_Trojan_Autorun_Dump_Generic_Dacic_BC58E3CC_A_00D7D229_517_1_Tro_529

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_517_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_519_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_521_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_526_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_528_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_549_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_560_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_59_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_633_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_640_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_670_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_673_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_674_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_72_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_73_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_765_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_773_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_799_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_819_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_86_1.vir, Trojan.Autorun_Dump.Generic.Mira.575DCBBE_17_1.vir, Trojan.Autorun_Dump.Generic.Mira.575DCBBE_2_1.vir, Trojan.Autorun_Dump.Generic.Mira.575DCBBE_8_1.vir, Virus.Hijack_Backdoor.Hangup.B_124.vir, Virus.Hijack_Backdoor.Hangup.B_193.vir, Virus.Hijack_Backdoor.Hangup.B_210.vir, Virus.Hijack_Backdoor.Hangup.B_243.vir, Virus.Hijack_Backdoor.Hangup.B_247.vir, Virus.Hijack_Backdoor.Hangup.B_287.vir, Virus.Hijack_Backdoor.Hangup.B_77.vir, Virus.Hijack_Backdoor.Hangup.B_89.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_109.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_181.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_24.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_255.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_295.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_302.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_306.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_313.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_354.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_375.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_379.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_6.vir

import "pe"
rule _Trojan_Autorun_Dump_Generic_Dacic_BC58E3CC_A_00D7D229_517_1_Tro_529 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_517_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_519_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_521_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_526_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_528_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_549_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_560_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_59_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_633_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_640_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_670_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_673_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_674_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_72_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_73_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_765_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_773_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_799_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_819_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_86_1.vir, Trojan.Autorun_Dump.Generic.Mira.575DCBBE_17_1.vir, Trojan.Autorun_Dump.Generic.Mira.575DCBBE_2_1.vir, Trojan.Autorun_Dump.Generic.Mira.575DCBBE_8_1.vir, Virus.Hijack_Backdoor.Hangup.B_124.vir, Virus.Hijack_Backdoor.Hangup.B_193.vir, Virus.Hijack_Backdoor.Hangup.B_210.vir, Virus.Hijack_Backdoor.Hangup.B_243.vir, Virus.Hijack_Backdoor.Hangup.B_247.vir, Virus.Hijack_Backdoor.Hangup.B_287.vir, Virus.Hijack_Backdoor.Hangup.B_77.vir, Virus.Hijack_Backdoor.Hangup.B_89.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_109.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_181.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_24.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_255.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_295.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_302.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_306.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_313.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_354.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_375.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_379.vir, Virus.Hijack_GenPack.Backdoor.Hangup.B_6.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "7359e40816d00dc2ab1d29e498cf75ddc0da23caa1bf4aa240c8c7daa78f0bb6"
    hash2       = "b6a9677ad08e344decd6e3d8f0303497698339d22d780bc422cbece601cf29f3"
    hash3       = "9a02c45627dbba03f76c5ba85a8b14bcefd429e26de683ed96a2b256c8108709"
    hash4       = "1f484e83c23ea42289141a86450a4882fdee156966572141b6c964b7f01e8253"
    hash5       = "fe8599718b636232ecfee18a0b16d3821a3f6b22718fc87617db5907908385a6"
    hash6       = "e645606ca0c355f6b313daa8617430219b67d321d7d7ac05682496752a38e568"
    hash7       = "cd082d72cdc0e597101e17a8995c891082a2871b13343e120d58384b39d4d20e"
    hash8       = "098b84e4428a032f7d0da8c1456353fe9554d0d4e1280a74912702ef27662403"
    hash9       = "9bb53def313149acdb6f946d7481023540b957bada6a08005344ceab4e27230c"
    hash10      = "c4bcc434eaca6ee1e8e2e76cdccb6217c7391cb7cc04d1bb750d8b98ea6aae87"
    hash11      = "f0914e252070ecd6cd1ac4d1d2bf8cde32e133aec8bd846a7162fba77954d5d7"
    hash12      = "204148fa8d046e3062e2c71f86e479ac86e97443cddf73e44eaa79ecd7143f34"
    hash13      = "2c4deed996ca60e92fab79fb333403ac2d32156f08a04a0b275f6ad632e412b2"
    hash14      = "76b93ef70d1024b4610e5501f6ecb389b435cb344337dfedb7e48bba40b560b0"
    hash15      = "5483460b35a96d5b4d28e03cd6d5c1864dc862b94c867294df4e7b3eb55888f5"
    hash16      = "12982dfb928b775ad2fac87141c5b91921445ccb46db7afe01ad66be60258ee6"
    hash17      = "98d62521ec8920f828f017168094064fad31e92d36ee40526e8eeb02dba33a17"
    hash18      = "9969296eddd65d8bba04476d0408c730e6ef82d87e24cf79615472ef865c177a"
    hash19      = "f5e4e5beed32837e910c49311ade733ba1a38f51434efead8a20ec46f403b1d6"
    hash20      = "b11b2376c09b31303bffcb7ab8f19b342e50201c328092e75d3ed207bb165ca6"
    hash21      = "a5919007ed2996a7341e6c7d50ed0aa4d4372a87a6dc059fa3d229e923a2ee50"
    hash22      = "d46e4d3267ea33c7d6ec7e39a37092ca6f48ab7a66af3e218da08a2159ad4e1d"
    hash23      = "7a1af30bf0b3c54b058acea04f7d0ef19adf3b20b94610e465713900d41999ae"
    hash24      = "441750f43f711ab2e8cd08e6d47af9374023bb101de155fee0d636dad1c8e9e5"
    hash25      = "87bd168bf0d7bb1a8842db70eb58245f63c726a53cbffa6b5add9b6e7b84dd58"
    hash26      = "b733072b30389796f78f16f7b4ca0791e104f5e597dd7bb08c355d56dd2803eb"
    hash27      = "5177b3c92796687214b37587e537c0df8939ed209133f37710ddcb84d4acec32"
    hash28      = "72e170e68c17730bcb703c9686bcd876102201171a1104c6e74422254d08fd4e"
    hash29      = "b84d224e242a4d3b87a8c391deec872924b90401dee38d6d19f373f401fb721a"
    hash30      = "fdaa43b545667168b87445acf8ad503fa88ecf780edf6a859ce95a17a38b0e61"
    hash31      = "62b989409061398bb5c295b5d1d05b273dd752f145bf7e19fd04c4859b0829bc"
    hash32      = "bfb1af5513f97db69b42639936be43e1a028eed242f5351e364712996a9bc961"
    hash33      = "d65f926c255caea0dbbaa407fa3b5cdea67259cac9237a9f1cc5e7c7ae713215"
    hash34      = "cb564637ec8c68fd651b70b320d08ac61b268e61f59ab9e86a8c541eb76eb714"
    hash35      = "dd3885f4055138b2b56ebae1475092af985aa0c2a9f2f055f8f3ddf918f8b14a"
    hash36      = "fcb04bcbe7031b614c15bf23e3f849fdc1dd4ba2df6ae3b740928041dd2efcaa"
    hash37      = "cdb7344f5f0b5d9f57152347689417da03eaa104151414caf904c4550c774e66"
    hash38      = "a03779b13b1a8f3fb62d6f62b0c07f4de350fa7a9fc3f6f6a537b41b624ebf83"
    hash39      = "9605bed9713c29b10c387132d52826d74d8421d19348a36e1edd8b572a1756f2"
    hash40      = "4df862702f4e18ee910b766f98df66d29f2a75bbd83ad0bb7779730c201c9a59"
    hash41      = "8b9d8ebe7b49ca58e1f333b837ee0a10e1a39dc706ef5b53762fd7940bd9fd70"
    hash42      = "4cc81772761f35be5d12567df26e8be92cf99bee61c8fac2bcb3b415a5ca90dc"
    hash43      = "25a67e7df66fcdbf1ff296412fd3de7da8fd691fae6a51e9a764ea66056adc7b"

  strings:
    $s1 = "processed through this application. This does not include communication on the same purchase order. For each application,r softw" ascii
    $s2 = "processed through this application. This does not include communication on the same purchase order. For each application,r softw" ascii
    $s3 = "are is running by going to the software Help screen and clicking on the" fullword ascii
    $s4 = " disclose results of any program bench" fullword ascii
    $s5 = "court (Section B.3) or in " fullword ascii
    $s6 = "of Subscribers. If your business is not defined in the primary definition of Subscriber above, Subscriber is defined as eachred " ascii
    $s7 = "of Subscribers. If your business is not defined in the primary definition of Subscriber above, Subscriber is defined as eachred " ascii
    $s8 = "PIP includes a business document with the vocabul" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "ee8da7ef88a946df26ae37f3f9c2f32c" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

bf749e97-b74c-4856-a4d1-2d57449fa6f1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion