_Virus_Hijack_Gen_Trojan_ShellObject_f8X_aeOesjp_14_2_Virus_Hija_450

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_21_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_22_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_23_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_24_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_25_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_26_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_27_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_28_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_29_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_30_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_31_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_1_2.vir, VirusShareWin32HLLPShohdi61457_10.vir, VirusShareWin32HLLPShohdi61457_19.vir, VirusShareWin32HLLPShohdi61457_33.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_f8X_aeOesjp_14_2_Virus_Hija_450 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_14_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_15_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_16_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_17_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_18_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_19_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_20_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_21_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_22_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_23_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_24_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_25_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_26_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_27_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_28_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_29_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_30_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_31_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aeOesjp_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_11_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_12_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aG5Bc5o_1_2.vir, VirusShareWin32HLLPShohdi61457_10.vir, VirusShareWin32HLLPShohdi61457_19.vir, VirusShareWin32HLLPShohdi61457_33.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "7f0b29f4ccda2e69b5ddc94b124f65f36a852b29cce17745f55f508553f26331"
    hash2       = "c368b58cac532230fb1cd9d335725e581be85147829f0e943feb5e0d32fb036f"
    hash3       = "1855e00d626daa8d04cf577795f0285d5b6af62671451ad34a2396fd796d57ce"
    hash4       = "8846d3572f89e4851a7d648a5f95f05a4219ca435f02f42fce31b2c94a7e0c4c"
    hash5       = "ee2d5c7e523649e39895d0b2ad5efcd2d955fdc98b3c33054f76899c88376946"
    hash6       = "984764b654c21c3c80539da0a7fac9c8796dc884e04c9dedd81051176b1a1db0"
    hash7       = "b8dcaa8240a19b9cdd0659c3ce8bbc351eaba0059a6c7d92e4a8239125e36553"
    hash8       = "f0dd6baf56e7ea871c894b52258015e3248a41f474b7ce07804922ca0fee307e"
    hash9       = "69c2bd57de067f5a22986f5a5fa101757b617356129f5b5aed979828627493ae"
    hash10      = "c05529393a0999767140c95923e91037a88d55aa72482a3e0095e8f3d69cf60f"
    hash11      = "8bb68cbdbd34549e7c9b481efa78222ef6fcadcd05ff8a79e3141f1c4d92048c"
    hash12      = "9ec04e5639c307fe92bacc327bc68693e0cf399c0cc27da1a6640e61fff07282"
    hash13      = "aab92bcf4fac85cc241cd4e0d29d3db0a0cad0b6fbb06ffd6abb4faca4041d11"
    hash14      = "afb66f8207a03beec006401431f4a83de6fca13f937ec7451b0ce94c22f3b5c5"
    hash15      = "c398f493d6b0404206df9023b63d5d5d2d3693d15167d45463cbbe08c0e741f9"
    hash16      = "a3f1b4bb447275469961de7561a5dd27217e31fb3312b05ae1b1766b591dd1c9"
    hash17      = "ca07a7c523dd2cc18cb5af087797c6a13027d66d5854b1d0b33e71b963741d0f"
    hash18      = "623f1b077fb087e5a8cb5df6e397277daa55916c8aada00d774e3153266328c0"
    hash19      = "25d8c1c0c07f5c80d3293e3fcf27f2a04a1b31bc8d80a85a219e8214d73b0074"
    hash20      = "32ee73a7e8e3e927dcf31ee532a8c4dba1914edd0654b82ad45cf668771c3f6a"
    hash21      = "43a5c8793e2d6c6a27257d18fede684042242da32245878b08570569a92c7184"
    hash22      = "8fc75c4ceb86ac03c2a42a8e967c59551befc5d63d5741b9ae1d89643c08e376"
    hash23      = "7460b6921143a152b0975f67e89af586349229d1ff6b1317aff73eb982408f4a"
    hash24      = "474f93416a85eab35d3f7f969b0dd7a51147a257a88b4aaae642bb21e552bad9"
    hash25      = "aac398251e203e782ba9ec01ac86ece456b6d120948a7dc37364666d20858c39"
    hash26      = "3ebad9a82cb88416a5e233b397eb545d628d4a3f28dd13a169a62ffe71d8d3c5"
    hash27      = "c6aed0d45c20a2af831cbb0ed67db7f98725082884008c522849f492c0d827ad"
    hash28      = "ceb3d4a28ac50b9ecc4230d5a515d86128ce2fc6d1aadbdccf7ad2948055a84b"
    hash29      = "de12f489efe18e966f089d13869130b78c8d5e08f285b55bbe5060800e1e0b39"
    hash30      = "f1238b3830ab652a4bac0f3777851d90a9dcc46b5ef734944d0fb4fdee77a0c9"
    hash31      = "f75d5ea56577223a8a489e7234e2b73d6e068770386c67d428789a36646bae09"
    hash32      = "a3627805e27793edb47fca06ff56f8ad3d21c28d280c8fbdfa1a278158699854"
    hash33      = "f33c12368ab62e18aca36cf57db227fb9c098e9367e7381b2ed7865d0e52afce"

  strings:
    $s1  = "Fuck you president of USA , Fuck you  \"bush the son\"" fullword ascii
    $s2  = "But if we looked at Israil we will find a big Terrorest" fullword ascii
    $s3  = "I will say some words which I believe that it is important" fullword ascii
    $s4  = "they only fight for thier country and thier freedom" fullword ascii
    $s5  = "And President of it is the President of the free world (I did hear that in a movie)" fullword ascii
    $s6  = "The government there have a control on newspaper networks , tv etc" fullword ascii
    $s7  = "the government lied about what really happened in Eleven September ." fullword ascii
    $s8  = "We will find a country which steal another country" fullword ascii
    $s9  = "We will find a child who is died embracing his father" fullword ascii
    $s10 = "Did they find any weapons there ?" fullword ascii
    $s11 = "Let's talk about Iraq and what is happened there" fullword ascii
    $s12 = "Offcorse not becuase it was a lie about sadam to make peaple agree the war" fullword ascii
    $s13 = "They arrested people who was againest the war" fullword ascii
    $s14 = "All of that and no one say anything about Israel" fullword ascii
    $s15 = "They say that palestine people is terrorists althoug they did nothing to america and to any one ." fullword ascii
    $s16 = "They say that America is the country of the freedom" fullword ascii
    $s17 = "Every day people dies because The president of usa is a mad man" fullword ascii
    $s18 = "Because he was fighting to the last breath for his country freedom" fullword ascii
    $s19 = "We will find an american woman died under a tunk becuase she was fighting for freedom" fullword ascii
    $s20 = "Even Now they lie about how many american's died in the war every day" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "77f13bc24efea5a05601b43cf44d1f1a" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

8847cd4a-db33-4815-9d1e-8f21f36fd68c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion