_Virus_Hijack_Gen_Heur_FKPc1_5_1_Virus_Hijack_Gen_Heur_FKP___258

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Heur.FKP.!c!.1_5_1.vir, Virus.Hijack_Gen.Heur.FKP.!c!.1_6_1.vir, Virus.Hijack_Gen.Heur.Japik.6_1.vir, Virus.Hijack_Gen.Heur.Kelios.1_1.vir, Virus.Hijack_Gen.Heur.Mint.SP.Dropper.2_1_1.vir, Virus.Hijack_Gen.Heur.Mint.SP.Dropper.2_2.vir, Virus.Hijack_Gen.Variant.Barys.102182.vir, Virus.Hijack_Gen.Variant.Barys.102182_1.vir, Virus.Hijack_Gen.Variant.Barys.102182_2.vir, Virus.Hijack_Gen.Variant.Barys.102182_3.vir, Virus.Hijack_Gen.Variant.Barys.102182_4.vir, Virus.Hijack_Gen.Variant.Barys.102182_5.vir, Virus.Hijack_Gen.Variant.Barys.102182_6.vir, Virus.Hijack_Gen.Variant.Barys.102182_7.vir, Virus.Hijack_Gen.Variant.Barys.102182_8.vir, Virus.Hijack_Gen.Variant.Barys.126777.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_10.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_11.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_12.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_13.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_14.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_2.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_3.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_4.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_5.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_6.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_7.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_8.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_9.vir, Virus.Hijack_Trojan.PWS.Banker.FMA.vir, Virus.Hijack_Trojan.PWS.Banker.FMA_1.vir, Virus.Hijack_Trojan.Pws.Online.AGC.vir

rule _Virus_Hijack_Gen_Heur_FKP__c__1_5_1_Virus_Hijack_Gen_Heur_FKP___258 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Heur.FKP.!c!.1_5_1.vir, Virus.Hijack_Gen.Heur.FKP.!c!.1_6_1.vir, Virus.Hijack_Gen.Heur.Japik.6_1.vir, Virus.Hijack_Gen.Heur.Kelios.1_1.vir, Virus.Hijack_Gen.Heur.Mint.SP.Dropper.2_1_1.vir, Virus.Hijack_Gen.Heur.Mint.SP.Dropper.2_2.vir, Virus.Hijack_Gen.Variant.Barys.102182.vir, Virus.Hijack_Gen.Variant.Barys.102182_1.vir, Virus.Hijack_Gen.Variant.Barys.102182_2.vir, Virus.Hijack_Gen.Variant.Barys.102182_3.vir, Virus.Hijack_Gen.Variant.Barys.102182_4.vir, Virus.Hijack_Gen.Variant.Barys.102182_5.vir, Virus.Hijack_Gen.Variant.Barys.102182_6.vir, Virus.Hijack_Gen.Variant.Barys.102182_7.vir, Virus.Hijack_Gen.Variant.Barys.102182_8.vir, Virus.Hijack_Gen.Variant.Barys.126777.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_1.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_10.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_11.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_12.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_13.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_14.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_2.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_3.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_4.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_5.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_6.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_7.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_8.vir, Virus.Hijack_Gen.Variant.Ransom.Sodinokibi.66_9.vir, Virus.Hijack_Trojan.PWS.Banker.FMA.vir, Virus.Hijack_Trojan.PWS.Banker.FMA_1.vir, Virus.Hijack_Trojan.Pws.Online.AGC.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "62e2dfc9befca3786381ae7a7f92e0689eb18ce4d8bc05c6a8fa4d68b62e6167"
    hash2       = "9894ed6be6b5a5e3fcb2b25237c03669bbed8d29cce804fab70dcf2ccfc5d3c9"
    hash3       = "c2e8da388f7d35f4bfdf099a162065ec2b710e935f0b54147301d7e11b7d9350"
    hash4       = "1f8c71c398a23b12eb851df8bb90f65d770afc113c1de2653e774ced84a2848c"
    hash5       = "51646073f26a9315557998053b9f4bdb4150add28889c9b56b30dd8e3a84de4c"
    hash6       = "18d936d40cfeaa3697fe85ebffb16092340e38f36d320e1a177aeb998f6cfb9d"
    hash7       = "457f5dc2f8680868398e18335c391915db1053d407bc9238618d79c7e203e9c8"
    hash8       = "c4c3867c6914b5530b69f7fb3e61f889fec24cac228d70c74aa234043fa0e53d"
    hash9       = "198561bf22f391da667cd79071c14a68ca7ad6f2d61899a0bdc98c3db538033f"
    hash10      = "c0750362a3ab492e66aabe307195bf85865b6942619d6160cbb40f956cde4ecc"
    hash11      = "00732c567b790722b5b8fbf0fb0cd97d2d312b7a85b2551c1943026d801eddac"
    hash12      = "81185627c8f26c202cd132ae8ae6cf352a26c5e1180525924cc1da4ae476d170"
    hash13      = "bcd6e193179437b501096afdd598f3e798921e11d59fbc5eb84f40e4f2a7f3e9"
    hash14      = "887846977e35b7ff8f536c3ed3c467981ec73a828f4710f6dbf36c454fade535"
    hash15      = "f6e0951e92f881c2b8e8eacebec7157a970ba0c56604bffcc87207dbae6482c4"
    hash16      = "983ba48eb97f14c8324eec383554019edebf80ee9ba04bb856a22f62caaa441c"
    hash17      = "7ca011424d83469855a8d175d177d7bd1291d3d60ec818b0eba5d549dc883c38"
    hash18      = "6c8ee5ff42897327960d3966b11b73bce67c94ed16f0216759375bfa945ab661"
    hash19      = "9e275be9e67c52e983ee73dc73b85e4341ee54ac6498c5212b8eb3acdc848f6d"
    hash20      = "702c8b837a14e7c64dfd545d54d795526c3af53780559f6347696cc7e578a4fe"
    hash21      = "cb72ee2fe17c558d5e2bfb092520eb881f0b662ac55e9e6f413d33fea20a30ed"
    hash22      = "698633fec6a50b4866c101652242f708c7ee4f77be2be88b2798b808c44163f2"
    hash23      = "18f0a3856f983576b46d9935b5cf12c7751c749930033dcf9c653eb4e9d4e142"
    hash24      = "46289621d8f5fafc58b9ca927e547db68ffcab215b41faae513cd59fdba715b1"
    hash25      = "8150122882e51a52e433dc678768b2f796ebe75454adfab383009573e719b232"
    hash26      = "ea937f0f33283d45f38e3d5a4d82d01ced25cc096b1b76bf7b2fd414c62cd031"
    hash27      = "287e5588115062a82f7b6cc035a3d0d9d738d344ffde0a3ee8ebb111a4b8208d"
    hash28      = "6f556624b9b237ec9366ed0807350ba505315c94f9db91c691bae61be76c1a9b"
    hash29      = "a14052f587c5c1973ccc84dce5428a64183d7c9a399d8d0c22680382a6d46922"
    hash30      = "c689570de19bf79879b81a2f5960fcc5774f8e7a353234e28593b606af036089"
    hash31      = "0ad0ab6483858e370b7fd9c5a1149923446ac13682698cd546b36236700e2590"
    hash32      = "a8af03922b26838ef33222cc03d3274c6aa8816cf511aa803cafc70eb284085b"
    hash33      = "c8ab7383769c1ff39fd0bce613f731c7729da4a26043b31c8efba61e4eb9e7e1"
    hash34      = "10b3c3ed6bc09a94a7fd8798f31206da0293aab9d0a8db098da0933378d238e7"

  strings:
    $s1  = "{Process: " fullword ascii
    $s2  = "Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
    $s3  = "Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.3072" ascii
    $s4  = "{Processor: " fullword ascii
    $s5  = "!inject" fullword ascii
    $s6  = "path%i.txt" fullword ascii
    $s7  = "BEGIN SIGNATURE" fullword ascii
    $s8  = "{Windows directory: " fullword ascii
    $s9  = "9; Media Center PC 6.0)" fullword ascii
    $s10 = "{Administrator: " fullword ascii
    $s11 = "IE history:" fullword ascii
    $s12 = "CryptoPluginId=AGAVA&Sign" fullword ascii
    $s13 = "END SIGNATURE" fullword ascii
    $s14 = "{Screen: " fullword ascii
    $s15 = "{Language: " fullword ascii
    $s16 = "{Local time: " fullword ascii
    $s17 = "\\@rand" fullword ascii
    $s18 = "{Date: " fullword ascii
    $s19 = "{Proto" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ee32d455-1ef4-4411-b625-a64fcd2b1578

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion