hijack_Trojan.GenericKDZ.98113_412.vir

import "pe"
rule _Trojan_Autorun_Gen_Heur_Mint_Murphy_3_325_1_Trojan_Autorun_Gen__512 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Gen.Heur.Mint.Murphy.3_325_1.vir, Trojan.Autorun_Gen.Heur.Mint.Murphy.3_84_1.vir, Trojan.Autorun_Gen.Variant.Barys.121928_11_1.vir, Trojan.Autorun_Gen.Variant.Ransom.Phobos.169_11_1.vir, Trojan.Autorun_Generic.Dacic.AAD0835C.A.440C5A1E_1_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_101_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_132_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_16_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_213_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_242_1.vir, Trojan.Autorun_Generic.Malware.SF!dld!.D800E25F_74_1.vir, Trojan.Autorun_Trojan.Agent.CCPK_9_1.vir, Trojan.Autorun_Trojan.GenericKD.72517131_155_1.vir, Trojan.Autorun_Trojan.GenericKD.72517131_188_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_8.vir, Virus.Hijack_Trojan.GenericKDZ.98113_131.vir, Virus.Hijack_Trojan.GenericKDZ.98113_141.vir, Virus.Hijack_Trojan.GenericKDZ.98113_150.vir, Virus.Hijack_Trojan.GenericKDZ.98113_201.vir, Virus.Hijack_Trojan.GenericKDZ.98113_347.vir, Virus.Hijack_Trojan.GenericKDZ.98113_412.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "dbffbc55bb2f1b2038eaca3c7ba705311829982b53809eb02c9569561ca6638e"
    hash2       = "2996669c5bd75fb95f47905044f35d12c18bd82e2a66cc31adff1e1895e50385"
    hash3       = "3380633ef7963799a694d93ddd402070ca34b31d51184c166d723d09ac708beb"
    hash4       = "76d3ee5e0687e6947dcf8ef9660734b61fad8463a7630568d9372396e484a77e"
    hash5       = "9005ab5f9dfd45bcf601cbd75178672ba791eeaaf417a997b7f07fbd12aab65f"
    hash6       = "34bf6fb1dd72a15805d45e85c42ec30b8c86c6a0580f9db4973a8711727db024"
    hash7       = "9ab2f36740053f21fa73e56ebf882e6cf420b8bc7ace66969863606ebf3c1b85"
    hash8       = "c59c1c76b3e793791d9a3286dc2fcd55a25c23b4f547959fc9eddac379660b81"
    hash9       = "c40322f38c88c886064f9da8576643ef09c75860a14985b259f79883b6b3b49d"
    hash10      = "8652fe87750c75fa68a29f3f3927ce6a3677bfb614733f11aab93b2f55407053"
    hash11      = "b43f5a07add747847e7d1c9bddeabcb7294025a0c04cfa73f3a1128c963449fd"
    hash12      = "97530455c6f39d28ffaafd829ae66bf47a79548197c0fe88dd1c5a667affa234"
    hash13      = "6cb0c95a204fe9f7ac4d329445f19e2c13ac8e18bd150ef30839a93f1acf0b2a"
    hash14      = "9c3f5a04617383aa256c5bb4762969a9006d9957e934f85b8d283d300547a5af"
    hash15      = "19281145a4abae2e6ed3746308ed7efcd84030420edbc304fb8a85f93033d078"
    hash16      = "503c16eb4840cd51232a395f8217ede8c8526b27702ca1a6e0202a612548852a"
    hash17      = "8d955deb96a17600424d196ef0d6fdb319e2a8ca8ef7054efb1e08dae4032b8b"
    hash18      = "8d61c31f6506af0812845b78d50782d8bdac55b00a0950ad8eeb215a8c340592"
    hash19      = "649d710ee4c748d69ac6f31e58002a282d4d8493fc7625e6025f11283b748467"
    hash20      = "ccea4651ca3c86805d460e27ad43b6c10ed4d18c81b57bb90c8c4905642461ec"
    hash21      = "7fd621e8074b19ee50f2f38bc69d559edafbd2aa5bae518ac432ed576e4e719a"
    hash22      = "9192be1aef62bc84187235219367e1411a5df3d63b778204ddcf3e75c57e0b6d"
    hash23      = "ab9225ace2da59ebbd116468d0a1d5fea39ca9e870963699e54a0868184c448e"
    hash24      = "3772624362b3235e6e7f36101dd00604484c0a25325bb931bbc1768da12b3ed4"
    hash25      = "a2da86cf2e057121303f9c2cf95e5df69c9145e96c2664df4015507d723a9c57"
    hash26      = "e8b72b1a113a9bcdbb4108038d8f0d1740c1ccf9a26c7c34475c9843c9ab8db0"
    hash27      = "3fd8993ff73199818f688d2d10051fe5dcc0fbc9eeb32f700c2704b3c64b33eb"
    hash28      = "194a1349926418322abc0a8d1a20c6c280f452c0a635caa87cfc2607e811e5f4"
    hash29      = "f35507d99a567dbf7d41a12add94e7c3962dc19cbbad778af91b9ee6f9a6b982"

  strings:
    $s1 = "nsfer the programs and/or any services deliverables, and if you decide to finance your acquisition of the" fullword ascii
    $s2 = "Oracle University Online service is made available to you subject to the terms of this agreement and Oracle University'scense De" ascii
    $s3 = "Oracle University Online service is made available to you subject to the terms of this agreement and Oracle University'scense De" ascii
    $s4 = " the genuine proof of license for the la" fullword ascii
    $s5 = "d if you decide to finance your acquisition of the" fullword ascii
    $s6 = "OR A PARTICULAR PURPOSE, A ND NON-INFRINGEMENT. IF" fullword ascii
    $s7 = "including residuals, whether owned or managed for others, active on the progr" fullword ascii
    $s8 = "VE A NY DISPUTE HEARD AS A CLASS ACTION, PRIVATE" fullword ascii
    $s9 = "to manually enter orders directly into the programs but any orders entered electronically into Order" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "1aab6bfb64ba225a83e9143452b536c0" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9cbce601-9f4d-4f09-b5f8-478aecf86c00

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion