_Virus_Hijack_Gen_Trojan_ShellObject_gyZ_aepfLIm_9_1_Virus_Hijac_389

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aepfLIm_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@ayMBdto_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@ayMBdto_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a0a9m9p_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a0a9m9p_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Z@aKTibuk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Z@aKTibuk_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.HuZ@aiy413e_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.HuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hyZ@aWevApi_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hyZ@aWevApi_1_1.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_gyZ_aepfLIm_9_1_Virus_Hijac_389 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aepfLIm_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@ayMBdto_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@ayMBdto_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a0a9m9p_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a0a9m9p_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Z@aKTibuk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Z@aKTibuk_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.HuZ@aiy413e_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.HuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hyZ@aWevApi_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hyZ@aWevApi_1_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a205403097d1b1fbf571d08a082ab1467df4e3c544bde66c4733a8d657340b21"
    hash2       = "f7e51843ed4e69d1d3073ff8b73e05e9d003e1eda117f325fec1190362fa0015"
    hash3       = "224754cf717838f4af1d151fc81da758dcf18ee439ab2553fbcffd148b626198"
    hash4       = "8883cc13e0f391979e828931e59168cd8bdb1814598323622a51f85ab302f3f8"
    hash5       = "5689db62c40666d63ef63ecb320d6dc65e02089823ab2cd3ea4df3a618957c94"
    hash6       = "e3b8b1a3e157be8984ac6884c7890f8a0b190866d42bed46da6248a94c50ab4a"
    hash7       = "8ac62cd67f11bb3bbc4a0b4f633cb8e67c5ffb91c71805a278c781c2a7340a55"
    hash8       = "a303927ac1959f47e7bec8c64c769d8bfe9555c683a03231f254708498589545"
    hash9       = "2bac5ee120f1e43a63553cef86ba6f3940cf539b48ab1bf703056974867f73d3"
    hash10      = "9ea06cd1f56ed75fe491a833d795860e7d1a098cde9bad12e5e37a01ca42daab"
    hash11      = "b8db351d8d3f9a95a48dbdf7c94a4725d772150fdd632d62a9070e9ad39f243b"
    hash12      = "e102db8a8c35cd3e03c348102da7c13d8b4b4c451eb125439bbc8c2822701dd1"
    hash13      = "1fbca3e9530cba2a549e69b8ceec6182998bcf0245d0000aa2ffc9ce3d033174"
    hash14      = "553f208826dc161e158cfb11004689292c3aa0968c73f049a3621fd721547e14"
    hash15      = "73ecc9f8486ba1bedf5511aa47bd858465529d6def4ef60441795608806ec219"
    hash16      = "cf4b0ac1854ba85f283cf7ad339523d593fadc9420cc9f73928db771978ab88f"
    hash17      = "863554520a4b52d05828943218c7e7c6115a87d3836cddc16d6c484f89fb6a66"
    hash18      = "84c12a44dec625fe29fb446b3677f35aada91619851c98a930fc77ad2cd42000"
    hash19      = "466b2bbc78cf5d22e379f9c5a6f03b230225a4cbde0433e3f299c24de4959bbd"
    hash20      = "dd5736d76f5ac364b5af69e389e23db7c68b49538867ff3edbdbe7e74e24b4fa"
    hash21      = "56ec9a1da5bc3d405a1f839cbe0cc0c70aac2192b37bb269e43152b7677a7b95"
    hash22      = "918323370638e60a75310ca23a0509f578d40f4b5511efe5c38cf58acdd56357"
    hash23      = "52d6b8e3f385451889ad975310b0a8f93b25895cfa4bd634b393f7213466c0b2"
    hash24      = "6121727b1b75b0c85e3c546827712e3151e61aa6267fc7f16a808de1b6ccb788"
    hash25      = "0d2de7ad522950d3e7aeeea5346bdb36a3d8b8739d51ff413c4c10bb2dd93cd4"
    hash26      = "8b82e75d74aaa00eef588a3875366908845c64e6f31197f0c6278d392056187a"
    hash27      = "2d5ec57a110fcefb6eec634d694c9c1999b9add82316b914500c719e38b7d4b5"
    hash28      = "66978316d52394b145ccd737a0203d20b01753a115b668ca976ca2e855cb5fc5"
    hash29      = "ff48c2bbe7041e51d80d645ab33f62be643c85500bba8705c23f19c36f6b09e1"
    hash30      = "6c1d87bc2cc66dd1bb007fda1bd96a6401e6eaa6df18e5e699760abec4209262"
    hash31      = "884029ed7fedeb818a11ac7fb866618c1d3d62da3f4777509975374ea0fabdae"
    hash32      = "e0e9a77e11210cd555d10fa8b1f6fc4cdec4274841b145a21bd3e8502e9bb7a6"
    hash33      = "62a4ca97822f59c9f1b6d53706ce8d9387576c256c08751d877bd3cb59e4868d"
    hash34      = "cfebde5708080522a30cd3977afe278005eae205bbb54f0df596d84dcb5bfe94"
    hash35      = "bcffd26661f42e5b7e5f406e6cfe5eb7ea1cb8b5101e638504345c35796fe595"
    hash36      = "2a04501ce8f773167c0cb27b34462dd0b5726d8e88bf6eae5dff79b33737e3e2"
    hash37      = "772222fe5c7cbadebf9b3a454c5bd28d05506fc4d87e18ff58a8a4ebda3f52f9"
    hash38      = "a8f43bf1130f4097ddda0d5c99d21667ae5397836e14609ff43ac7897e6b7fa0"
    hash39      = "495afbd0b5f9610d923b8b7c91e8c2a04f6365572102ef8ef01b9de5d696871f"
    hash40      = "af64d7e6549226eda9c8e29cb6ca0c6b393b5257a1cbdb9ee80e8e8d00240b60"
    hash41      = "29050d5fba1aa60586271df818a920480a8f75fa7007023a6303a6747f1ed086"
    hash42      = "a0c42478d63a4a645e057d6ae984bae8da01f590d8bea76251934b5a855813bf"
    hash43      = "e3d41fef5350a30a0fb0429e346b083b0230a357eb1dd144bc4147491fc1a484"
    hash44      = "c994dfe5bb7f5831babb8c5859b3b2cd21de327d67662a31efb2e5d7111faea0"
    hash45      = "e5147d7fe69645ea8f6d8214a5617ff8c01f5fa4e8677baf858ab3d07fc39b75"
    hash46      = "6d13a8b101b0c225fede434949cde295d861df00da0f68ad2c7d7acbc302a7ef"
    hash47      = "5b817ace6e3d813c6a31a46369105d404fd6301a8c96d40763a6217e79103ee4"
    hash48      = "1cf24144756e4ddb1db407eacfb63147c6b51b2c38e3f522cfb873a51fdb99a2"
    hash49      = "f3621d40188f122384a8431b3521324a644915f56377cf702a824b7b1023e313"
    hash50      = "5134ccaed29a58bd24d6ad6746109c7c61c9bdabd35346bbcced133973869c29"
    hash51      = "959b7437e887885cf06cd30a2366200b130506490e9a83549c257fe1a2d4c701"
    hash52      = "efa5d1a0aaa7f12bf8efef0acbb6d0cf78330be2d5666ba41dfd925885d1efc3"
    hash53      = "0213fb49267a8538644345f0684deb0fa474136be7534cdf1fd92196b286b916"
    hash54      = "aa6a639bf2b5b7b67838bd0c2f9127fc34f7245ec5e44717d161cd2dfa5115ac"
    hash55      = "d75f0aff1987cd6bef2a707c21c9d2663d9343fbdc6826460df486e1dfe852fa"
    hash56      = "300bdbfd36fde43a1c4c420e2e026dbc46ab20b10a06730fae8a51249366519d"
    hash57      = "684993edc8a4aa5ec065f279ea554f835f7d37d47606b53668396dd137596c4c"
    hash58      = "09539ac5700f49c1ddc13f2c55f4285df1c5676def959f29d24fb7ee2e2a6786"
    hash59      = "f592448d4c3c5dd126d7e869050a472f3380cb8938e0db87abd0a2a64556c35f"
    hash60      = "fd76047cef243aece1a402a30d0f85995b5a2fa5761fc3af0848ec6bb1d3df1f"
    hash61      = "c2a6d744a8717a5a9a5dd457d7fa255f2d31d902539ca83fb0fa488064ba3d10"
    hash62      = "885112b69b85305081c2704658b3451897cc1feadc55d7a6ab9c336948fb3e9e"
    hash63      = "769b1e12dc06d615dce11931ec9c6665c2d9992b80a128efdccf0421a5c40d54"
    hash64      = "2934cb4ab65220906c88bacca3acae277e2c9386ae482a0177e65f1f36ed8c55"
    hash65      = "c7e8d5a87fef57c6b1f16c5ba3425fe8b13cf1657de7b54ecd3d81c2016e951f"
    hash66      = "082f1317183c0b187f384db62a6acb663ac600b9f1f0f6f00c722d5b97619dbf"
    hash67      = "6cf0e3bf3818a82082dd7de096fa84ba91a3bd4c4949a8687ca249709d2b444d"
    hash68      = "3d22c37e30e5d710920339dbb3c3c5abb97e7bbe0d55f9058adb59dcee8ca798"
    hash69      = "4c95654dec68030a920c1aeb54c1d73bdd06c363bed1c9bcee4c1e38dc240a6f"
    hash70      = "4d432d8ade6f74a73121ffed75340d5fa66b10b7661b0ea2a8483823088e57bf"
    hash71      = "200b5959ee5c697295ba7799fe9f2bf19d21c61e12bd3caa97052fd9f6f74fdb"
    hash72      = "f5b796143d2b20bf488cc2f3c9bea25693568a9ac095d1af8f1fbedae98c57b5"
    hash73      = "dcaed207abac1a9d0691a20c84c9c3c579e069c39b8ffda2c371284c2e23129d"
    hash74      = "68a6fb14ca8c89bbce60b700977ce144d1249b245637e1b5b7bf4c9a8276c0f0"
    hash75      = "234aa36f5c3897579e4ccce6340f8e72713765359219cadbebaf053264c291af"
    hash76      = "f1853c2f0a32c477f5442bbb79f8346da48e47225548ef55c7e4d04dec48ff19"
    hash77      = "bf44a0453a5588a972408d1f4d6de98e43f88eb653a468fe9b5013f6e701c238"
    hash78      = "5168142e71599a98e9cc84e159574e48e1e7dea179127b179ddc007f8f187d70"
    hash79      = "e76c00fbab668ebf77dcf4480dfc7f3b431293f32df7877ff578520c4aeb8aa7"
    hash80      = "a4c835ec5822c7d48a6906a49bd8bc5a8d9652a2b3566cbde2a4683222076d86"
    hash81      = "ccc1aff4ab2fd635360d02e6a9bf2a212b3f03c3943f0fd21ab69e4819213d78"
    hash82      = "7096ea6f5878db719c55c43974fbf59d5b405e917b1333f80cb5441e3f5253d9"
    hash83      = "bc56609236febd51fd4453869f64775e6747ed68a5ea1160e9200083bf954d11"
    hash84      = "15c6619a96c86cd31b08ba5300c0e97d9815f5be16f28bae3ea7b17d0d23a9cb"
    hash85      = "e55134b7b8769dbca1a0e2520b73ae28eca78f94c685b549c59b1f26256d751c"
    hash86      = "41647adfbd31ab15114d31748244c521ee730c2d419e32f940f8ecfc98b46c8f"
    hash87      = "f455b59172fc55e54340f17238a4607d77a6ac401b965b949837273f4e4606c9"
    hash88      = "551e829f4b06bef6149b5228a87581ed891f1f8b95c7892fb2c2429426a3d59c"
    hash89      = "a397aadb51105c7b589c85c8c2782843e2a7adb3a28cc1cb92b62fbec6108c1a"
    hash90      = "3b8b0ba4badd66cb572fdab09133a25b5bb6fcfbd3c49106b30b1064b92e1116"
    hash91      = "e5db74204e2795102c521b76ff3ff47188d19c23476794295dc6d5bb0898832c"
    hash92      = "9f3285b6da89cb455e61a06f3ff71bed988c1dbf3cbd5dd25acd9bb2a89a3c32"
    hash93      = "3975c946aee8f85c2639bfa811b5feba5e26a60be6b31533ecdb615521d3d3ba"
    hash94      = "5e3e7d905bf4950e257a3898a21c0f1372b37d272e6f2ca62935a3fff5dfe8ca"
    hash95      = "9c1db80d67617e3c35a70003b7241442e06fddca13ae0eb9f3b12d0e5cdd385f"
    hash96      = "3e313c4458bc8eaa49cc6fac623eed0c8d31c9813960494941fb023a521e3fea"
    hash97      = "87cb6c55e24d78de5e70cfe2f8624014d21ac30529836da1dab59a7a43d7b285"
    hash98      = "fecf49a38774fb215c2213fb3c265844de363be50f850052edd84ea92d1538e2"
    hash99      = "dde2b1f08f8c2aa4c72b1abc0193dbb056dec43966fce9512451202c3e60841a"
    hash100     = "5f988d4b5ceceb5960df099168549d67fefcb7bfe67976ab0aef4e2d82c561f6"
    hash101     = "ae24b13c154a97b2ddf2d66f977bdfd1ae500af4c6b116713aa7bb0479ed991c"
    hash102     = "a8f226bdf5acaaeb3a8a021b70a54faf903147f7428cd84fc8a76cc2cffdfa4f"
    hash103     = "72e8bf994a215b8d6d1817f313886a9bfa46c1206e0d724b2ece00bcf78ccc68"
    hash104     = "d8cdeb7c4b5ebc3f19913f45e19811b92902171151de362694738e1a626ff41b"
    hash105     = "1a75942592e601930b0125b90e65972b6fc2504741510f193eb798db028300d9"
    hash106     = "70098c7733c1088dedeb1b6fcf9d26b95c833e98936a40f49b9c52a70365937f"
    hash107     = "7850cd8305cbe8dad0d8366017dcffdd5f9d1f1c1e9aeddc081f344735f4c8c1"
    hash108     = "94913a1b60891d8b417e773473f9be4c36552895cb0460662fe61972bf501415"
    hash109     = "7d467a43227904f5e93d174e82786dcf458b6bb2bd7f7c11ec47df3ebbc850b5"
    hash110     = "4144d1875bc309aa7205b5412b3e89466aef7e88ca24e4ae938863c7a5fbf194"
    hash111     = "fed2237c846019cf06d44a1b1549dba7bd459bc15602d19ab056e1a6a8afbb39"
    hash112     = "8e59de5cb8c6b1bbf48c318a737d1e1893b659b204e15f2b855e83daf577abcb"
    hash113     = "b1ecc9bc7787f65cf4b182c61e358279b4cb7ee01cdde449bd17f6883b478e35"
    hash114     = "ae9e10547d90258c43db9ef3d9a6a6fe4caa71037a73580b606c84a218e6d598"
    hash115     = "87da54c45178ab6d259fe556f9211b017601df019dda54315e5e7384f262f55a"
    hash116     = "9da5ec70b5317bf89e43903d718b004ba77c8785a9efe55fed497bb90d542e1d"

  strings:
    $x1  = "tor_socket::recv_cell() [circuit: %i%s [%X], stream: %u, command: %u, relay_command: %u, payload_size: %u]" fullword ascii
    $s2  = "tor_socket::send_cell() [circuit: %i%s [%X], stream: %u, command: %i, relay_command: %i]" fullword ascii
    $s3  = "tor_socket::recv_cell() [circuit: %i%s [%X], command: %u]" fullword ascii
    $s4  = "socket_buffer.read(command) != sizeof(cell_command)" fullword ascii
    $s5  = "circuit::destroy(%X) already destroyed" fullword ascii
    $s6  = "tcp_socket::read_impl recv error: %i" fullword ascii
    $s7  = "Ping url %s for %d times" fullword ascii
    $s8  = "circuit::handle_created_cell() extend node is null" fullword ascii
    $s9  = "circuit::rendezvous_establish() [circuit: %X, state: establishing]" fullword ascii
    $s10 = "circuit::destroy(%X)" fullword ascii
    $s11 = "circuit::handle_relay_extended_cell() extend node is null" fullword ascii
    $s12 = "circuit::handle_extended2_cell() extend node is null" fullword ascii
    $s13 = "circuit::rendezvous_establish() [circuit: %X, state: established]" fullword ascii
    $s14 = "introduction_point is null  [circuit: %X]" fullword ascii
    $s15 = "circuit::~circuit(%X) tor_socket: %p" fullword ascii
    $s16 = "circuit::handle_created2_cell() extend node is null" fullword ascii
    $s17 = "circuit %X is destroyed." fullword ascii
    $s18 = "tor_socket::remove_circuit() [circuit: %X, tor_socket: %p]" fullword ascii
    $s19 = "tor_socket::recv_cell_iteration() !! received cell for non-existent circuit-id: %X" fullword ascii
    $s20 = "circuit::circuit(%X) tor_socket: %p" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (1 of ($x*) and 4 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b0475a1e-3e0a-4077-9204-67a52b5dc695

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion