_Virus_Hijack_Gen_Trojan_ShellObject_dyW_auLFnao_17_1_Virus_Hija_287

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_25_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_27_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_28_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_30_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWELKOd_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWELKOd_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWELKOd_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWELKOd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_6.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_dyW_auLFnao_17_1_Virus_Hija_287 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_25_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_27_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_28_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_30_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@auLFnao_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWELKOd_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWELKOd_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWELKOd_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWELKOd_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyW@aWV0B1k_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.dyX@a0MYK1d_6.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "1abf342c788256fea89a96426efba2979f5bba081ed706c95facbdbcb5209f14"
    hash2       = "a8f27cc5719cc09cf612523a60ee1e4d1423a266ab24b3d87f8059d8e1c6f69d"
    hash3       = "ed7662c5bfa5fbf91743927533ce85f050ae4e3485316ee4c97923605eb13e0a"
    hash4       = "f40fe72a9f231599c5adef2c2386fb20511683ae201dcacf8d4c6ecbf2a9455c"
    hash5       = "12df5f115fa6663fd4408d4064499eb7a3f3610b6ce76809484183c49241e1e4"
    hash6       = "78f1437e6e579e0d877095d8480e1b94e751ed9fd90228dae065fa7960decbe1"
    hash7       = "cc0b37e10c9e7d60272f354ff56878556afa0bb68e35fe93e2729f8e71bc1eae"
    hash8       = "164f5d77e96208abd1a54db7d76297e5c219109f2502a9f3e1f15d46dfb2b157"
    hash9       = "8ebbd2760508e5e72b2933510cf415438adc44d2ffc86e7ca3731921e3e52e0a"
    hash10      = "402b7f6127a11b824e618e6bc2adb6005a46081fe9252020cacabdb32c4a6302"
    hash11      = "bcaa57298f0b6810f42df07dca8c896cb8de1102f7357e701f47b0daae6670ad"
    hash12      = "bba873f28487d3f7eb53b66f2c2894d6041ed003b9c4ab4aab27e8cbfddf80c5"
    hash13      = "8e39d7263af6e16165cb81006724767dea0955111f2bd6a2df2c89a00a2cedde"
    hash14      = "4ab026da4f0df17224bf190c261dab72f06e40a3b15b44d79fdedaf401f615c6"
    hash15      = "0733a9ae261b084118efbb9abe34294a66111421a421f7f163facaefc7b388c8"
    hash16      = "0d796956cfdf2ad092aac6d9336db3b1e74a2f8361f13b0a6eff73ea032149a1"
    hash17      = "02869dd6dcaadae0925bacc4c017ac5c1770fe6ff4ea146c1467de4cf9ee76cf"
    hash18      = "60991663d14ad6c7905823301bdfc67ef632e37046db82acbfda4a91c7364484"
    hash19      = "57615dc0ce2d330e4875fab9e73ab067fb75d00821f0dd8697ee2fd8c3c68f8b"
    hash20      = "e974a31363b2a6d9ce923bc771cc2eb3e9f2162da33b1e101d10e49d9c84576d"
    hash21      = "8a7c9af0feb64e3eec44d184e9818a8588d06513b6cfc417c073cbb4b988dea0"
    hash22      = "92df28c68ed5ad8ecaab2986d0379a76c31ba5937511dba2c7c2847589d5bf2e"
    hash23      = "b9011c7be350b2e8fc3c7a9e82b4571d8f0c4af25e5e2fcd7faf85017e44f931"
    hash24      = "16cc455f3264931ad4ed9dba96987580d6dc69fbf132557492e4ccee0127cc52"
    hash25      = "294b0494baf481b0ca707436f22e26ec26902fdb12b3cb91e31dc2ea52e26720"
    hash26      = "d897ccd4e40f1219011698d30d4004b70edd71970689811213c53600563ca3eb"
    hash27      = "3799bc9954fe618d429352d8c17fea1ec907f6600e5d4602434d7dd65f8a0140"
    hash28      = "9dfddc53804b8d14662802a06eb9fc90497d807022544962805efa4367a1ebb3"
    hash29      = "1a72fcf0697f519234b1d5c95d35cb5b9fe39cc4e526dd315facf70209182c09"
    hash30      = "f25b82c8ed60dab26830a9c1937368932d1f6e1eabb040fc3460369333366823"
    hash31      = "f1639ceea43d91ca68e35c6d5ca329a581c8fd3926747f729c4b2aba696f6610"
    hash32      = "eafb3cd577be36d6e5dfecc609a710dadaea9e7295237c92e20c081965e9bbb0"
    hash33      = "705384446c92545872597cc91f270d71568a084ba52ad44f9f51a12d39597a80"
    hash34      = "5aae639517b8fa2027a5c751532c01bb0aaf52780c699ea592ea26e1c5a7cba5"
    hash35      = "23c6020a062d6b12c2a07dbb8dac544bbdc5df6155edb88570cdc259e60b18fe"
    hash36      = "9a15840ab5bbc928bf9558a8107cdfb032a8d8af8e2cbe19f82cabe7e088fcdd"
    hash37      = "da35e3f8dc769cf2b0b6f34ed806e1daf8834df2de0ddfa698f68172ed1f457f"
    hash38      = "fc7c419991d8e3521fac232994fd6ec24127defbf35fb6a7eaedf280310e6b97"
    hash39      = "43ff037737ffba75364ef3f6228296d256f4e607487b16dfa5af4a57212ea5b0"
    hash40      = "fc20034435ecdb0fb217c093f885e0a61c23fad743a90c2859e00b2ce9b3fccb"
    hash41      = "d4211f4ca978cafb16662298e1c8220b380210eeb62af4bcaf61e4cfd46bc15c"
    hash42      = "a85eb45a2a91e41a921d6b81be084c70e9e4f7c44f53b29f03fd1c273f9980bc"
    hash43      = "00cef7f4d996791b82a9d1885afebd185e92174ab115a292167c6d55fd80e19b"
    hash44      = "e2697b0aeba44f359a87d5f3f79e9b08b10ef4ab20a1d08d46d134b7e226de7e"
    hash45      = "7b55e778c83e02e55449867102dd7389192b2ce6bdceb5c5a5a00d420a67591c"
    hash46      = "af2e55d3d86fe50d98dc67fcf9ff17f5166a257b702cf42a2a4e27164e932fc2"
    hash47      = "7519c06fe9141a26deec46bb803fd2a1ce67c638a592f80d0861ab44f19f4d1a"
    hash48      = "eaad1f637dd4542ef385b9eaf37299013051dd99decf41e1c396c07f1a73b030"
    hash49      = "43e38b757549f15e6a96dd9014b8c4f3d7b82cdffcffb2ca395dcf490c613205"
    hash50      = "66b7889a878aabf2ab2db5bc2f58b3d07197bf324150dc0bf7b0619ad31d5e03"
    hash51      = "be95b98a071c3a40aa009cb63740cc3ab67721a4b420e0c587303f13f8fd4368"
    hash52      = "effbfbbec6405fdd3ebc57014ca2cc5bf5208e93de509f77b98f6d44079e488f"

  strings:
    $s1  = "Password  " fullword wide
    $s2  = "JC:\\Program Files (x86)\\Microsoft Visual Studio\\VB98\\vbc14663.oca" fullword ascii
    $s3  = "Variant of Dark DDoSer" fullword wide
    $s4  = "Phone / Host  " fullword wide
    $s5  = "Network shares deleted" fullword wide
    $s6  = "User Name  " fullword wide
    $s7  = "User Name/Value  " fullword wide
    $s8  = "&type=Form Grabber" fullword wide
    $s9  = "&type=Email grabber" fullword wide
    $s10 = "Variant of DDoSer" fullword wide
    $s11 = "Registry monitor active" fullword wide
    $s12 = "User  " fullword wide
    $s13 = "Action URL  " fullword wide
    $s14 = "Entry Name" fullword wide
    $s15 = "Resource Name  " fullword wide
    $s16 = "Web Site  " fullword wide
    $s17 = "Application  " fullword wide

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "3e8ae3bc85823ef9afa9731fe8e9fda0" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e04167d3-4f3e-4259-8841-4bd0c4a3682e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion