_Virus_Hijack_Gen_Trojan_ShellObject_g8W_ayJVeyi_10_2_Virus_Hija_275

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@a4IOpRm_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@a4IOpRm_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@a4IOpRm_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_21_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_22_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_23_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_24_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_25_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_27.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@ait5o7p_3.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_g8W_ayJVeyi_10_2_Virus_Hija_275 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8W@ayJVeyi_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@a4IOpRm_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@a4IOpRm_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@a4IOpRm_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCggSqg_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aCMzZah_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_21_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_22_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_23_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_24_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_25_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_27.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@aiHu4Wp_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.g8X@ait5o7p_3.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "52cc6cf3dd1de8bf5d13c198d9d65e392030abe886be89756b1d3ed0e972165f"
    hash2       = "0921085192d6a37290451fa882119e590a00522617ea1b6166f09ba7684a7845"
    hash3       = "4f3e507943ce7922269b3960ede26893a1acc221573b1ae2343cd8b9ffbb4af0"
    hash4       = "ea45b491ce31af028206a2ed664a06245528ef08a7334e6273dae4e486cc17bd"
    hash5       = "893178df667392ffe74eac94f271d012d71db41ac52a0fe152e4bd2b18015835"
    hash6       = "a7950d4ed270e7e8062e5600121eb9d24283dc5afba37a1adfbeb0e5e2e02dd6"
    hash7       = "b5cca62c25b0fa6bde7c3d3056ce9e9c8afff793cb4cf0a457dd039d746ad34b"
    hash8       = "2df360ba78a4e5e51fb986f998398b61e6b375b9c953d4fecde29bd2d7dbbbca"
    hash9       = "07a78fd3a6b6ee9603e8dcd90769844f6db5e914f0283c962bd188f26ad9a3cb"
    hash10      = "1be1f116b61b0b9b4a0bd59c754f9337b36f3c2a7238720b2a30ed5de23d4112"
    hash11      = "1e3a0c9e3f3cc1f5bba550362c1577d35376e46c94b989fae232c7b3865a756c"
    hash12      = "d071a59d63389c2c92b8fb8f8770693187c4cdfb11f5aafc333341cdb47d2f29"
    hash13      = "1903f9e33cc95bdb3cf0b875bdb467abd87b25fcb66ab157a06ee2beefb875bb"
    hash14      = "94ffd8c80c25610ad45d63f01e3f6c95505b5dd85ecb757be94140a2277bd458"
    hash15      = "c7ef87d24a51857771974d4a120ff358bd4d090d77724d3ad63a5a08ac819151"
    hash16      = "a9a81777356ac9e611c2bd05109ab6201bd3eea29054764e1f0a9a2678aa3bb3"
    hash17      = "c008e76f5e222d2c47e44a5e3fb5929596857a15756d2726d8ab7d4219889086"
    hash18      = "87377b1df38d2e3e9fa93788a996a2ad02f9bcf10745f3b478a2dabd26d30d56"
    hash19      = "75404776bb4916b0c7c6fd72d19a9fb9fe515c6d6df55aba5201ded88ec42e83"
    hash20      = "ff5812629ee297dfc26ca80904096a7d5a2f2f315cdd6e2bd2c546111b18643f"
    hash21      = "f4d8ae0ef39498fa81bfc10c738e8f53f466d6505f0cf32abd14a10f0c89542d"
    hash22      = "33d09b3ad2464a125d57d0cee1c7d3962a59954e6c60872a90904410565d5752"
    hash23      = "93d61f5ea822bd7146c9ed2207904f1815ab23225e3ffd1fb04087653700f413"
    hash24      = "926c729bb7a1b14c579b7110e60b754bd6aaec18164bee9374ca84eac0a6ec12"
    hash25      = "8ab6649c1dd1a40440055e260bb8626a46da603b4e42f6020cf85b4df27a52d1"
    hash26      = "d92fd4b76bbabab2577f1d888a28dbbffad94d60ecf593cf63372b649c7d9d01"
    hash27      = "c1615d8f8deefea744dd4d8b3a1866dbb145db326f2a17b64eb256293ef18743"
    hash28      = "e78dc134bf62321efd3119e9b143836eac2c3c32f883ee52a33580d60527956e"
    hash29      = "45acbce58bc35ac49d967987d4415c0ddd570cceb53fbecbfbc7f334b94caf24"
    hash30      = "e5f0a65766d00454a9f8870578d63948805e9e0290b0a71bb7199416f5387ce4"
    hash31      = "25709dfe403a2690efe3b0ad5e44f3f621491c5318aadc89b240d362dad9da6b"
    hash32      = "0b0b1b1dcddde409d104f71333ff3f684141035637e82661f2676f01badcd7b3"
    hash33      = "f5c246f99183027a01315ce4b785dd5aa9265b24d4441cf669be26ed20260e7b"
    hash34      = "88c7ca7044c11abd22fde24ce25ed3349a88f8fc8f9e9458e859a31cc48ecd89"
    hash35      = "261ca80192dd0e388114050b8409dc3a1bba409f5c92145758c808d6fa676dba"
    hash36      = "9555e8de29ebd8ceb807232f461108cbf5e809f7aadf35320e3c00ac827247bd"
    hash37      = "046ee2a447e4d13b78c85054846a63c70dd8119e7dc1d06971e09e9e6a1b1b13"
    hash38      = "bd055fe2ba79b1e8c72caa9dc6bf1fbb6b3b2d07d2ef9273aa250d1af9def8b8"
    hash39      = "4bc603202d1c4e7a66e9e4932e0e052e23fa24781f7b80ffa761cd13360fb12e"
    hash40      = "d27a7b3294a75b45ad21b32c1c33d3c90b48d89a18118968eb5563b75ed4e912"
    hash41      = "9972b908b0215c89bbaebf5031d13ab96e470df2b19f126182a254aaefd628b3"
    hash42      = "1d46d24f1cb06ea12c8da377583f653ab76dd1a9cad96901cd8626078034975b"
    hash43      = "3f1e7ce12366a4b61969e5386d9631291296981e512abd18022012e01ad7fad6"
    hash44      = "fa8db3a1345db47dce5b18985fc342d5deca36dae5d49a94f6e71ba20740ce52"
    hash45      = "8b2b9a84c0c62db0b05fbcfd148991fa83d0dfa36fb3ab942326006d244bfe7d"
    hash46      = "1528c455442e7f21ce8bbff348c943bcd6825fa5607e06b84684b648afbd22fd"
    hash47      = "5fb544f53ccf6712de781f33373b18eca6b2b3b1bec4fde2fd7f5f0e5c4eab21"
    hash48      = "069888715a275ee4ed8275da7aa4acd2f09fa86d7c9571c1d42744a2d74d1b17"
    hash49      = "572fc6035a9adf71ab4ef57ee4aec47cdf96760e07f109dd375c8fd1a87c4e19"
    hash50      = "606aaf489f58b4e7f50166bd36b5427a4a3fe3d423a3e5a32675df3e1b42c816"
    hash51      = "2c71b6970079dcc214b9ffd40a3e66e8e449183695ad4eb4964f454ffd9c0a3b"
    hash52      = "6c838b89cf2ec0d2e3a0711364da0738fa21917d5cddb3e43fb40cd8c7d468d2"
    hash53      = "95b355ab2b21cc2810cf460c0b353f0e24106e53e207cdd86f9f3cb2be2921ec"
    hash54      = "3f888f9a8837148060779d01bcfb459f48e7d36bfa507bbb0c4574d25e5cc2bc"
    hash55      = "9db2b99b127ccbe6e00661a827fe7c244e739fe23d1fca0cc393eead78593d3f"
    hash56      = "c84920bc645bd10903ffe60bf609fe9d269b3b5b83121f6672affe725b33c13b"
    hash57      = "60fffb29010ff6a027e8673fcfe07b14d0f4e0090b70176f771a75453bd4d916"
    hash58      = "e9f5a3da903093a050854beeff6aed99effd1c7472ca2846c4c8352319ca5736"
    hash59      = "0be22fa6ce5f7c4fa664ceb579d86bad05e338c5279aaf026dd501b8da89a731"
    hash60      = "8f71a46480ea27f2039a3a4ce783a47507bef134d4f8958838520734b3672040"
    hash61      = "a410a79f5ac00566a53e06661a0acce2d7751c27fe9510266a380db386a25ada"
    hash62      = "0847eeb59808b6dc0382bbb8a59ea43ea25c75bf45e4b38f936293b383ae8246"
    hash63      = "8b7ec088fc953f27e4e0a2c5727c5d96fd6f29b1f75d291412cb04f65e4273cb"
    hash64      = "5f2ae1791a2e56b2584546af354d81d530937c27b013f7803bb53e0dc4e1b5b2"
    hash65      = "6bac342d1efe82d3b9bb98164064a9fe817c0dcc2ae1e44f34978ebd82247967"

  strings:
    $s1 = "Execute completed!" fullword ascii
    $s2 = "Process name missing!" fullword ascii
    $s3 = "Process killed!" fullword ascii
    $s4 = "login " fullword ascii
    $s5 = "Error while downloading!" fullword ascii
    $s6 = "Rename Completed" fullword ascii
    $s7 = "Error: Rename!" fullword ascii
    $s8 = "Error: Delete!" fullword ascii
    $s9 = "File name missing!" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "842ba1c2436dd1a931cfdde74fd7ef17" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

edaa04f1-6d14-41bb-8579-05611040d8bd

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion