_Virus_Hijack_Gen_Trojan_ShellObject_dWW_aOfWMFe_8_1_Virus_Hijac_117

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.dWW@aOfWMFe_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dWW@aOfWMFe_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aiNGyOg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aKRpTib_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aKRpTib_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aKRpTib_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgChKg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_31.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_dWW_aOfWMFe_8_1_Virus_Hijac_117 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.dWW@aOfWMFe_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dWW@aOfWMFe_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aGIb!Qk_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aiNGyOg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aKRpTib_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aKRpTib_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aKRpTib_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@amUgp3c_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgChKg_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aSgQ9ei_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_31.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "9fb9db0ffe3bd8f60dfe3299bc7ddc172c728b61d79b1ee32d0c26ee8ccf3a60"
    hash2       = "3673c4e11b206790d884eedcaced0e58d19bf08b6554c8df64725aba2573240e"
    hash3       = "c19978ff923a57eaa927d419afa98fcb4bf587a6d5dbeef2a438c4ada94eb706"
    hash4       = "d472f89d0b68abd765b27b2b51024f4f46f830ba9f8ca70ba129be6dab1147a2"
    hash5       = "618f126eea899d5bcb75fd8e440393d65b8a27b72ede98a84948061afde739d8"
    hash6       = "d177185553551986f129a109b25dd90b138b0ae557b560f698159fcc06ec63c5"
    hash7       = "03140c9bf304711f69f85eceaaae00e8ba3aa92fb140fb038a69cd37ae2bae14"
    hash8       = "52b9edbd3ad92c7f7e09ce6905be01efb8d4c93e91539b581f2143c4c6ec9901"
    hash9       = "84a7b0e511298a4b4d84b71a5152e1ca80803b1e4572227f540b22d4454a9236"
    hash10      = "a8160ec869147e0bbf115997fc37eb3b2198dfaaa6fb293c10c196e7b3b99921"
    hash11      = "8ca6c9aaecd3154d26ede7c847697e8badd372afab657e1fdd6e070f1ee6a185"
    hash12      = "8ad9af153a524ccdd475bc75f17b90a3fa890bc28741ca22b136e2e78bbe407d"
    hash13      = "ca4bd34795e2ca0c3d1620e85b1019d3cec99785ffe6c4712be0fc1a812305fc"
    hash14      = "b2f606d9c9e72d3a1b7ed42a56dba2d704521c2026e4ba30c8367877ef3922fa"
    hash15      = "8050ee6db0ef0ab70c83e60f41659e46b655cf4570e1a0d8f7a61f242e53dea6"
    hash16      = "b059c31ed7a224f41af929f2a2674189de732c962ece7a6b989400e1cb012a9f"
    hash17      = "59822012b04406a3df0f5893619e6129398134fc922d53ff1f1c9a6daf803f5b"
    hash18      = "184e59e76f6fa14247e00c92234aa8475ad86486b03177ceac287691e75cd726"
    hash19      = "1bda0eb41a1e5ce231d980591ab63c629bc7493ac5c42bffeb822497ac34c9e7"
    hash20      = "0cb3f9c88674924b5750eaee234cabe910d3a14dd93a8488abb7f284bd886207"
    hash21      = "fcc512a8935f6072e24cf5623b8876f4c2dd6609215001dce9b47291f3aab04b"
    hash22      = "02aa095e176c7bb6e5673834aa2a1c406b88a0e5c0c869c96af3e9714bb045d3"
    hash23      = "bd1decaf4df6f8ec4cb7c1b3706bc6cd9232a593b2185ddcef017ca4075f3824"
    hash24      = "e7b9ec468f4cdeb94423169d3d9c8745393b2232c54b525bfa887b687a34daa4"
    hash25      = "55dfea44574caab8f9584a90f41248fd5f0247520d085394f1253740b057ab57"
    hash26      = "dc43e49a23fc5d0802fb5d8e2b6e7369c628e608a2398e704d12e50b59e959e8"
    hash27      = "a3bb16f22fe6bd33abb59b895e0e71f8a543c92487691c3748bdea83a55f97f4"
    hash28      = "9c8ef3c78883f61cdcfe2a97424f16735ba5d7848c45ff64850a3512e7dbff5a"
    hash29      = "8798b0104be43e9c3eaf21ecad69fbc66b4d5f069d2f8ecb0437b009846f6cc4"
    hash30      = "9ddc505283f3fd5efc1b44c69854cd6780e93939a16c32c4674e8370e23bf8c7"
    hash31      = "3393bfa44beb5d050f73f1a2283f35f95b36cfed85772a456de18f1c837d157c"
    hash32      = "ad4ffc1484e94e39ad5a7b72206124e57bdaeacff7ad86866bc5793395db9a33"
    hash33      = "6221d31dd79dc7f271aded1eb5ea303f1b4d61cbcefdc9e748763961da7a002a"
    hash34      = "169e820ce83b74aa44f531763354fc30504dc12075371299acafd48ecfbbe59b"
    hash35      = "c2400f68483515e89994c4fcea600c47d4b31123efaf1d6f0d8787e1c5f43ab6"
    hash36      = "bc2ee6464d57b4a87947a1c94bd4f672ad7b0df52597449e1f34969939dd2424"
    hash37      = "02f67bfd2253b4c96960de891748da330b339a210bfd926a866faeaec586483a"
    hash38      = "cd5c22a2f4e2418324606dff94165dae91ff51380545b6d0bb6206f63c442612"
    hash39      = "6ee0355f40e4cfc8b96649e0f48d54567dd7813468010698faf924486ac3b379"
    hash40      = "392c774ec78dcf6c4b26b9d7d7509f9132f7328e656bb7a260a47da586992cb0"
    hash41      = "d2a38dd1da12762e0a95d81c19d08464fe2027e498cff3a44eda946a4a8ff133"
    hash42      = "ec0e78d2ca78a0f77f578407ab239203c8c734b22ab8d370fb53e50f8681a3a9"
    hash43      = "fbf5b0b3ca5f0089c4822b0fe08420c959df2e97c7c238b6310ac7f9234aadde"
    hash44      = "607e91d78cd6434b615c4224f4754853afd23a15bade9facd5fc5f09f5b6ed70"
    hash45      = "6f8b432952f328e0e14dd154d144ecb43e282592d614685293cfa7c02a9d47b6"
    hash46      = "6938ed8162676d33bc9aadbbd9d55175933fae2199c697df0d1c4fac25d60418"
    hash47      = "cc9889b846c3377c18beb430d7d75e56a37521f01af575e8dbbb9abf7ea5c058"
    hash48      = "dab9a84f752c602dabf90e43234fad1f6c97a6c64c8e482c35c9e5af60185aef"
    hash49      = "7f4e069a2242137456e89d1211ce93315a7685693bac18f383eb0235734d746b"
    hash50      = "6aaa55ecee63d3ea9e5c61f829bf3c11043581975eda30f52621ed0232fd4de4"
    hash51      = "57397e26bcef031834d4da382683be2fc2a4afae26cc2134b4f122e68d0247eb"
    hash52      = "b7c5650d83c719882aa2b9f3ee22c3545aacb1ec01c42d2e6e2ceb9edf21a831"
    hash53      = "b896da0b698656eed91710152bdacd3c89802a1366bf5c95c1540910e327cbc0"

  strings:
    $s1  = "Connection failed. Secure (MD5) login is not supported on this account." fullword ascii
    $s2  = "Connection failed. Your ICQ number or password was rejected." fullword ascii
    $s3  = "Connection failed. The server is temporally unavailable." fullword ascii
    $s4  = "As part of this software beta version Mirabilis is granting a limited access to the ICQ network, servers, directories, listings," ascii
    $s5  = "Received malformed login packet" fullword ascii
    $s6  = "Too often logins" fullword ascii
    $s7  = " login " fullword ascii
    $s8  = "Buffer Overrun ErrorYCan not estabilish direct connection due to client using an unsupported protocol version.<Can not estabilis" wide
    $s9  = "Direktverbinndung konnte nicht hergestellt werden, Remote Klient verwendet einen unbekannten Proxy" fullword ascii
    $s10 = "The server sent warning, this version is getting old. Try to look for a new one." fullword ascii
    $s11 = "As part of this software beta version Mirabilis is granting a limited access to the ICQ network, servers, directories, listings," ascii
    $s12 = "ICQ - Providing Help" fullword ascii
    $s13 = "Password@{E" fullword ascii
    $s14 = "INFECTOR" fullword ascii
    $s15 = "Could not add user for sending/receiving files" fullword ascii
    $s16 = "Dat version not supported" fullword ascii
    $s17 = "Auth methods are not supported by SOCKS5 server" fullword ascii
    $s18 = "Connection failed. The server did not accept this client version." fullword ascii
    $s19 = "Connection failed. Unknown error during sign on: " fullword ascii
    $s20 = "Connection failed. You have connected too quickly, please wait and retry 10 to 20 minutes later." fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "f5e2fae08fb1c8fba965c988eb10e880" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0c765c25-3019-44ee-9341-0d9db2ed8f27

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion