_Virus_Hijack_Gen_Trojan_ShellObject_f0W_aiqugi_109_1_Virus_Hija_482

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_109_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_28_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_32_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_34_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_36_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_41_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_47_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_48_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_49_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_51_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_52_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_53_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_54_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_55_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_60_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_69_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_71_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_72_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_77_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_80_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_82_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_83_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_86_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_89_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_90_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_93_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_94_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_97_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_99_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4X@aqH1LVc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4X@aqH1LVc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4X@aqH1LVc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4X@aqH1LVc_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCkwazk_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCXl7mh_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCXl7mh_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aGAMRTl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aGAMRTl_12_1.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_f0W_aiqugi_109_1_Virus_Hija_482 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_109_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_28_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_32_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_34_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_36_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_41_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_47_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_48_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_49_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_51_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_52_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_53_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_54_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_55_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_60_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_69_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_71_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_72_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_77_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_80_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_82_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_83_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_86_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_89_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_90_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_93_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_94_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_97_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aiqugi_99_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aO3zEnn_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f0W@aSlVvue_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_19.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4W@aixDqOn_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4X@aqH1LVc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4X@aqH1LVc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4X@aqH1LVc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f4X@aqH1LVc_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a0q1@io_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a45ajXp_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_16.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oG5if_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@a8oUJio_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCeX4wn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCkwazk_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCXl7mh_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aCXl7mh_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aGAMRTl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.f8W@aGAMRTl_12_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "2ead6deb6879e11d3236cba03d80a83b0bcb473533a70dadc9466e85f8989b7b"
    hash2       = "f73b4f6e1d1b9a7722ecd18c3e759cc5863b7ed2e1939f608275a18d5a70bf18"
    hash3       = "9c8283a174ba9585f5d90279c6e5a1657772c9f58cb0f0d0d44805ee0d40386f"
    hash4       = "74bb4fea4765750848f2a3195a8a54a2e647b005b55753fe3b4c25f5accccbc8"
    hash5       = "8743ab81c2f66dfab5d1b98be4dbbc500686cb7421c27f27618e23b8d4ef476c"
    hash6       = "0e82f4b4ddd50128614dc2366046ed6e381d27e2a42029c7c0842fded6075c89"
    hash7       = "75470c2523e405cddfddaab35965d6f281feb2f045d97683a462ce1413d768b1"
    hash8       = "4ec37ac989a975bfbe6a5da3573753a326ee660a4bf2d773157c997ae575919e"
    hash9       = "f022c8c56ef2a54f14ffa360f125a4e5f25541c08fdbb423291df116ecc35e4a"
    hash10      = "5ce6b88f3b55f2c20fd56f084b8f9b8b5beed7a43a857cdccb442c2396fd54b3"
    hash11      = "611cb4a09cbc864430e519edbafeff985c06f3a81a259dbe4b4b0baec1f993a5"
    hash12      = "ab37ebbfa9e5dcd0bb71a7d54d9c1b888b67e04e76ab8e16f08d73d23ffd5d1b"
    hash13      = "5022855a7270c6fb9edf55d8b977f3613c6d0701c6f80d44f24c3c9aec65bd14"
    hash14      = "0e672d0899c2140f5bbf0c4e49ce2ca98d8d29926bb1326c82e2cb2519b880c2"
    hash15      = "8a27acaeaa9b50b7d7d2e2e334259f1f70552999712199b53c416c854c362a73"
    hash16      = "bc5261fea8e5e07ca33b28a7a38be10526e2e7372a93308a7570332693c4522f"
    hash17      = "699d793ea7b8ffa6268f1e0b8881dfd0f82d0a6e3deff85e1e122c2f32d22d6d"
    hash18      = "8bcd833092ac63f9b6613c5e323c7420a4638a923cdc1cc4c9469d0de801dbaa"
    hash19      = "16832fb7af74d4e464fff117b303ccfc4ceb39edb8b2e15075a2c8852b66fdf3"
    hash20      = "f7b6fd6d8cd5e9bf72b9863bcb2f4bbd9dbe0929b0056f7cbcb20e713f4e3c12"
    hash21      = "3e47bb1330b343f6fc7fd613c5f5653fadafb30d276f7cc33d5d7f60b0b24f2d"
    hash22      = "4176bae5446f851d12ba5792b609abb6183138ce16a54a75fc5a0052472c2dd4"
    hash23      = "e4f002dc375eededbc08b504f3cf599d50bac3941be3cee6ab554db0b9610cb4"
    hash24      = "7a3e9e7a19f613af933b2c2755cbc2d6af4516e05656790bb28207f42c728e77"
    hash25      = "533753ef114f5c945ca1edbccfcf76ea58c93861197368962142fb7c3bc31a30"
    hash26      = "33cd26660c86214d66f4f7a9ba5a37d404c00349855ae4546fca53c721295c38"
    hash27      = "bd5380a1cb2a50406a8c87257d09755368e926b12d564ec5a19d4291d29eb5d9"
    hash28      = "fc535bb5260cc4fc2228a73dfc603e16d912963dcafe5b1f114038d8d3c36a18"
    hash29      = "8d4eda4c1010e7d0561571b12a7aef9e01b1313e69cc1be5404770aa8a32fbc2"
    hash30      = "a9fd59efa4dd76b76c02f15b7781b21d24c2cda7837b485b72c60a301215f925"
    hash31      = "f9244f4b7a684124a102edfce891b89d734273a5d6071fbd117935e343f82545"
    hash32      = "e1de03e6aa99022bf1384485f1eda586c41fdd0087a9b874e88a1a73ba52e447"
    hash33      = "436c359b3212a384c0e77aaa2c0267375d1756a9e394c1bca43fa40ef1ae5b42"
    hash34      = "71329c7d9a7e8dc1335a1284f197b114068fc19e0c88db1df9792ca808d3decf"
    hash35      = "80f6adeff8ff98ba5a79e03d03858124102cb2f684913f966792a18882b1fd4e"
    hash36      = "5e14d1d158998f22959f211f9e2feea34726d5dc1de90bdbd949019849c03750"
    hash37      = "4a23cb28fe1cd87e228be49b8e73fa6eda1475f427575b3f804b7f169f6731c4"
    hash38      = "ab50529897b926919adaf9ac06a33dd02ac01f771eb2cb9eba67b2f27aec2a95"
    hash39      = "2f1695847f534c8d1bd29b5b4fef3f9b1a358551eb8fc80319fea2c0ad790cee"
    hash40      = "3183baecd09cc8f7da63e57bca111d060ccf1f8ef03b42d5b2ccbc8ee70070b2"
    hash41      = "6e4d68bb689c0241653312111dc70b406b1cd7f877005fd0b548cf4d3ce9b106"
    hash42      = "8148a106c4831365d2d80cb3f32639be77bf7f2dcfe31d8aed24b361b83bc8b8"
    hash43      = "246418b835995d34dbcdd3b348aec91e0e92f6c5bffa3f581b7900f490110627"
    hash44      = "3041e46546a0999a22a07732e05360ca097464e74e9d2ae00a700b5537bf24ce"
    hash45      = "2553e6969332a6e5391114973e4187c6884c63dc10d1fe023a7a596cda2e6737"
    hash46      = "9f69f8d6c32bc014f7f39b019d6b4287c45c3cadbfad798b32cdd3dbe8eb2f92"
    hash47      = "edd97fe790404c231f2806d3d95fe25021dad1e1d19930ec225073c7d5e014ae"
    hash48      = "660abb9fe016d15a4064be6ed8a9c3dddb3ae71c06d80f8b5e32d0c471fc1dc3"
    hash49      = "7580dc93ca9a0f92bdbf31abe7a203f23c4ffddeefd4fe03ba5227a1227b31c0"
    hash50      = "93ecb50709b2517a47943d4a5aa0baaa8c9ed9161945c62f7b1aed6a27803249"
    hash51      = "69bd9416563472f6c30ecf98e0f5e54b0b4381fe116f5a0f115411d6add8a794"
    hash52      = "60976c3d92e1deafd81517f8425a7a29aa0aaa563fd422c6e2bcd728072470a2"
    hash53      = "c0a56563cc6af165473bc52215c18595790ee262ac8d430233ac4c35fdd2d1f3"
    hash54      = "2f22611486a934b8e7432456b039c12034b18886576f64f25b558edee07d2ae0"
    hash55      = "71a9c5d8b4c4dff0c038ea2b56e07fcf0cf4570bb8df9fc2bdfbff69456fa38a"
    hash56      = "ee50c0ed415cb6a402b89cad2f14a48012e5fbc6ec5249a3b53d00a375358fdb"
    hash57      = "1bddd032dd8e8aa7fed30d409b9c5a1d1b51284a74643d618b6af50cb8027708"
    hash58      = "6c90326caea19664994b5634a9d69a5c057c0a8acc2295c83e2bbae73b89640d"
    hash59      = "093eace29fd3e09cc8b4d91174adb1e30c5cbd50a8dbb569566c26d5b7ea66a2"
    hash60      = "5d54a571e786e400d1592c5a2907d7fb4e053ebf799242ad4c201571a3ce6979"
    hash61      = "f8942b92be1d51ee6247994cb4307d4b92132ac567e98742018dc8e9e78d1a09"
    hash62      = "61b2a2b42a4f296bc5cab8496135c8b83cd9ac2c8d70a80ae4b14a5bf45cb452"
    hash63      = "62d481b38176de33db099f959ae3f81d896f9ca9cdfd0ef0609e1655e58d21d5"
    hash64      = "2d07b9370a598b272df3e34edc27cb1d54d9fa469cae0a3d697642f60f94aa5c"
    hash65      = "dae446e3d965e70e63a209b6543f22809559b24797e2b115fec4d7bac9187a24"
    hash66      = "983bc0c9ae7db5382e22479d7d971771c5feecd4e3d503dd891549689296f233"
    hash67      = "a07971e8c970757eeca46bf5158a0111d923746492af0b08e7ab4aeacb937f8d"
    hash68      = "dda42da5337ee2e4f8c8c9d0ffac05be15de722d3273601faa1a42fb011ab8a0"
    hash69      = "f76a510bbcbaecde6ae13eb0b560fb7996d002698d5dedaf53493529e9bc0373"
    hash70      = "270228bf3c3269030f2205fbfa979e6359587a34240fd25a8fd122274ac695d6"
    hash71      = "17177c00b8eab5673db666517d23a208c9139dcf1a9735d82a8df443dbfd0e53"
    hash72      = "608d10f9f2432b9abe8e4ee736310df5f9a4bf800ffeb6f65b51a37ef9b315a3"
    hash73      = "69fdb37330ae6075d1fc20959c891559406a8478cd602799347bfa75ec11bd2e"
    hash74      = "d6c99011bc5bd5f5eccff023c3da07bceeef04d46f619d43fc5e6c3c6253e3f9"
    hash75      = "1bf49e3026c410e408c292aa1f1bc376008356d04941cc0e838ad0b91c5425b3"
    hash76      = "77a612ddcb623fbb92240d19e582ab24ff912142a490d4f5ff465b07f6b89615"
    hash77      = "59bec145960b3ed3d57eb6661ab4511c679ee84f9bacb80713e9ac9964d4d17e"
    hash78      = "93f76783ce6a2ff5410b84c1d48d5dc776521e10e4ff77d44cb298db6493f819"
    hash79      = "e20cdecd93fdb6cdf2770553729e361f670f6879afc803b6e02f6abbd6c6808a"
    hash80      = "2e0eb3e7456f58807443b03fcc284e795a4b51f2122e4923a9f975d241ad7392"
    hash81      = "6140b2908846fde3a19f74d9a7624336e6775ff79b4dcccff4adf50c71504001"
    hash82      = "99dee35542e7cbf0a9b53c026333da2405e36245cda83e4878cca79735299e3d"
    hash83      = "95bd66419f1bf28c5b02aca34fd1719ebca3405349e1751c09ea6af91870f5b5"
    hash84      = "774d433cb79d589865d8fd1f7dbc1d04bea64ee83b2cfe92f0e8dfb6b4161065"
    hash85      = "7df1b6c77a50af0bd24792d98ae4cd62958bb94f4a098416047e99937b76bc41"
    hash86      = "f498fc617f874e750b8f3149e04788fafdaf807e73faf62f2438df5f3a0f8a35"

  strings:
    $s1  = "02-26-2020 13:19 : DTC Install error = 0, SysPrepDtcSpecialize : Enter, com\\complus\\dtc\\dtc\\adme\\deployment.cpp (2099) " fullword ascii
    $s2  = "02-26-2020 13:19 : DTC Install error = 0, SysPrepDtcCleanup : Enter, com\\complus\\dtc\\dtc\\adme\\deployment.cpp (1939) " fullword ascii
    $s3  = "02-26-2020 13:19 : DTC Install error = 0, SysPrepDtcGeneralize : Enter, com\\complus\\dtc\\dtc\\adme\\deployment.cpp (2010) " fullword ascii
    $s4  = "02-26-2020 13:19 : DTC Install error = 0, SysPrepDtcCleanup : Exit, com\\complus\\dtc\\dtc\\adme\\deployment.cpp (2004) " fullword ascii
    $s5  = "02-26-2020 13:19 : DTC Install error = 0, InstallContacts, Enter, com\\complus\\dtc\\dtc\\adme\\deployment.cpp (321) " fullword ascii
    $s6  = "03-18-2019 21:55 : DTC Install error = 0, Exit MsDtcAdvancedInstaller::Configure, base\\wcp\\plugins\\msdtc\\msdtcadvancedinstal" ascii
    $s7  = "03-18-2019 21:55 : DTC Install error = 0, Enter MsDtcAdvancedInstaller::Configure, base\\wcp\\plugins\\msdtc\\msdtcadvancedinsta" ascii
    $s8  = "03-18-2019 21:55 : DTC Install error = 0, Exiting CreateXATmSecurityKeyCNG, base\\wcp\\plugins\\msdtc\\msdtcadvancedinstaller\\m" ascii
    $s9  = "03-18-2019 21:55 : DTC Install error = 0, Entering CreateXATmSecurityKeyCNG, base\\wcp\\plugins\\msdtc\\msdtcadvancedinstaller" ascii
    $s10 = "03-18-2019 21:55 : DTC Install error = 0, Exit MsDtcAdvancedInstaller::Configure, base\\wcp\\plugins\\msdtc\\msdtcadvancedinstal" ascii
    $s11 = "03-18-2019 21:55 : DTC Install error = 0, Action: None, base\\wcp\\plugins\\msdtc\\msdtcadvancedinstaller\\msdtcadvancedinstalle" ascii
    $s12 = "03-18-2019 21:55 : DTC Install error = 0, Enter MsDtcAdvancedInstaller::Configure, base\\wcp\\plugins\\msdtc\\msdtcadvancedinsta" ascii
    $s13 = "03-18-2019 21:55 : DTC Install error = 0, Entering CreateXATmSecurityKeyCNG, base\\wcp\\plugins\\msdtc\\msdtcadvancedinstaller" ascii
    $s14 = "03-18-2019 21:55 : DTC Install error = 0, Action: None, base\\wcp\\plugins\\msdtc\\msdtcadvancedinstaller\\msdtcadvancedinstalle" ascii
    $s15 = "03-18-2019 21:55 : DTC Install error = 0, Exiting CreateXATmSecurityKeyCNG, base\\wcp\\plugins\\msdtc\\msdtcadvancedinstaller\\m" ascii

  condition:
    (uint16(0) == 0x5a4d and (8 of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0ea1e1f8-e4ca-4709-a493-95fd03c884bc

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion