_Virus_Hijack_Gen_Trojan_ShellObject_f8W_aKzODno_7_2_Virus_Hijac_426

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSCh4ub_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSCh4ub_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSCh4ub_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSZtDuk_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_4_2.vir, Virus.Sysbot_Win32.Mydoom.L@mm.vir, Virus.Sysbot_Win32.Mydoom.L@mm_1.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_f8W_aKzODno_7_2_Virus_Hijac_426 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aKzODno_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSCh4ub_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSCh4ub_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSCh4ub_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_13_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSmvFGj_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aSZtDuk_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.suZ@amBwvTb_4_2.vir, Virus.Sysbot_Win32.Mydoom.L@mm.vir, Virus.Sysbot_Win32.Mydoom.L@mm_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "6150bbc3211700bfb6ff3a868bb473d0c01991649bf616ddc5197b91678138b3"
    hash2       = "027781c49cad09ce0b29158f4ad6e93b48fb31548dcb1d843d62b1035547bc61"
    hash3       = "a2bfb832277c53e1fb3ecdd9066d13efe2ecfb996f688d01094bc9f1f3369327"
    hash4       = "89fb48c0611dfc1eb0fece41dc8fcf748c590a96981af9b39fd5c2be4f845836"
    hash5       = "6dbd19ca410c6d985d6156bff13933bb017ec52d65a5a2ffc57a9558a9c57077"
    hash6       = "570dbd4c9b95519039519c00afc8be1ba21c6062fbcfee22488ebd30170a9785"
    hash7       = "896345bc1768b591f3f4d0e9136682356909058712ec3ef410edc320588e4084"
    hash8       = "ae83139c2ace06e2978c9ed1e75b4db1a5c6a66c3b66a12d2a6cf23ccc7e4e9b"
    hash9       = "b6b96984e43d3a7492a7096b626d373aecb5b2110e648b7d83bde3acaa44f877"
    hash10      = "66c4e1a58e79eb2712cbbd8d3a984fdbdce80feb609ca0f5428ec7ae4603c75f"
    hash11      = "9b8880646b7d6a1fe2e2e1c5f30cca5b33afccf1f8b1b74874670dbe5dd79136"
    hash12      = "b8df58481452d9cdc2079d8f3a339bf4de05cc9bd86328dc913420ea0dd6f9a4"
    hash13      = "38df984cc0d233246f937f0105d3364a3b4f7baad049b4820fc604bf66aba55b"
    hash14      = "a098d674bd419c2cfea05ad27eab13954667eaa91f788f080c0a5ddd23430402"
    hash15      = "f45eabaccf040873e111dd0c06ae0f2cf9a0b3ada11d7f0a26b75668a463f4f3"
    hash16      = "211f5ed4a2f59288df802e89c8a971ad6737e957a6c64822a4ad16f36045b830"
    hash17      = "7cff5633e75ddd3151c6fe1d53469e2edd25a11f8b2a661c441796022157311b"
    hash18      = "4328b22ed9d6b053803390a42083b09c7ab75f22517414b9fba7315231f44578"
    hash19      = "27f8556afb930cc66cd359a07be652820e2c21031ca589b61a6468376f42aaff"
    hash20      = "93b02c1a5347e1fb4a33adcc52e29eec0dde8f6d1a427661f6fa0d3951a689db"
    hash21      = "9f1b0949f1c366c537f918c813ed476eb9340b27aed4807fc5783f888486f57e"
    hash22      = "85669f0457effaffb104743827b357fd71fda9b800dd7041d05ead8cfbb21c3e"
    hash23      = "8e845ce5b079a0c00713b6817ded9ec84022e49c6158ab18a37a03fe7a3138c7"
    hash24      = "944022969adced892cefdd01c1f99c44a25e7150d3ddf0ba07f874317251b822"
    hash25      = "5f2f3f45a98732d46100a79e91efe83603082203553532bf144962724f8026eb"
    hash26      = "3e71a567974d600b4f3427b44bfb5567fc33ad9531d03705d56d4ae6c80e6b02"
    hash27      = "04b388fc0c7bacdecd97bdce79bd8cb5b00b8973f82408c877f209b7aa279813"
    hash28      = "dd213642161d3da69f7e79c0f70973ca3551779039f9321505808da090d20104"
    hash29      = "69d99840d92e57cdb444ddc15fb5e9daf48308e8b288401cabb7b4552799ce09"
    hash30      = "410a32a40e25075a2baff314ec912b3026ac3feb1b6f982dac34d9ee5db4182a"
    hash31      = "3fbcbb6f1080da6662ca9399694ccbe8e3764d78f7099802fb9f08963e9337b0"
    hash32      = "a8c5fb3f2d6ab3719ef620f122633e4b792ac899e72feceb44f388e6cf992697"
    hash33      = "aafa613c04338be4a76f849cecd36e54d84b4faa22cb08bc74b28cc8f410c3e8"
    hash34      = "f1adb39907f4f8f0d91e9c2bbcb8dc18ea7d3ec996306a666f227c7865338439"
    hash35      = "e737f4a87067041146644fa921454eb1374d61ceea064e7f42b383db5da16029"
    hash36      = "d606e457bb1a2aa4e0c3536dfe6b5898460e562ba86ece947e41c9bc4247caeb"
    hash37      = "5ddfd3843ffb6ffd261eb3b2e337e9c8c6795f8a243306360733215f870e9b26"

  strings:
    $s1  = "----- Transcript of session follows -----" fullword ascii
    $s2  = "Host $i is not responding." fullword ascii
    $s3  = "Please reply to postmaster@$F" fullword ascii
    $s4  = "say helo to my litl friend" fullword ascii
    $s5  = "not reachable within the allowed queue period. The amount of time" fullword ascii
    $s6  = "  while talking to $T.:" fullword ascii
    $s7  = "The original message was received at $w" fullword ascii
    $s8  = "The following recipients did not receive this message:" fullword ascii
    $s9  = "This Message was undeliverable due to the following reason:" fullword ascii
    $s10 = "Kazaa Lite" fullword ascii
    $s11 = "Your message was not delivered within $D days:" fullword ascii
    $s12 = ">>> MAIL From:$f" fullword ascii
    $s13 = "click me baby, one more time" fullword ascii
    $s14 = "Winamp 5.0 (en) Crack" fullword ascii
    $s15 = "from $F [$i]" fullword ascii
    $s16 = "Your message was not delivered because the destination computer was" fullword ascii
    $s17 = "ICQ 4 Lite" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

7d4df4a2-b92f-4abe-930f-c4b140a8d336

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion