_Virus_Hijack_Gen_Trojan_ShellObject_f0W_aiqugi_112_1_Virus_Hija_477

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_112_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_27_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_31_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_33_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_37_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_39_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_50_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_68_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_78_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_83_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_1_1.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_f0W_aiqugi_112_1_Virus_Hija_477 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_112_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_27_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_31_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_33_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_37_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_39_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_50_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_68_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_78_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_83_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_1_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "4868c9d1071c28bed990f81475d6a27258edc9eda913853a004aea96c5e30420"
    hash2       = "7f7e88723c899e65f52c4bcd026a0525d7b92b34604b906d0ed4075d9903e1ee"
    hash3       = "eb6a6b11483aa7f7fa390ec804288499dbc7a264762c5cadf7d4b4bbd76161c3"
    hash4       = "2bf99bcde53d600d0af387c71fb9de363e731e50f3f0ab6394e6ff93c512f70e"
    hash5       = "0f5dbc342a77a2ee6031e9c3b6e9a7697ae73ae640a621d083aff5e55301d1fe"
    hash6       = "f16c260b72f5c17da509155477f27ac1668d6a80fa90e62d1cb7a8c91185a1ad"
    hash7       = "0f402d08f7e0dbaca3b5627fb133952433399c2dd0abe161a2d70ee7966aff56"
    hash8       = "9b8341967f3e84f5c56b687783dd0adcfc9b8aabbb2ba774eb5b4cfe5e4f165d"
    hash9       = "efb2b6b18e48b20873ec0db3b4d36cdda05e5007197ec17a63c9bd0de21a40c5"
    hash10      = "f8bcaa2c085b0f51e6662784141ac032264644dc799f91a0b2708c1c187cb533"
    hash11      = "2f674f634baa18ae1c02b9ad355b3445401af4bbddadf1314757ec63c03544bb"
    hash12      = "7624fa30cd13bd9f9d8db208ca7a62e755cd369b8f8370f0d87dfb875ae5c414"
    hash13      = "f9244f4b7a684124a102edfce891b89d734273a5d6071fbd117935e343f82545"
    hash14      = "fc772b647789abe73304fa5d2fae0c921d6f071b85672b7b1fd7624e81629d89"
    hash15      = "6e4d68bb689c0241653312111dc70b406b1cd7f877005fd0b548cf4d3ce9b106"
    hash16      = "9582da6d757e0aab08f3b505f266be5499968a924276a66617ba2db8ccbf4835"
    hash17      = "3f01b724d9c970c41fa439f0d8d6e7e731b5863e3067a3b0568c48a2f2622472"
    hash18      = "b25049361980539c3e08897c0c28fdf3d6eec267063a311b8a1598946af3568d"
    hash19      = "5f2d62f2768019af615b717ecb0a64924642fcd5a53d2db51731525b43ef2113"
    hash20      = "1e6b56754a453e9a908b745b442d02da25b3d694bf41a38b982691c8dd75712b"
    hash21      = "6428f6adde73416174349882c276a0dd7831402d03d30a8568e58db077f2b461"
    hash22      = "906c9e4e5ab33e9c806bf6d599c20c12a923b135167ae404a119876bfdae42ab"
    hash23      = "1b04e6b33475158a4d3261b8114638f9616b6e007e8f4bec5ced5270b7ee5b1b"
    hash24      = "f367cf268a97eefe89f5a5729129a2cfc4e7f188e19771c05d54a55fe63c049c"
    hash25      = "69fdb37330ae6075d1fc20959c891559406a8478cd602799347bfa75ec11bd2e"

  strings:
    $s1 = "8/9/2021 7:41:32 - PFRO Error" fullword wide
    $s2 = "  [ValueDescriptions{\"Error Flag\", \"Debug Flag\", \"Noise Flag\"},DefineValues{\"Error\", \"Debug\", \"Noise\"},ValueMap{\"0x" wide
    $s3 = " PFRO Error: \\??\\C:\\!" fullword wide
    $s4 = "8/9/2021 7:41:32 - 0 Successful PFRO o" fullword wide
    $s5 = "[Dynamic,guid(\"{0888e5ef-9b98-4695-979d-e92ce4247224}\"),locale(\"MS\\\\0x409\")] " fullword wide
    $s6 = "class RestartManager : EventTrace" fullword wide

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

5956f5dd-b7d9-4ac4-ba61-654f927a9ebd

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion