_Virus_Danger_Gen_Trojan_ShellObject_e8X_aian2n_Virus_Hijack_Gen_475

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Danger_Gen.Trojan.ShellObject.e8X@aian2n.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_23.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_25.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_27.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_28.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_29.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_30.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_31.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_32.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_33.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_34.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_35.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_36.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_37.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_38.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_39.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_40.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_41.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_42.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_43.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_44.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_45.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_46.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_47.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_48.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_49.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_50.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_23.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_25.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_27.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_28.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_29.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_30.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_31.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_32.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_33.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_34.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_35.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_36.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_37.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_38.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_39.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_9.vir

import "pe"
rule _Virus_Danger_Gen_Trojan_ShellObject_e8X_aian2n_Virus_Hijack_Gen_475 {
  meta:
    description = "datamaliciousorder - from files Virus.Danger_Gen.Trojan.ShellObject.e8X@aian2n.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.08Z@auel1S_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.1yZ@aCEmdoo_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.2zZ@ayMBdto_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.3yZ@aWcfH4h_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.4uZ@aiy413e_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_23.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_25.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_27.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_28.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_29.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_30.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_31.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_32.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_33.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_34.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_35.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_36.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_37.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_38.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_39.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_40.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_41.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_42.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_43.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_44.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_45.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_46.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_47.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_48.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_49.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_50.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.e8X@aian2n_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aaHqO5d_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_11.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_14.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_18.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_20.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_21.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_22.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_23.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_24.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_25.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_27.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_28.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_29.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_3.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_30.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_31.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_32.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_33.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_34.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_35.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_36.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_37.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_38.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_39.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8X@aian2n_9.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "aa43daf0959ecad76eb02405ccffdb620577fd7d10d32ba4c5f6c2c2f3d76fb8"
    hash2       = "ecc41ccceddc0b316c50d4f151eb0b15da4d569f90163c685d0e19dd50e5d167"
    hash3       = "cd4230fc09d11aee372fbde3f3f6d3b2d7a716cf9c8c037c94c2ec1e169deebc"
    hash4       = "dc506804bbf1455cf3f798f02745fb17d8ed450df65dc5367193758caf31ec4e"
    hash5       = "dccb4229d1dfca6c0bc6ff6e3ed5e09fc70b8d8344e6302e19b9f041a6132f38"
    hash6       = "fa6cf912ad55a4387050735fa39159d20c4ed0de46a25ca7db0f0cc3e8a553ce"
    hash7       = "60d4a21d802596ed5de75af02303cd028a4428efa1d8d187b7f79b602e01973e"
    hash8       = "5b78901751119320bf75f9ce41ee4d7b1279acf2dfa6602903ff3d2bafbb90a1"
    hash9       = "f3fb4185e985e4068d5c555e8864ba32a8c9bb9ec6972c45cac91ee2379b24fe"
    hash10      = "26b4abd7c1d16812c6bef0374f25989d756546a2ee3baa603cb5e0129e7674e6"
    hash11      = "569195096ac0fe5bef73bf2d6bd5417b4a3aa2d0f3d602b5455d5f7761b569c1"
    hash12      = "2117bc347d582f6d0221cc235d3a53a21ce0ef8b672b213d87d8aa7755c7e64f"
    hash13      = "8227187b877286c1adb2c2fd8e63280a15c490be6cccc940c08c3596fee4c575"
    hash14      = "60a3b625e682a16bc4d1954b83a820c2c8b80076cc769f5d9ece443ffd63be1f"
    hash15      = "c2e2455305437d3c09cb0d8a6c2b6dcee1d52cd5ba2647f580a94ef38f1fdcab"
    hash16      = "cd6a8ea4184e749253c7beb6c1db9c2e95c0b72cd9719b09e21f481edb5a050d"
    hash17      = "1fc6ffe96cec8b64dc066c5ce9fdaaa109eae4fab26c60a21c7bc8ac93b28916"
    hash18      = "f21c9c0213c2c36b4b2772cc460c057141c8b109cbe5430d347c0687bf581762"
    hash19      = "762351f8b3a12a0e9792227bb9af1861547c35ab05a4aca491ab2215b24601e5"
    hash20      = "f514c5d05f650830b7fb77cf56b3978ae785693c03e8a3b7ce537b38eef954f7"
    hash21      = "167f1b9816f68e2f644bcbe3fc17279c4029e677f64067d872a7114655c69691"
    hash22      = "58f17bcc673ad3e866dc0d122eff473a4c6e25e9174bd2e89278911a42e528a9"
    hash23      = "f6a4312f9b619ae7703309459ea0fd0e341d5eb97855fc44fdecab636df6d882"
    hash24      = "862bb350f2a19f1dc2d5918225c167057ebf8d1a1897fcfda9324340503d3259"
    hash25      = "5984b6443b69cbb23a552c909a715b0f375de959e979b81ab9000afb9ebed2ba"
    hash26      = "da2c6552e2214151d829d658c7b01c75c673c111f0907e21ff9d29615d67e837"
    hash27      = "b08c7f3176919609b31cd09c06aa57e83987b00b6868efac151bf0d52139d7ef"
    hash28      = "c8742dd390effd5a0c3b7b4eae666119354fe6915b34b6ea920025d96375c24f"
    hash29      = "e3e36e2172475c8e4ec69a2fcc8768558abb1924aafdb249a11a13626985b865"
    hash30      = "3e68987282d19c7dbdf401d7f14eac041a1f04cbf6f40774b7d27d6e8747485f"
    hash31      = "c3aaa0e81ff6ddcd3cb7b467ff374c1d2dbcc7864d39221b2705149ee743e630"
    hash32      = "b41463983ff90ba855a68ab4a0a9986fa9f64b83166a3887078ed1e52faa6b3d"
    hash33      = "bbe33a8312c3c3aa13a250c2ec913a530ae0850b672a7ae94d82e2f0b9b569f5"
    hash34      = "3e8aa2f9e9e7633c2f928ecdef4994b9b954f254c09b4441e15dfb02b2b0a5df"
    hash35      = "c8cef46861bdbd2c32e5d0688fad832ff261631c1b8a5a9d3ff5601a6e2af3c5"
    hash36      = "702b3abe1e16abec74f924317f18a61081d7236e4323ac88d3aff4410718c9a3"
    hash37      = "28047fbc219c03702aaf5a5e9892f1eb45452684b72915bb20ff58814538ee2e"
    hash38      = "234cc7c5091274fd6d4732bb5e513e5226627c8b04c0782b06ed78b241555db1"
    hash39      = "5171b8e17f3f7dd497aa35d96f3c383dff4997a75e6724b6eabbb2eac6f38615"
    hash40      = "d53c16cd50c25a036257ca036043aed2ca161e57fd4eb60f6e4ff7ab0053795f"
    hash41      = "a79db54fbb181b054ead72556acc312790a4e22cd161ccf5d6b86083f0e779f3"
    hash42      = "1dd54607597ea93e18a381d58193dba681902c3783ea00b3e21b4577bf73ec44"
    hash43      = "b6e7c03e550d9d92de6a8dbe5d25956d2f75d4f5a38cfb5db9447e079b6e4610"
    hash44      = "ed589c74c72a832eadbca192c9f692cb202ee6e85c30bb00ba130de73823b4ff"
    hash45      = "bdfcb6005ebc0105d7104c3c63f515cbaad1bafa6c35eb6cc9039d225a9751ea"
    hash46      = "c85de452f675fbd7f0c1bc255b163e77c129b354df9d05d0ab084b4ee21a27e3"
    hash47      = "12f94e308fc63f36cebfa6bd86bbbf7077522a023d32e2862eb1279c8af6470b"
    hash48      = "423d938903b4275c1c2c9e8852999c4042606ba572ada00300f677eb0083aea8"
    hash49      = "52e59695c234ec2aa644bdd6a424e49ac7d741bd5bd2671bdb2168f5be8fa795"
    hash50      = "0ad79f8e98ae857f55bab3c91bdc314cdea44573133173f2a7da3312ce41d197"
    hash51      = "77b5c428d2e32674ffcc64b61bfb67cd5314cefe909c1ec208b85b53231b46ca"
    hash52      = "9eb3aa1f72f16bf136d6efc324e1b8e5f19e80ddd1077b80f9c5a242e81a8d2a"
    hash53      = "2f2cee9fa938a497afa387cf61dbe64c79140c6b5efa665c8f848b6235c20c29"
    hash54      = "25ec21f73c3670a3efd6b846c988ab7834da350a9974476d072b2527f8ec8df1"
    hash55      = "143a4617ee775e16b3db219038b09f45e6a7c57603ce14e3addbae4a1f7c602b"
    hash56      = "d5098830df8f12e068cc70b7584addaaf8e6d6096ef2b6d68b830a00acd621bd"
    hash57      = "9bf6ac3e37d1d31009af53183d72eaa4b5f8a2ebdf0f6df0b937bccd2791b60a"
    hash58      = "dbf69e3eba1101d4072642ecacdf202d93e1a908e9157fe810220916ce9bff1d"
    hash59      = "8370aa0d563f0ff67ca7cf231df29c64c59c8426cbc1f77b2b918ea27f19662a"
    hash60      = "47ed334fe1ad04df0661ea15ebc42a2eafe751b24fd6e78f65ecb3e090b6eb50"
    hash61      = "8b4a28fb322b9ad9d257fa49b7b9b64448036825828bf967b9595f86f2418360"
    hash62      = "0c4820c846abc13e0a7f05a872c340bfc9077d69d7c2727d132d3036050850d6"
    hash63      = "5ce477239219341ed7c1b7c951a73afeff787eb4e227e8114e5c8f8e5d6816a7"
    hash64      = "b7d86b87dd9eb6f5dfb25d65da9547c1a87ec4366c3e7c10c9d72bb9b089b7a5"
    hash65      = "b7ddc45ae0ff02416fd9e5c579397e06879677fcc9df0cb0351d76f678b83486"
    hash66      = "baa5b8162bbb9f111499350c72541a00fa609cb86b76108a4cd530e10daedd2f"
    hash67      = "14ca83c2c3bfc0b0ccfaa7c499b636d44102b7fb6ce0fda71156d352b3e7e2bc"
    hash68      = "5934958cb82eabee76a7de6ff03715b657f545eb63f861b06afc70fe94d681c3"
    hash69      = "ade4d5b3caafe1570511c7ae1dfa316e21a45710ac7c32284820fab646d7df23"
    hash70      = "d5e85d84c4cc83147db3c3f75cf6a1cc3ae5f500caea7ea56782d47dec2cd5f6"
    hash71      = "870332660dbd683f64c11e6bd370c811fda5dbffc75492ed56664f527d2b0023"
    hash72      = "b3886908c0d6e9e04a8ef146901b1a9f29dbe4908c5c89e5f67c563aae861a30"
    hash73      = "c40cd68a9aabe01d1c1ade13e02bdb679eaee18cd4cdb639568aeac60624405c"
    hash74      = "644f2a4dcfb5474510e5dd2e6f9d6469d7c7de5486c067f3b3298ae0f2ead23c"
    hash75      = "291e76f2537a2843505c66b2800480566bff32b1eef1f059a585ada73fadfe1e"
    hash76      = "a5e47d4f71f6807e5e4e390e3c4eb0a0956a9dc7e054c6b712aa89226480abdc"
    hash77      = "3f6b3102df2c187e3cc6d8ad6b08f3ab99a25eb70d45d274c6e7c42a419bd16b"
    hash78      = "e5b06dff5a244cbbbd1167663a1bf5da3ac5addacabe8e9c85b0ea40e72ffe96"
    hash79      = "c7c6e73db42d39f10920cc269b627120c4b696cd4e32ed1d128155108c34e2b6"
    hash80      = "38cc42ab9d15744c193020c972d915c691c1db3caa11e776cce981a01749597c"
    hash81      = "063005c07dd6bcd0027b1cbb3e10ca496923f2b1e8627ed43cf741a154df43be"
    hash82      = "ae242f649d699ef859bd35232eca3838fc78c54db57748cac3175b4548f7793e"
    hash83      = "a5d5ec727ce340f3f22f691988902400a98b1fcfe0d878079f398207e98ca796"
    hash84      = "c8d75d1aea52db0a3591716240156bdc04351e76a8b0f9d10450fdd1e4db2aa4"
    hash85      = "74c69a2c04ec026468fa9262fd73b7688d9d2fd1f6ae5e0f1bcaa00bb48116c2"
    hash86      = "07cba49d85966c279eeb0826da10dd38fa1696da81f469e4ea60e6f288b7ab2d"
    hash87      = "67c44a315342f749f9a06800c7dce6cca9fae590b1119f43e9e4d5e0d413ff5a"
    hash88      = "2e2ce94be56d0515eb8842f681b4487fa65f35c1c131ff028beb9def8aac83e8"
    hash89      = "9b1ccaccd49bf9c4568c4a002c3b413b55e565d33e749bf06a11fd35295a5448"
    hash90      = "9b377a58194a8b1382cf075fad91957e04e3fa7cf10974af177830fb23a3cdbe"
    hash91      = "3221acda86292dd367103091ddbfece919ab946ac8685cbe97323387f87b2a5f"
    hash92      = "3bac768ec304a0f9362a4d4cf1fcce72db3b2c3870d14f27f53f54961812acbb"
    hash93      = "c8924a060b8f1993d18b19370183d2c3e53c87f9994dd7b50a342e2345fda645"
    hash94      = "f2fb8b9dcbe848d956d3c9add213f07caca55959087371ff201a19d95f627992"
    hash95      = "f6f7488646eae6431fa8be65ab974bf7d1232f463eca870dd043042d4b8f375d"
    hash96      = "b277a1a16aba7af948cb71763e69e6b2a471923ff4323a186bbf078ecee414e9"
    hash97      = "51692d4035dcc10f996645e8185ff5bd81147cb57c079636269a1c9f1dab8854"
    hash98      = "64d17e216b375ebeca062c5950386376e81b8d531ee426dd61134fc85e86abd5"
    hash99      = "2c7314d57397a8afc2e709051c10cab9be5285e19814dc0f9e11303bb8c5e7cb"
    hash100     = "fd0b4b9e6a9c08547b95738afe57bd88be5d8a0ff29732a00a87c6c1eb5ed5c0"
    hash101     = "f4881020a2be60ab76bcdc653e2b7da96a8999dc5e9e9e0bb4e5cf996c681e23"
    hash102     = "363517c12fed93b6933e28c82e057c15d1c89654296cd6720857ed092d1896f8"
    hash103     = "114cfec95ef212b6bc761cfe142bb00b46f46d4e9630544e91819c65ea315af7"
    hash104     = "f7d457e4ffc448ab17e06bacbe704768bed3ce7ce0cc0f5ec2db31f58352f0d4"
    hash105     = "c6d35beb6407f873b309e7bd116dea826bdebed921ef6ce702613b8abeb69c14"
    hash106     = "7f2d73a27bf731cddf79a7b8c4efa79b040e0e498a6767853f928e0286060754"
    hash107     = "5cc22efe54960f5cab2e0d56a0b382a367d43d7aef6a0d4d0ed14111a5bbcb75"
    hash108     = "6ba80cbac76e72c5cfe5b9f286a974dfad211c32c31431c3dc764b0328e4c02b"
    hash109     = "299a47e4fcf66549b86bb22a436cce2fb61c8a83dc11da9d9cc499ed103686c7"
    hash110     = "8c89d001113cffb2aac8a54cdadf399ccd87fed765f3d66b0977cd9706ef2e9a"
    hash111     = "95cd048b41e1e66f74f85c9a49acaef5223d02ed0a364b866cbd16c083ecd987"
    hash112     = "ac526ad138b866a82bfe160e687a48867df8e0719d8a4776759089a4d11c10c4"
    hash113     = "a5a433a7739821dd09f7e7ce7d4a4cc46c644260667c9c1f99192eadc58f56b0"
    hash114     = "8034ffcfba728f0accb07460afbe8090a06cd0a31552e603405eb360a721fbec"
    hash115     = "2c7861ddb8b01d2943e6efb9f8b292ee539e81903b8277755d7cf234d3939e07"
    hash116     = "ad72ef18494899128403e898460cb5af061b639b099c8bcdf3c680e73bfbc2f3"
    hash117     = "2cc548014c84eae5140a3cda3db7e10c9a0ab4358d07505ce90a0c7d7ee383c6"
    hash118     = "d8cd4911a1f1d9e10a90666b64591f8829fba0d7fbf2f74d5d9f422ba58b7bb2"
    hash119     = "6d0a560a8eeeb545b896de95b60e2a799f4f9314234c97ddcdd94774169363b6"
    hash120     = "4402fc674c4a1fd23ff0addc00c588dd25acf83525d8923e9482c8dc428b9488"
    hash121     = "493660eaff54990367ff910dd5c6f66667afa026617b5d2943c2d6a8f74d3dda"
    hash122     = "fbda3bda4d1b9a42ad53d107fdd4ce3b5b6e7cfeee3a9401d6c24de9ddc45e18"
    hash123     = "57ac90acc26341bacd867fb30ab38f1f5d1262f8aa110e968c4af00ed9238c3d"
    hash124     = "483707ca2e9f6c866f3b594ba465b548cd1c8a416f22236c759ede48273fd114"
    hash125     = "08f567bd3ce3684b8c483f16d856d1a7fc167ba4ed3680c19e8b47c0003a9d23"
    hash126     = "c0b9b6b8d9571ebd5e10d3b11829742a74d3062f9cead2f21b7b7df095e77dd2"
    hash127     = "6d04918a1f07518f21a91a0d1d2a23b6af01121dd8aead022cf260c541382638"
    hash128     = "0ee1077ee9cd0e7688a21ca51ce32cbb0e082a84e9e25801be0f5d79faeecf22"

  strings:
    $s1  = "Order Line: is defined as the total number of order entry line items processed by thProcessor basis may be accessed by your inte" ascii
    $s2  = "rnal users (including agents and contractors) and by third party users. For the" fullword ascii
    $s3  = "computerindividual is actively accessing the hosted service at any given time." fullword ascii
    $s4  = "Order Line: is defined as the total number of order entry line items processed by thProcessor basis may be accessed by your inte" ascii
    $s5  = "authorized sources. Certain upgrades, support, Recipient. The Provider will not indemnify the Recipient to the extent that an in" ascii
    $s6  = "authorized sources. Certain upgrades, support, Recipient. The Provider will not indemnify the Recipient to the extent that an in" ascii
    $s7  = "authorized sources. Certain upgrades, support, retain any copies." fullword ascii
    $s8  = "authorized sources. Certain upgrades, support, " fullword ascii
    $s9  = "Neither of us shall be responsible for failure or delay of performance if caused by: an act of war, hostility, or sabotage; act " ascii
    $s10 = "s confidential information. You shall use the TRMs solely for yourr convenience, we" fullword ascii
    $s11 = "remium Online Library may be available in certain foreign languages. The" fullword ascii
    $s12 = "4. Language Packs and Proofing Tools. If you acquire a language pack, language interface pack ord." fullword ascii
    $s13 = "ISPUTES IN COURT BEFORE A JUDGE OR JURY. Instead, all disputes will be resolved before" fullword ascii
    $s14 = "licensed use and one copy of each program media.transfer and use of the software. You may not" fullword ascii
    $s15 = "ary may be available in certain foreign languages. The" fullword ascii
    $s16 = "oficity label, and this agreement. Before the transfer," fullword ascii
    $s17 = "terms on those websites.before" fullword ascii
    $s18 = "be available in certain foreign languages. The" fullword ascii
    $s19 = "ne Library" fullword ascii
    $s20 = "fringement claim is based upon any information," fullword ascii

  condition:
    (uint16(0) == 0x5a4d and pe.imphash() == "ae701ec71bee9ed956fa515753fef9cc" and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4a151392-65a5-434b-9577-6919404dbef4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion