_Virus_Hijack_Gen_Trojan_ShellObject_08Z_auel1S_7_1_Virus_Hijack_461

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4yZ@aSgChKg_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.4yZ@aSgChKg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aSWq7Qp.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aSWq7Qp_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aSWq7Qp_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aSWq7Qp_3.vir

import "pe"
rule _Virus_Hijack_Gen_Trojan_ShellObject_08Z_auel1S_7_1_Virus_Hijack_461 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4yZ@aSgChKg_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.4yZ@aSgChKg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aKrnLEm_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aSWq7Qp.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aSWq7Qp_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aSWq7Qp_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.i8Z@aSWq7Qp_3.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "3586435ac9cbd620903b3adc22472f1097e08c45eab583ad7f080373d44155c0"
    hash2       = "e1a6e63e94d1a7a20585797596df36bc95083f730dfce490039bc4dbdd379e11"
    hash3       = "d3d8ddc4c7dabaaefcf09a28398210a3f7446087c1c626edcf67d9002f3f8893"
    hash4       = "2a4423b21a6fc4e56c4adaecddef339e6baf3f87f044900b66c46afdf85e9e76"
    hash5       = "1a06a20a50824575fe55f999ad2d61c631dee97e00afe8bd734920281234b139"
    hash6       = "aa221bf8765b06c801d935de3b9492a12336a6a0a020ec3ab593cdebfc4d2bd3"
    hash7       = "715432b7a8bfb7899f672ff1256241800a71e93ea2ddde3df0af193377c35b9f"
    hash8       = "f294e7ac0f5791711ae6728f872675a1941f70cd878e8493cf41901fce1fc571"
    hash9       = "83b331588a297412c9ccc14157888bad18180b8f9ad8b4391a6b69f158350c79"
    hash10      = "95aa77adf5e1511ce111bb733d667eb080086ba6d25a5268c145bad1514f418b"
    hash11      = "8fbcab0dd7e867f30bc9bcad4bc9c3c539eadd782cfd7b6519442bba72e279ae"
    hash12      = "89cb702c690f7de629a59313ecbfb90994c4edb90aa067eb38d2a60b1196f011"
    hash13      = "0388ecb138e1907937d3e43d3afaab2b5f713f2ccffdc6bb02ec57d5eb665d64"
    hash14      = "e6c17efe455eb977e42f4fbec7d21a795b16bd34ad0fb8178b2d543a04c86b3a"
    hash15      = "e44c9717f26c383da492bce3e7c2eced707eb873f2f37869e41b9f507ee299e2"
    hash16      = "257706b78353ed56f4f15d65389e169a46dd2ee7e4fb83998bfc6616980525cc"
    hash17      = "9f67ff8d93fb7b270561347985e66726906b33814c63a36da10399203fa7d296"
    hash18      = "1d3f549064448571b880ebe060c5c5aa5894cfc222553423341795843f0879fa"
    hash19      = "0e2ca9e4fac506248ed8ccde3c01571f043dc04a43fc6c7c9fa80ed052e8d8cf"
    hash20      = "1145ecfed236bfeed2840634847a92d82cf79c5794a047eddaeb0d8702fc73c8"
    hash21      = "2806afbbfcc1ffc77b14789bed4f4ac601cdf97ca18caba33f5204a1276515e3"
    hash22      = "6cb9540600c93c1b7dfb5b8ee6dc6f142af2bd7bddeb158b0962d30a4e7b765c"
    hash23      = "4c6e60f2afc431e1d70094d9f9b0abd781dc7e2fde99b597493382678e8bb3d4"
    hash24      = "feaab563c3259ea173200da341f7f21e08017d2fd01cea5da5891f66371c84a0"
    hash25      = "6194e65d8c91cd3d118366b5920b62b41bbcd7856922e2fc6443d0ef0d0b1c87"
    hash26      = "de9822c055b5929ffc28c477bcb8e7176cf748a521ea9242e0abdb132c188170"
    hash27      = "3205d46b0420bed47dfc13a61e139ddc4982d58df81756a03f29dae6955bbfa9"
    hash28      = "2a38f7567d0b3e96b688c5720b75f618b2ba6bb3ef4b7c41aa7a8c9c4bb19fdd"
    hash29      = "cc067405affa64153b3638dc75bfeaba67910051a3498ed6c9580312742e44f5"
    hash30      = "2220fb9f57ea150e2d5efbed6148eb4cb3a7fe9c41eb8a0702b551b7a1936e66"
    hash31      = "c98355fa5ea82ddb230a23626972dfa4e198c9c894d9370a21a6107d9f286591"
    hash32      = "7e5ef207dadca8f8f6e02f780709109222c1ab2a20f03e69f19b127fbb10670d"
    hash33      = "dcdd85bd6863a8346b73563eac7053ae58b2dc46f6aa822a85caffdc45a317b1"
    hash34      = "d4ce62f107bd8681309d90c4df3a2dfa0b1721aab203a6c3adb7709178ce95f1"
    hash35      = "4795cc3f2b9c2ad4c7c03cc9ad992a597f7e81bb4e38fb0f677d2f06cceeebde"
    hash36      = "818d5d2ab1e63ef248f3e2093c09b24c2fe74171be53bdd8ae594daf339a2ca8"

  strings:
    $s1  = "are responsible for ensuring that the named user plus per processor minimums are mainta" fullword ascii
    $s2  = "giving rise to the dispute, and the relief requested. You must send any Notice of Dispute by U.S. Mail tohat end users retain as" ascii
    $s3  = "Statement at r.office.microsoft.com/r/rlidOOPrivacyState15HighLight?clid=1033. BY USING THESEterial to be non-infringing (while " ascii
    $s4  = "Statement at r.office.microsoft.com/r/rlidOOPrivacyState15HighLight?clid=1033. BY USING THESEterial to be non-infringing (while " ascii
    $s5  = "giving rise to the dispute, and the relief requested. You must send any Notice of Dispute by U.S. Mail tohat end users retain as" ascii
    $s6  = "1 Year Oracle Hosted Term: A program license specifying a 1 Year Oracle Hosted Term shall commence on the effectivefor student c" ascii
    $s7  = "another computer or user. You may transfer the software directly to a third party only " fullword ascii
    $s8  = "access online files in SkyDritransmitted or executed electronically (via EDI, XML or other electronic means including purchase o" ascii
    $s9  = "access online files in SkyDritransmitted or executed electronically (via EDI, XML or other electronic means including purchase o" ascii
    $s10 = " they change from one service provider to" fullword ascii
    $s11 = "not separate or virtualize the component" fullword ascii
    $s12 = "1 Year Oracle Hosted Term: A program license specifying a 1 Year Oracle Hosted Term shall commence on the effectivefor student c" ascii
    $s13 = "rders transmitted from" fullword ascii
    $s14 = "are and replaces the agreement for" fullword ascii
    $s15 = "ur rights to use the upgrade software and replaces the agreement for" fullword ascii
    $s16 = "rounded to the nearest" fullword ascii
    $s17 = "our rights to use the upgrade software and replaces the agreement for" fullword ascii
    $s18 = "lassiTHE REMEDIES THAT ARE DESCRIBED IN THIS A GREEMENT. A section near the end of this" fullword ascii
    $s19 = "access online files in SkyDri" fullword ascii
    $s20 = "substantially preserving its utility or functionality) or" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "d8473a767b28e24844381a75eb5d11c9" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

bd5b23d3-b7f6-4d23-81ed-f3f40f49bb38

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion