_Virus_Hijack_Gen_Trojan_ShellObject_m8Z_amOckRg_8_1_Virus_Hijac_429

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.m8Z@amOckRg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@amOckRg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aOGzovi_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aOGzovi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aOGzovi_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@auFLy0g_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.mCZ@ama2@Cb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.mCZ@ama2@Cb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.mCZ@ama2@Cb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.mCZ@ama2@Cb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aaHUzge_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aaHUzge_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aaHUzge_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_27.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_m8Z_amOckRg_8_1_Virus_Hijac_429 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.m8Z@amOckRg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@amOckRg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aOGzovi_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aOGzovi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aOGzovi_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@aSl2g6j_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.m8Z@auFLy0g_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.m9Z@aG4fkNb_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.mCZ@ama2@Cb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.mCZ@ama2@Cb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.mCZ@ama2@Cb_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.mCZ@ama2@Cb_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aaHUzge_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aaHUzge_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aaHUzge_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@aiy413e_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.MuZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.muZ@amBwvTb_27.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "4ac8cda6194be713245267e51998a2d08ec58e2643cc0970e21d498cc9406c9e"
    hash2       = "a20c6053b94928f5e2cdd43d65927a844e4e699bfabb60992fd870e42bfb542a"
    hash3       = "ea033c8cdd53b81b095a4fe45594623aded198e980cc045a1ff97514f011e7ba"
    hash4       = "843a6584801e2b440916d24939c00443bbd2512671fa3c6841929fe08aed5948"
    hash5       = "d7efa8f42d58f9d58d24d048dca64b64c3a9f11d565839183d429b4b06a92bcc"
    hash6       = "c6f0be24689bde1bcf3f83074b4d51c57d5b249e7494043c7b6cfe0e28bf969f"
    hash7       = "e6dc30b3d38ee3bad32ea724ad597ed8df4982c217ce13f58caeb1752d120b22"
    hash8       = "0f5ee320a91614fbd3882b37724dc8b325355841f8f458d6027ba9c9be089b4d"
    hash9       = "ded662a308f9771ec7326606641c7ddf17a4f2e2bce0912d8d4638f6f4b6aa50"
    hash10      = "0a51033665356ffc276cce3e34797d78c717ad9f216413f25624209f94fa34bf"
    hash11      = "7649b0d2a11b0a9f6651b1188af26af17ac05a5c717d2251041dc1865c082ad4"
    hash12      = "86c14c7d83d51a550506d266ddae1cf422df0d3b2a3fcc53382501aea20378be"
    hash13      = "ec325342c7d95bbf1782e4750b61a9bef6c06379a72e5504027b2ed2fcbf0acd"
    hash14      = "012b581efa0d79cca83fcab95bb778e323db9267f0f4a113ead1bb31ba89f39b"
    hash15      = "c44dad1cec69676fef430a195ac52b2ee08947e8be79269c603cfbbc4d27d0ee"
    hash16      = "667529c27d9f037246a9ce6218a751837e4e4c9c30687cc68f0cab51c52b7cc3"
    hash17      = "6a719676618eb96b0c9fb455d31f72e39bed51706f8d8c985ffa6751a5f55711"
    hash18      = "4228fb3c78e157e840dd0519e725ce241a616044b8e2391325d3e5f03e557b92"
    hash19      = "5b2c387b071cbbf94d3432d500edcc9600982ea076aa00d000f95942337075dd"
    hash20      = "3b035c6d711a1bb5ceb4f0109f367a957b499151b356e39cb77318b5a1743984"
    hash21      = "b3a6a519630d8d9194cb9442e3d16ad15a7dd1e3e2641add48068a8327827e09"
    hash22      = "1380a0bb66f92cdf58a032e2c9f344ff3b199e5262b7449a38ff9d33a73043f0"
    hash23      = "a1c048fb9df3ca4262ae8caca26871265ec0519b4c1443e7aff24d564e4af42f"
    hash24      = "3108e2bd3a611dca1dd5ea01198913352fd6ce49c1717f7fae844bf1f4d36e89"
    hash25      = "0c4246581351343b69ed3d09b765eeefc9fd36eeb2e2824a1955c0f1c7f1d31f"
    hash26      = "24ad3658c93c56eb1f6bca80643a6e8fe97edd929c2a81f03fa1e7e7e385387e"
    hash27      = "0b068a3586cb738d7e0cc3c03605eccc787a92e52b7829e4443f5af570d1b287"
    hash28      = "f985f46febb3d45835c94505986d61f561d9cd4e95bab39b11ed7274e1787b32"
    hash29      = "b266e7cc9f3c3d072ac7a34a184e31e52b53f0ffcc0103e45a29addcfe7cabcc"
    hash30      = "6c59e462a7faac26db185136f92845af9ee4968c4243d301b1b1bea4ab8bbb8c"
    hash31      = "69ec5369ea64c5c4dd4c45f925412a87955b071dff4b62f576ba816146e5fec4"
    hash32      = "b87ecc91451dbb86eea2838a99398eafe92f7153b741672f1defbb6a860e45a5"
    hash33      = "fe889ace2321c89cbb0fe073f9768ef52f4534215d5fcc7040af4445dace6a51"
    hash34      = "856243e6da75400952217464864f4958b9139059896d0acea8ed12950d7ac94c"
    hash35      = "adfe149c8445fa12334d505de4d11c63f6ec03c636c98d8f756c01090d48ef50"
    hash36      = "1cfc834c044d91d11e832c25f97eaf5b55161cbe184bde7b6f2e758fd0ec9913"
    hash37      = "71e8fe4343ce4bebedfe18ac4c54439c51ded146df2ff099d8c3bd1aa361cf06"

  strings:
    $s1  = "WNetGetLastError failed; error %ld" fullword ascii
    $s2  = "%s failed with code %ld (\"%s\")" fullword ascii
    $s3  = "%s failed; Result is %ld (\"%s\")" fullword ascii
    $s4  = "Enumeration of the network failed." fullword ascii
    $s5  = "NetSample Version 1.0" fullword wide
    $s6  = "accessible computers:" fullword wide
    $s7  = "About NetSample" fullword wide
    $s8  = "CNetwork class Sample" fullword wide
    $s9  = "NetSample MFC Application" fullword wide
    $s10 = "NetSample Application" fullword wide

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "535fa6479108b5163f64223c5e835312" and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

35f33dd4-420a-4163-804b-f949e2d490e4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion