_20160921_ba57fd323c757d83bd9bb08cdba3b4a4_20160921_bc3224e9a637_2159
YARA detection rule by HydraDragonAntivirus · GPL-2.0
datamaliciousorder - from files 20160921_ba57fd323c757d83bd9bb08cdba3b4a4.js, 20160921_bc3224e9a637b2113b3de820bcee66c0.js, 20160921_d4b576a05afdcd9649d02e422feb16d3.js, 20160921_df47c7f57f308287ca344dcc34150b37.js, 20160921_efc4e68608b4bd36f7e16eb4722b21c6.js
rule _20160921_ba57fd323c757d83bd9bb08cdba3b4a4_20160921_bc3224e9a637_2159 {
meta:
description = "datamaliciousorder - from files 20160921_ba57fd323c757d83bd9bb08cdba3b4a4.js, 20160921_bc3224e9a637b2113b3de820bcee66c0.js, 20160921_d4b576a05afdcd9649d02e422feb16d3.js, 20160921_df47c7f57f308287ca344dcc34150b37.js, 20160921_efc4e68608b4bd36f7e16eb4722b21c6.js"
author = "HydraDragonAntivirus"
reference = "https://github.com/HydraDragonAntivirus"
date = "2026-04-26"
hash1 = "119b312aafd59cd12991442685e391e8850e3417b81d4aa79ae8e5c89a75f170"
hash2 = "65d11827de99ef59cd2cc61d914e235dd2b16ac6b8f4f65f39b8a79dad86ed57"
hash3 = "221c028d5b96ed7d5655800598b47b367ee2d1927826d126b5808db32c9a01f2"
hash4 = "dbb4502419f8afb7a2d5fc4186a2c7922701956498b55deb8c27312672415d9c"
hash5 = "fe50eec4105613d48ac273c2d63a5b952098f339f7f06871b77053c43642dba7"
strings:
$s1 = "n fuck(){return \"SUi\";})(),(function fuck(){return \"Cd\";})(),(function fuck(){return \"MOj\";})(),(function fuck(){return \"" ascii
$s2 = "\";})(),(function fuck(){return \"XFd\";})(),(function fuck(){return \"Nm\";})(),(function fuck(){return \"QTc\";})(),(function " ascii
$s3 = "{return \"ADy\";})(),(function fuck(){return \"TTs\";})(),(function fuck(){return \"Hs\";})(),(function fuck(){return \"GWo\";})" ascii
$s4 = "\";})(),(function fuck(){return \"Hs\";})(),(function fuck(){return \"EHo\";})(),(function fuck(){return \"Np\";})(),(function f" ascii
$s5 = "turn \"Np\";})(),(function fuck(){return \"IRn\";})(),(function fuck(){return \"OQr\";})(),(function fuck(){return \"CCb\";})()," ascii
$s6 = "(function fuck(){return \"Jo\";})(),(function fuck(){return \"Av\";})(),(function fuck(){return \"Cd\";})(),(function fuck(){ret" ascii
$s7 = "Bg\";})(),(function fuck(){return \"Wo\";})(),(function fuck(){return \"Jo\";})(),(function fuck(){return \"YAv\";})(),(function" ascii
$s8 = "on fuck(){return \"ZWu\";})(),(function fuck(){return \"AUx\";})(),(function fuck(){return \"IPu\";})(),(function fuck(){return " ascii
$s9 = "})(),(function fuck(){return \"IPu\";})(),(function fuck(){return \"Ai\";})(),(function fuck(){return \"AUx\";})(),(function fuc" ascii
condition:
(uint16(0) == 0x2f0a and (all of them)
) or (all of them)
}