_Trojan_Autorun_Trojan_GenericKDZ_94847_139_1_Trojan_Autorun_Tro_541

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_139_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_171_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_218_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_245_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_252_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_254_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_326_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_348_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_352_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_354_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_452_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_456_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_457_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_81_1.vir, Trojan.Autorun_Trojan.Ransom.Doboc.A_10_1.vir, Trojan.Danger_Dump.Generic.Dacic.1A48D031.A.B69FE9A0_2.vir, Trojan.Danger_Gen.Trojan.Heur.duY@HPIO3zfb_1_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_192_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_210_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_282_1.vir, Virus.Danger_Gen.Trojan.ShellObject.i8Z@aOOYw2o.vir, Virus.Danger_Trojan.Agent.DQQO_3.vir, Virus.Danger_Trojan.Agent.DQQO_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aOOYw2o.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWlu0Qk.vir, Virus.Hijack_Trojan.Agent.DQQO_109.vir, Virus.Hijack_Trojan.Agent.DQQO_185.vir, Virus.Hijack_Trojan.Agent.DQQO_243.vir, Virus.Hijack_Trojan.Agent.DQQO_306.vir, Virus.Hijack_Trojan.Agent.DQQO_39.vir, Virus.Hijack_Trojan.Agent.DQQO_408.vir, Virus.Hijack_Trojan.Agent.DQQO_419.vir

import "pe"
rule _Trojan_Autorun_Trojan_GenericKDZ_94847_139_1_Trojan_Autorun_Tro_541 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Trojan.GenericKDZ.94847_139_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_171_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_218_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_245_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_252_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_254_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_326_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_348_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_352_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_354_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_452_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_456_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_457_1.vir, Trojan.Autorun_Trojan.GenericKDZ.94847_81_1.vir, Trojan.Autorun_Trojan.Ransom.Doboc.A_10_1.vir, Trojan.Danger_Dump.Generic.Dacic.1A48D031.A.B69FE9A0_2.vir, Trojan.Danger_Gen.Trojan.Heur.duY@HPIO3zfb_1_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_192_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_210_1.vir, Trojan.Danger_Gen.Variant.Ransom.Xpiro.2_282_1.vir, Virus.Danger_Gen.Trojan.ShellObject.i8Z@aOOYw2o.vir, Virus.Danger_Trojan.Agent.DQQO_3.vir, Virus.Danger_Trojan.Agent.DQQO_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aOOYw2o.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.q8Z@aWlu0Qk_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.t8Z@aWlu0Qk.vir, Virus.Hijack_Trojan.Agent.DQQO_109.vir, Virus.Hijack_Trojan.Agent.DQQO_185.vir, Virus.Hijack_Trojan.Agent.DQQO_243.vir, Virus.Hijack_Trojan.Agent.DQQO_306.vir, Virus.Hijack_Trojan.Agent.DQQO_39.vir, Virus.Hijack_Trojan.Agent.DQQO_408.vir, Virus.Hijack_Trojan.Agent.DQQO_419.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "ef3457f448ecfede49b4b756085df29ca929b1d2fbad44dee4ab9ae32662f0ca"
    hash2       = "e0b2548b0a278fb43e23359245f1cce2e82550cdf1e9ef1261d25a3e18182b8d"
    hash3       = "207c8aa6c518753f539195909055e486727aea217b891898206ba659a3e16e7d"
    hash4       = "f75bac9d0581a5dde069ec60075b94b59953383c2c1a385fe2cd1221dcf6501d"
    hash5       = "268b6b33e82eb6556ffda62f40ae1bc7ccdf687e89629f13f249fb872252f894"
    hash6       = "2f2ab72129c6e65bee7ef27960b2dabf047f7f0d20b6bd34deb28249a0820881"
    hash7       = "3c2140ed8b5d6e0a6be12bb7dfa2dd210e2fd7dba711f77e2b8a191c0f68d932"
    hash8       = "fdbe66b54e32e9f916851e8d831ac759bc94a091f2316f11b5a0b84d703ddbd1"
    hash9       = "2ec7ad6da134e3f1b12cae7fba421e2e9ed872d06eb4414d80725db2d19997cd"
    hash10      = "d2b8a5d92b581ae39891c806fdec8d66dc55ebb0a662c5f7578ce672a9f5051c"
    hash11      = "a2050570c05e436edb8c2756c3a888fa52dfa556c797522b6d40a3de74dad9fd"
    hash12      = "473054184a7e0b1aed641e4fc8c123b3786671a537b285c226cb8f6ef94211d2"
    hash13      = "4c57e9627abb787a83ca1914fb2b282237b308d5ec4849c5c1b4bb186a93e297"
    hash14      = "f21b5d7621c1ab2e19875a3b12910c3dc5d10351367f8388dac960e0370ea134"
    hash15      = "7fde68de349a3542219fdc1aa821e85e68bdedc581f8c3dfb838d61deea4bb03"
    hash16      = "b83b57d26a1b6d2bd6977c6027f3b6b761505a11483081e5f8e9ece2f503ea8e"
    hash17      = "eab238d1f6530a818b421595a0e3a0ec6a51acb0b2b412efb610d1e5efadaa74"
    hash18      = "89f41095666bc8dafe19b500f1913bdd98ba336601ca388b0996096417cdd912"
    hash19      = "05b0ae4b34475938c702a9b2a0cda4940099ffbe775f8bc004d662c46e6afde4"
    hash20      = "cf36d7889e2d293ab5a2081490f24f6ea9b70e8acd0887ddcec3140d6a6ef79f"
    hash21      = "047ebc67eb10a953ca54793b1b5d73a80b4d1504b132ca7a1f5c32328ae6a798"
    hash22      = "90803ea9e0de8dc0f93ff09e1d7ac3d38a1cc11c37ce40ee71d10a738b79da7f"
    hash23      = "e28297e4d828b22d5a7db7975ffc50a410a03a1fb4cb0587759e0c7efae142c6"
    hash24      = "0d4a4f0dce57e46ff3f5f9a92793588507068e80eecb9d92036bf26b5daa4347"
    hash25      = "8656d22fd56fbce588e5a40b334046b7468c5323c7c8e682791fe1622aedfbce"
    hash26      = "791f127d9be344f7d762dc2262e88312d8a10cb64c369ec9aa63f208f1104aa9"
    hash27      = "b861fcd90d4059638cfbaca72c115a03dfbbd0f862efc1baf92633f61119129f"
    hash28      = "d07d1a382deff24e3baf1ef714f9f7e8ed837f0654e342b81ed4a4fe55c7ff85"
    hash29      = "b0e8380ef9400209e544cbb9db4aa7980c71ee7712506cad553977fcc8d31349"
    hash30      = "301d207156f917ccabaf524c5ea734870090902a11b99bca3ea29529377f4f71"
    hash31      = "e3e77fb76506bd9e1f7c1b417b53d60991900769eb7d65f7bcd79cbe9e04c3ce"
    hash32      = "a8d6e504471c8af50fda397e15af94d29c82fd10914503cf6b7d10d990e82b53"
    hash33      = "c072545f3ee0f36218dcc9b785a603a3f92698d4fc4071d8c0079eddbb2a42bd"
    hash34      = "6c56355f61309757cd6b20cfa6f6069b9d483441e70aee2086978c97778617a0"
    hash35      = "d5329ef1992dd2e79c1ceec65cf303c468e54bb8b439f094c585cffec037d803"
    hash36      = "7aae39d04755e1d92a89a061145cd2283466cdd9a20c77269fb2112475b2ab19"
    hash37      = "4fae6fd650f0c706524b9d72e8ddef415c012cea1b495427b86470b00cad04c1"
    hash38      = "8af848c7f5916e243adf739b249cc4b051d13bf72ef10e7adaafa0e735fdfab2"
    hash39      = "ab99dd4b08a0fd476754a00621687f303bcddbd5d4b103b38a46d50fd08161a2"
    hash40      = "bcc24a35d0fd961d27823fba1bfc9e0b4b66c6c2bf863fd2bc710a565d30c0cd"

  strings:
    $s1 = "Failwww.oracle.com/education/oln/index.html, and may be updated by Oracle from time to time without notice to you. You" fullword ascii
    $s2 = "programs. The term Compensated Individual includes, but is not limited to, your employees, contr" fullword ascii
    $s3 = "parties such as Oracle and instruct your employees and agents of these requirements for the TRMs; (c) restrict disclosure of the" ascii
    $s4 = "including residuals, whether owned or managed for others, active on the program, plus (2) Book value of assets on operatingVCCha" ascii
    $s5 = "including residuals, whether owned or managed for others, active on the program, plus (2) Book value of assets on operatingVCCha" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "ef8f213fbf3a8f339b41732b5dbdfe46" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a336e32c-5b3f-4a70-9d76-ad6aff89fea5

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion