_Virus_Hijack_Gen_Trojan_ShellObject_gWX_aeFgVVo_27_2_Virus_Hija_301

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_27_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Z@aiqugi_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aCkwazk_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aO3hPGn_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.iuZ@a0EF!lk_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.iuZ@aiy413e_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.iuZ@aiy413e_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.iuZ@amBwvTb_47_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.IyZ@aCEmdoo_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.IyZ@aSgChKg_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8X@aKuHmDp_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@amCvSwc_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@amBwvTb_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@amBwvTb_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.l8Z@aKTibuk_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.luZ@amBwvTb_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.luZ@aWZUE8k_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aiqugi_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aiqugi_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aGAMRTl_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aOGzovi_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.nyZ@aG7qmhc_3_2.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_gWX_aeFgVVo_27_2_Virus_Hija_301 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.gWX@aeFgVVo_27_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i0Z@aiqugi_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aerna7n_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@amWqEpo_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Y@aSl2g6j_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aC!4gaf_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aCkwazk_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aO3hPGn_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.iuZ@a0EF!lk_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.iuZ@aiy413e_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.IuZ@aiy413e_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.iuZ@aiy413e_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.iuZ@amBwvTb_47_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.IyZ@aCEmdoo_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.IyZ@aSgChKg_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.j8Z@ai6MB5n_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.k4Z@a8!cJFh_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8X@aKuHmDp_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.k8Z@amCvSwc_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@amBwvTb_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.KuZ@amBwvTb_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.l8Z@aKTibuk_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.LuZ@aiy413e_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.luZ@amBwvTb_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.luZ@aWZUE8k_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@ae3yXvm_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aiqugi_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m0Z@aiqugi_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aGAMRTl_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aOGzovi_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.nyZ@aG7qmhc_3_2.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "6e7b0121a24c81b878cc94b7ef223ddd76700827b9594df4c1b29ca119820a9a"
    hash2       = "71987fd309762787431f6f6144d9faacffb7b7542c00a3687a1fa23aaa24d6d2"
    hash3       = "f54ea408256b1da9a69bc16030adcf74c70c1265bde24dca48e09dbb1afff5c2"
    hash4       = "0accb670d9f4091bd3da2c193f3b4f5c3704166e1234d8c2eb74b3901b7ebee8"
    hash5       = "e479bf3c09e3e2e163c644c334de02c2fe51213e4ab520fe05fa868adea98f8f"
    hash6       = "199361b8a3ca274c78687df4dba9aa137ff090c06766664d86e79d223f9326dc"
    hash7       = "12c0f92e70f6245ceebfba2a215a075adea3680895126b0fd559d3b12fc928b2"
    hash8       = "daae841ddd0f030c253a82a1738289112df59b3b5a1980ab0e3178502a7ca37a"
    hash9       = "2059a26fca8c08165bfab933da8eda9a3e8d248e6072216e881d8f2482c4e90c"
    hash10      = "859425fc007789edf26db0594f67c9b3623a8d96839dbbb147ce629bb8073aff"
    hash11      = "8cb9e3bd605f133afccd4e663bc7c4bc706464d2a7c2695942c192c674c32bbe"
    hash12      = "b2c7c99ba27e31d4f7075467bdd0e92c83dbf812d94b6f68e9601c955dd8f333"
    hash13      = "0ee4111498d50d31acdcf4df9ae8c4763c65818f475ec8a4f3047f64aedadaa0"
    hash14      = "13426992cda65ae3695c51468cdeefb637d1fc4849fe4d149beb4d6632bf3a9f"
    hash15      = "fad19a59532e6231014b8574ca7b869e7f407b4a293c823a50b3658efa7814fc"
    hash16      = "81a18e8c9320e77808bfff5bf8a43fbc39e2c49e4a86703346cdd752e0c54030"
    hash17      = "f51946cd716e699cd03e229f7627c870f9cd9a50b483bb88360966249bafbd43"
    hash18      = "65ba137a268a1d6ef1eaa83a2288e43ac81eb23cd04bd0d06fbacc83d9195e3d"
    hash19      = "0e2d2b9272894cb455cbad55152920bf8b0f9865037e92b5e35b6fa27d4efd6b"
    hash20      = "3027b49166ad7fca852a67847c8fdf401874511ae948b918bbc6f38a7a140fd3"
    hash21      = "7edee7af2757b887687d3a05c38e765aeca7cc485009733d415e5638ab7db3a3"
    hash22      = "8f258a3752bfed1cd3baf84419cdea126c5c02e8f723ac7af9dcfee9e45c094c"
    hash23      = "5d1b488bf3c1fa452a78dc36c7c3101637957834958ce53d379457ffa9dc5628"
    hash24      = "18818b86baa1e571a381545d0e899a3520303b1127a0a5a060562ad73ed9f4bd"
    hash25      = "f2bbcc6b59fc52fbea7f44da49c4f765868c306714fe4171234e11c80a13815c"
    hash26      = "74f7f525fc4e0651d8fd38784d5730ec5d39683f40ffff84470b648babadb387"
    hash27      = "90875a42d2ff4c5e1db5fb4b2d6483acdb61c7992332942862e6847fe6c3ae93"
    hash28      = "cad9b689e60fafb596199c38cd8ecc11c935eb93ba86def34b414621b770452c"
    hash29      = "874d96460fa55e9c27e57d88bda35ea8bea3ec382b3d53cf9d6e6782481cd00d"
    hash30      = "52e88cfaa9014f5fe16db4c8551d816c288e89a9377423e6596c439abcfe8290"
    hash31      = "fe98f39bf55836d43136cf5183f187917c48354b89f1753d6d9ff68d9a360eb5"
    hash32      = "ef4ddd714fca398329cc8dccc9df2aeb80b51675d78bbeedb479dba6351e6399"

  strings:
    $s1  = "<toast><visual><binding template=\"ToastGeneric\"><text>%ls</text><text>%ls</text></binding></visual></toast>" fullword wide
    $s2  = "This PC is running low on space.Click here to get help from Microsoft Support." fullword wide
    $s3  = "o7Clique aqui para receber ajuda do Suporte da Microsoft.+Entre em contato com o Suporte da Microsoft" fullword wide
    $s4  = " Your PC is running low on space..Click here to get help from Microsoft Support." fullword wide
    $s5  = "%L'espace sur votre PC est insuffisant?Cliquez ici pour obtenir de l'aide d'Aide et support Microsoft.*Communiquer avec Aide et " wide
    $s6  = "o5Clique aqui para obter ajuda do Suporte da Microsoft. Contactar o Suporte da Microsoft" fullword wide
    $s7  = "lp fra Microsoft Support." fullword wide
    $s8  = "Kontakt Microsoft Support" fullword wide
    $s9  = "Contact Microsoft Support" fullword wide
    $s10 = "%L'espace sur votre PC est insuffisant_Le Support Microsoft peut vous fournir de l'aide gratuitement. Cliquez ici pour en savoir" wide
    $s11 = "Contacter le Support Microsoft" fullword wide
    $s12 = "r om du vill att Microsoft Support hj" fullword wide
    $s13 = "Kontakta Microsoft Support" fullword wide
    $s14 = " para obtener ayuda del Soporte t" fullword wide
    $s15 = "skate pomoc od podpory spolo" fullword wide
    $s16 = "PC-en har lite ledig plass3Klikk her for " fullword wide
    $s17 = "i'nden yard" fullword wide

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

37690c8d-618b-48f7-a8f8-54791d74c20d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion