_Virus_Hijack_Gen_Trojan_ShellObject_puZ_aKo42Jj_9_2_Virus_Hijac_28

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_21.vir, Virus.Hooker_Trojan.GenericKD.48560802.vir, Virus.Hooker_Trojan.GenericKD.48560802_1.vir, Virus.Hooker_Trojan.GenericKD.48560802_10.vir, Virus.Hooker_Trojan.GenericKD.48560802_11.vir, Virus.Hooker_Trojan.GenericKD.48560802_12.vir, Virus.Hooker_Trojan.GenericKD.48560802_13.vir, Virus.Hooker_Trojan.GenericKD.48560802_14.vir, Virus.Hooker_Trojan.GenericKD.48560802_2.vir, Virus.Hooker_Trojan.GenericKD.48560802_3.vir, Virus.Hooker_Trojan.GenericKD.48560802_4.vir, Virus.Hooker_Trojan.GenericKD.48560802_5.vir, Virus.Hooker_Trojan.GenericKD.48560802_6.vir, Virus.Hooker_Trojan.GenericKD.48560802_7.vir, Virus.Hooker_Trojan.GenericKD.48560802_8.vir, Virus.Hooker_Trojan.GenericKD.48560802_9.vir, Virus.Hooker_Trojan.GenericKD.72461089.vir, Virus.Hooker_Trojan.GenericKD.72461089_1.vir, Virus.Hooker_Trojan.GenericKD.72483755.vir, Virus.Hooker_Trojan.GenericKD.72483755_1.vir, Virus.Hooker_Trojan.GenericKD.72483755_2.vir, Virus.Hooker_Trojan.GenericKD.72483755_3.vir, Virus.Hooker_Trojan.GenericKD.72587580.vir, Virus.Hooker_Trojan.GenericKD.72587580_1.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_puZ_aKo42Jj_9_2_Virus_Hijac_28 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.puZ@aKo42Jj_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.PuZ@amBwvTb_21.vir, Virus.Hooker_Trojan.GenericKD.48560802.vir, Virus.Hooker_Trojan.GenericKD.48560802_1.vir, Virus.Hooker_Trojan.GenericKD.48560802_10.vir, Virus.Hooker_Trojan.GenericKD.48560802_11.vir, Virus.Hooker_Trojan.GenericKD.48560802_12.vir, Virus.Hooker_Trojan.GenericKD.48560802_13.vir, Virus.Hooker_Trojan.GenericKD.48560802_14.vir, Virus.Hooker_Trojan.GenericKD.48560802_2.vir, Virus.Hooker_Trojan.GenericKD.48560802_3.vir, Virus.Hooker_Trojan.GenericKD.48560802_4.vir, Virus.Hooker_Trojan.GenericKD.48560802_5.vir, Virus.Hooker_Trojan.GenericKD.48560802_6.vir, Virus.Hooker_Trojan.GenericKD.48560802_7.vir, Virus.Hooker_Trojan.GenericKD.48560802_8.vir, Virus.Hooker_Trojan.GenericKD.48560802_9.vir, Virus.Hooker_Trojan.GenericKD.72461089.vir, Virus.Hooker_Trojan.GenericKD.72461089_1.vir, Virus.Hooker_Trojan.GenericKD.72483755.vir, Virus.Hooker_Trojan.GenericKD.72483755_1.vir, Virus.Hooker_Trojan.GenericKD.72483755_2.vir, Virus.Hooker_Trojan.GenericKD.72483755_3.vir, Virus.Hooker_Trojan.GenericKD.72587580.vir, Virus.Hooker_Trojan.GenericKD.72587580_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "7a539b9c8d6d991b4abdb186528601f2b86abeea72d4bcdceab0eb1f85ef2309"
    hash2       = "5bfb283dc4ba0f3304dd642c0499a0d15d97fe9c0195c3e9122aa21d87ff6afa"
    hash3       = "331bf610b5d783915c42acffe9e3cd3f5ca96672ebe471a6ceb4a488ac7a4e71"
    hash4       = "056182e2ea9640cff9241b13e0b13ecc3c3439512dde66bb46a97023c4ca641f"
    hash5       = "b484e824f671f5fda210beaf211740e69bca601500df35c19e341968bf0fb4f3"
    hash6       = "2ad469924123e49320baec29fec5fb49599eadc3e346c3afcda895bb82ad3245"
    hash7       = "462a54e170bdfdec5e10fe77f68736fe5f027b6d8e34ae3716247f36b5356322"
    hash8       = "5963ae36c134609bbb88c17fcc2e81e089a4f9db96dc272c37d5c54344979304"
    hash9       = "ab0ef393d9ca9033b7c3e96b548ea1fbb6131e6e5ba43d0f83892ee939fcdcad"
    hash10      = "cd23143b8dfd26674f44ecbfe0da27388ca6371e98f03e030d5aa9ce4254d6d5"
    hash11      = "3fe409eca98d9ddd8caf288532a9a8f428ca6238c5dd553eb21277f0630da6c1"
    hash12      = "547b55d71d603a4e597b5eacac91adc078beec1627857ecccc2e113b491cf354"
    hash13      = "cfdb313f5eb0dfbf2cfbc06263e09f0ebba0d281d3cc15325890534a75efea84"
    hash14      = "7c6458d3d1c6b62d8c67ddcb84f306de6cc29be5db5f3c1e6de264200ab7a73c"
    hash15      = "dade8856db744daf4d55cefd32b211ff47a0abb319b03942c9315f05e80ce029"
    hash16      = "6152b2ea900dcf3d7357eb305ef45bb153c18bf1948f71f6a3a2fe794d44d2be"
    hash17      = "7350a1a84d002418901387853b21ca35c649557686d1e96cb007c4fbb9785aa9"
    hash18      = "ca08e050f374bda14d7d832af93d267f848f91da6ac0ab06787d275522f320cd"
    hash19      = "3939d38ef888921fefac83b474ff237b95ab8dd5f5df6628d88e5487d50ba245"
    hash20      = "b6eb9b1497d1360f776b4ab9d263bc8805345487ef0a17164b6677290a67b432"
    hash21      = "27d8bada9937d9d06d9b6370a6f51f01b60542ff03b3ade702fc43fb88df5b17"
    hash22      = "a747c833377245e3b1dcc733bf9d97ae9e7ff075e8c9ec2683408cf697a74d79"
    hash23      = "d70d966a85c20ca60e5d6f8ca0d7dca35cfebf27f245de82785e329d2529f222"
    hash24      = "31e06ed32e511815c96316e04c451baafebd1ee53c9c0f875f622e3e81c0db4d"
    hash25      = "5be039925dd091b061ad18cff9822882c7a09ccfa51f1cb6650e4f063544539e"
    hash26      = "b6117f28aeb805c67d32426902026f31b1c293fa7114c48d1726f0f771962169"
    hash27      = "30e751665d4241b1ec2eab98e72d036520888468280451b8017f34f847fdf1aa"
    hash28      = "df356eb52edc65c98188c0ca2afbd1c8155622627340f6d18a481b34be3ee937"
    hash29      = "f8c05998871139e971abf7eae861d850ef23d55b482e88723785d42509ff0d67"

  strings:
    $s1 = "ping 192.0.2.2 -n 1 -w %d >nul 2>&1" fullword ascii
    $s2 = "start /b \"\" cmd /c del \"%%~f0\"&exit /b" fullword ascii
    $s3 = "User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" fullword ascii
    $s4 = "This is element 0: %s" fullword ascii
    $s5 = "call :deleteSelf&exit /b" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "afcdf79be1557326c854b6e20cb900a7" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ae31286c-874d-4e9d-9378-92de08700e5b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion