_Trojan_Autorun_Dump_Generic_Dacic_19E38D3B_A_AAF775A0_693_1_Tro_559

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_693_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_720_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_8_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_95_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_198_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_328_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_353_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_354_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_426_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_489_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_112.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_138.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_156.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_290.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_32.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_330.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_375.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_379.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_398.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_427.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_435.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_485.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_522.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_542.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_578.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_591.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_618.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_725.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_735.vir

import "pe"
rule _Trojan_Autorun_Dump_Generic_Dacic_19E38D3B_A_AAF775A0_693_1_Tro_559 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_693_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_720_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_8_1.vir, Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_95_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_198_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_328_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_353_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_354_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_426_1.vir, Trojan.Autorun_Dump.Generic.Dacic.BC58E3CC.A.00D7D229_489_1.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_112.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_138.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_156.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_290.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_32.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_330.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_375.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_379.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_398.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_427.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_435.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_485.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_522.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_542.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_578.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_591.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_618.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_725.vir, Virus.Hijack_Dropped.Backdoor.Padodor.BJ_735.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "b78d7a77f7a5cd9e1f239b64288231bb7641c81bc896c0868a8099deb655b2d9"
    hash2       = "f5c96916da0dbe5aae0e9ee73f74e616b4038edd0572e78d0c8ba562d1898c90"
    hash3       = "7acf5c048cb3874114a18d378c5c98713e22baa3376dbd7de775d2f246d7a6c3"
    hash4       = "ebfb6e43b5011517de7a060c4c27c7d51517db3f03c877a92978231e77b5bf53"
    hash5       = "52d72a5b913d30f48b21051ca2c186ecc7537a99dd7273ee6ea00cc15bbe8a47"
    hash6       = "f61ff7f32cb8e4fd0819180c57fa7f470cf72cf0f6c8dfa10c04579a71b09f9c"
    hash7       = "fd544467490ef59efd3fd1a74dec8a4fd5e7d5c6e4083cedc4aad0bbd5388a01"
    hash8       = "c1ea7af3ae1951a84d7e4c94916270b4229ef06e2fb3be056168e326c1fcd56c"
    hash9       = "16b14c5f6ff2c64b10d960c4e101287e1d8bdfe191d55692444e1f4cad54699d"
    hash10      = "a0272b7bb8ac7cd6843b87dbe4a142ca8007fd17c00d11fcb4310494bd04aab3"
    hash11      = "01bf9bf1be9672fe7fada3f8fc66f1098c540a4880d18413418998f66bfe915c"
    hash12      = "0c1f3884b7cba8e89be3c236405e127a28313db00f1970cc1ef0884f3988b669"
    hash13      = "1aea9e3bdd1cd750eb5991d35987bd575e757f9d4957eda15ae6a92cdbc7898d"
    hash14      = "67668cd311299e8a9559c5044301d4b7f677b26cc10a8e21ef6f554eaec094df"
    hash15      = "899b0b945eba58914f90c06454c20180e26073a161dc980f9133aefdef757783"
    hash16      = "14cd5b54798b179994764869b5580ab88920aa8535d1f11f995ebcefca892cc7"
    hash17      = "6c39acb96b1d32659cd00e1c92dfdd4273d2abdeef5df6f34bd15839fbadc9c6"
    hash18      = "59a287e0f96ae9aac379281f283a4276f9fefc4fad4e64033c504c51f0f6c7a6"
    hash19      = "706af6fe683ad6176ce5e150ee61ef2d20a0c0aa56e686cfc1cb489800c545d7"
    hash20      = "f3a20fbcd423fb9e087ef5d49e707ff124c6f9bac8f497e05edc83f97ad367dc"
    hash21      = "e7af0e87b75c8b80d580b00eec2afa9ab45c879067515022a7d2090fcafb1ec7"
    hash22      = "14babf5e3effb54e10d8d14c881c3c8c8740cd0b60c560bed06d509843aa2c1a"
    hash23      = "80f10babe4622f4eab9ee4e11da2a279ebb6d07c430f7773406422e6f6eeace1"
    hash24      = "01587c2452f82bded962e416daad31f3fa7d549b31dbf732e9ae392b66fba16d"
    hash25      = "88e393964f79156b7f130a98893bd173b33ee59f059d2d2a7916aba09887c8e9"
    hash26      = "8009dc970fa3710d64ccef96fc3620538e237fdeddbf868b23ae63713b19f550"
    hash27      = "e172593553ba6e1555515d897daab43bcb22b1217725f86985c10af8fa9daf5b"
    hash28      = "c78c3ae416e367449d16290873d6b5bc5cc45bce589dca290446e377507ec752"
    hash29      = "ecf6d9f2fa8489ab2c60829d68e2e95bbcab8be977c7e3982fba2851b9d382ed"

  strings:
    $s1 = "licenses needed is to be based on the peak number of part-time and full-time people whose records are recorded in the system.k" fullword ascii
    $s2 = "2properly licensed copy of the software." fullword ascii
    $s3 = "2If either of us breaches a material term of this agreement and fails to correct the breach within 30 days of written specificat" ascii
    $s4 = "2If either of us breaches a material term of this agreement and fails to correct the breach within 30 days of written specificat" ascii
    $s5 = "by a cable provider; or (d) a live connected utility meter. The total number of Subscribers is equal to the aggregate of all typ" ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "a3486f429175d821c3b8a0abdbffaac7" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

356217e2-10b3-4e67-aaa0-91d17647a35e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion