_Trojan_Autorun_Dropped_Generic_Malware_SF_dld__BF6D7908_14_1_Tr_540

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_14_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_123_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_135_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_185_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_192_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_264_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_270_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_309_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_314_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_349_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_353_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_379_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_400_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_415_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_427_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_449_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_475_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_602_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.p8Z@aOU94xe.vir, Virus.Hijack_Trojan.GenericKDZ.98388_152.vir, Virus.Hijack_Trojan.GenericKDZ.98388_190.vir, Virus.Hijack_Trojan.GenericKDZ.98388_244.vir, Virus.Hijack_Trojan.GenericKDZ.98388_53.vir, Virus.Hijack_Trojan.GenericKDZ.98388_96.vir

import "pe"
rule _Trojan_Autorun_Dropped_Generic_Malware_SF_dld__BF6D7908_14_1_Tr_540 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dropped.Generic.Malware.SF!dld!.BF6D7908_14_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_123_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_135_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_185_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_192_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_264_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_270_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_309_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_314_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_349_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_353_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_379_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_400_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_415_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_427_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_449_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_475_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_602_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aOU94xe_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.p8Z@aOU94xe.vir, Virus.Hijack_Trojan.GenericKDZ.98388_152.vir, Virus.Hijack_Trojan.GenericKDZ.98388_190.vir, Virus.Hijack_Trojan.GenericKDZ.98388_244.vir, Virus.Hijack_Trojan.GenericKDZ.98388_53.vir, Virus.Hijack_Trojan.GenericKDZ.98388_96.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "5d2b2b9080fed046646846a864967f489a643b9bd01e8ae90a0bee28669387a3"
    hash2       = "cf21688889f86f9f2be35a45192e7b357e4dad078cf64a614cf7735b034c40c4"
    hash3       = "7b858fe384d54bcf7709e7f2430351a41f069bfdf590ee213a6b53aae2ed26c9"
    hash4       = "ac1e637b9d33c6cc774f89cb15bcff80d3356a88ef0b309d6a4b8dce44858af8"
    hash5       = "b5829849f58e131bfc056352cae0a2be35e5e299c1b8e886522ac7339d9dfde1"
    hash6       = "130b7e81935d2b1766f5a15ef0ab75db01777c40dda34ad2d6a248d9a9afbe46"
    hash7       = "1214c03118df82fc9ff1d17d5a1268e73533ca690256a284f91ffd991a74f539"
    hash8       = "a1ffc0c29d41edb30d11465710ec4c4eb181e7ea3779aa9612fc291df6abaae0"
    hash9       = "1cb975fed746ff3cb8a43a4faeb494f8fdc3d7527056c80b434c063f821a5b58"
    hash10      = "b2b8b3949ce91f8e4740ecf1188b84a2eb308482570426e132079d21ad26c343"
    hash11      = "a41c152dbd95c41573e5bff1648a280ebbf5741c27da81d3146b5f44b5d5664b"
    hash12      = "d017da31ebe9b4bbf5ac456c543911da3a1922fa192643181fcd1e8a3d343e92"
    hash13      = "54c5c7f07bb7bf342347a87776fd25714d98c089355baedbcd5426f718dc3f8f"
    hash14      = "dc2a3fc48e53486fe74ea6a83bc7a4fa35ca241d0d1fe5f937f856748a209bc9"
    hash15      = "92f04000d0d426a9ee709aba1d9153b877798fac6b33f6e239363719b253c60c"
    hash16      = "0382bfe7ab55bfd28fa7389c6034d9a19f50fa53052b252aff388a00a92f7425"
    hash17      = "24da51cf91bc8d26f2dda4a16e3174d9a6042c3ac8b7d847696d592f093f05fe"
    hash18      = "ca19fcb77bed7a601be0e212db614dde186aafa6a34de8404c500352cdb425bc"
    hash19      = "47a254ae1453faee674303d3e170142bf6b17df67602cf0bf2b1357a61cb950c"
    hash20      = "f757d99f736d80217754088a48a2944432f02a940722cb2290cadcf98a81dc1a"
    hash21      = "043557275b8427a10f009dd8b75ee2ffc82cf7c91d4b278b526f05efd6dfbcad"
    hash22      = "03557e9c6cebcb02c3646957f1dca538a8c11c28ccb7d9cea219a85df25236f6"
    hash23      = "4326eb1d2defb3b2b9af3ab453f15510df259dc6a3d543a8c2ecbb5d7b7f38b0"
    hash24      = "6da1e35b7ba28bd48b20dcde5064e7d79f03f5785f7cd3cb4c0f78652c85e995"
    hash25      = "4d69e6b8ae7bb2f9825e6f05baa81a3a7f822fa941fbea586ebd7e5967c16693"
    hash26      = "4266331c859914948db72331f18ef00c3925b8430db28d0dda1c005017ec2a3d"
    hash27      = "c3b1bf5abe08380ed1cc14f2037331ee5085c372387eaa31fbb3cdd69594951c"
    hash28      = "260c629afb6cbaf5607484a79ae404b34e349d825514f1c7b244e38df4f109e7"
    hash29      = "e4f83dab6a8e9101bd05cf69af868a67b33973350db6ca3edf7f6eb3ba6090c5"
    hash30      = "2adab7a34f0908c17090a37378561c48f60d376e96a8e06ef58acfb715150b86"
    hash31      = "956f185548c0c4a3f8dc92d21ffd7b2e6d449744177a67fe946db6b2ebf25d22"
    hash32      = "3b4d72e4308a66daf2928e375d02a020115de4ac6cd88a8f3a678ed005498be3"
    hash33      = "d8614b0a7d980964cf847b9b49b07ac9a10fe51c62f7a77d48c1d71b294eaff7"
    hash34      = "c2482a86a8995720af2d112dd4d35f76a2335bc0a19348a29f81a9603411dbf2"
    hash35      = "b3c7e4b2765b0b49360fb4f6f048e0d971ac67c7bbcc60408dc6f5690b314bb4"
    hash36      = "95db462f722389e2895d07b2aba8e670195ae79288e8cf617d4356243411c8ef"
    hash37      = "d0d08f246776b2f74ce891a2d53f9d2f394dc427554211e2bbc4ff7c74e504bb"
    hash38      = "282b22b7e4f83cfc56978a91f92ad14e48dedc76e9ad0ce966dc5ddaafd147e7"
    hash39      = "1dbcd040a52175bf34908b2b17a1d3d1f7b6bf9f747352c80aae27579cec1a41"

  strings:
    $s1 = "participants in the web conference external to your company and attending a web conference are not required to be licensed.`z" fullword ascii
    $s2 = "ty Programs. The software may include third party programs that Microsoft, not the third" fullword ascii
    $s3 = " frIL. HOME USE PROGRAM SOFTWARE" fullword ascii
    $s4 = "relating to this agreement may be brought by either party more than two years after the cause of action has accrued.uy" fullword ascii
    $s5 = "relating to this agreement may be brought by either party more than two years after the cause of action has accrued.1. Third Par" ascii
    $s6 = "relating to this agreement may be brought by either party more than two years after the cause of action has accrued.1. Third Par" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "d6dd153d9bb686197d1d05fe4397c0ef" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4221e1c3-86c8-4415-9708-da9682ed9d48

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion