_Virus_Hijack_Gen_Trojan_ShellObject_gWX_aeFgVVo_5_2_Virus_Hijac_262

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_4_2.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_gWX_aeFgVVo_5_2_Virus_Hijac_262 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyY@aWevApi_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aag1Gcl_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.uuZ@aiy413e_4_2.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "f7207e80f7033d49646fab7c882ad80e8593ccda74b900c0147e1e9133bdb8af"
    hash2       = "47b5d9c2e5b04ec6aba8cdeacab65c45ad3e8c9c4be1b008abb75595b37f3302"
    hash3       = "1975f8c4afb3c2c70b7f2b79ca75a80edaca2e0827b15540558db3bba1c7ef5c"
    hash4       = "a0df192a7c2c405839f7a29651cc1b0a2f56cab4c6ed8cc574e8e97daa07e8f0"
    hash5       = "8163daceb55c6fce39ace1fb4c58ea4a8e136c96fc2d6216c6500883e842c4e7"
    hash6       = "2d471d1479d6452a694610e8b8d07b65f2682bda97d43ca6e88b5a0bf49196fc"
    hash7       = "6f9b6d9da4e59f833ea88dfe0acd4ccc4c0ccfc8502fa2964d109988da5f216e"
    hash8       = "eb190c08814c10626f7c1c46dbd349a260dd49aada11cbc7e8503bcf05a7043f"
    hash9       = "971b7acdebec4ae14b77137ea38b466f6dcb0c46cab6477ba707defb9f0bd3b8"
    hash10      = "16d8570e09f4a1e93d47f76a41b31d09d4b15900a2a11208ab911aaad62a813c"
    hash11      = "91936a91428daac1fce5b55b7a834b2469294ad4a0b7612118549f8359c2d51e"
    hash12      = "23ad5959092e0a635bc8ff3f9a0073eff1a6b71d25ec9ecc464d9bb0614f0917"
    hash13      = "71d15f8436787f007b1a323e07aa1c35b8a11eca1fc4b8dcbc831e8d5d2918d6"
    hash14      = "a704c24e3bf9da0420fd444e94f6f156ee99b715e890dfbf12018c56b6ac5db5"
    hash15      = "e3261cdf4e7483085317063acf385b2c87fe59a7c9ce23c6334d1a04dbcac4a7"
    hash16      = "5a490d0bfad90b1576a4f496989c003ed20af29a40df2fa9a07edcc2bdc5244f"
    hash17      = "96dc5e85908171a1b7a00d19f9177aac5d48c86a12cdf54abe4eeae73baf960f"
    hash18      = "fa06cf151bde568a688dda37d76cb5112628057b714e3e6be358f55348dcd237"
    hash19      = "903780357f8d1e3061fab0e8f50b03ce32907e27930a62a7ee83f031049ee8c5"
    hash20      = "63eb338e51c7e3df5392748cb91da9e2b885958eb9a9a8252c39b951f7667735"
    hash21      = "751c75776e267e95ab685dc9b5c1df44cba0d8ddd52649315fababdc72d37796"
    hash22      = "7b068a79fb2d6a13b58e4abaada05bfd45ad1b277002101b37351ee50c5c346e"
    hash23      = "2415acb8290b91200645c448565ab86f5300ee933b9c25109718285d3697662b"
    hash24      = "bce63c468f29a66bef4148948a1594f5b3dfff12b2b6b647cfc0b432ca880237"
    hash25      = "24604b0f22eaed1c87dcf9dd502477b81c1e8c7f829610993ea6d8e280eb85a9"
    hash26      = "b11f3736f0acc91690715d9d3ce201bf242438fedc738437a457593ae7d9af9a"
    hash27      = "a5328fd93bb5b2fd42679bcb8b61558068bdb68b64984dc3c8775226f20a5e56"
    hash28      = "0470210e6786035a424fb98b5c40c30934d215b505580801c32fb464a150d2da"
    hash29      = "75dae4e2a5d8c39a1ae8ad06c269c944835df5f4c035b2e3d6086a9747a1acd5"
    hash30      = "8564578df4cc2243b830f8e79ff81f493f46ebbbad6770d4898374bd625f0982"
    hash31      = "aeedc1a0bef85b0df68aaee18dc18e8163d6c46fd770cd0e35c3a63718116969"
    hash32      = "cd85627abb1545acfe50bbbb5f3a0e35dfd448d1137666b11be5e0cf04e11d4a"

  strings:
    $s1 = "gram must be run " fullword ascii
    $s2 = " cock in" fullword ascii
    $s3 = "Want to" fullword ascii
    $s4 = "rape)+exe" fullword ascii
    $s5 = "=VC_TY.D,butt%,134" fullword ascii
    $s6 = "}~`DATA" fullword ascii
    $s7 = "S type" fullword ascii
    $s8 = "sh[Buff" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "359d89624a26d1e756c3e9d6782d6eb0" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

ecf68911-236c-46fe-9c89-586725c1cfa8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion