_Virus_Hijack_Gen_Trojan_ShellObject_gyZ_aepfLIm_9_1_Virus_Hijac_509

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aepfLIm_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a0a9m9p_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a0a9m9p_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_9_1.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_gyZ_aepfLIm_9_1_Virus_Hijac_509 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aepfLIm_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_12.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_7.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_4.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a0a9m9p_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a0a9m9p_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_15.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_9_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "a205403097d1b1fbf571d08a082ab1467df4e3c544bde66c4733a8d657340b21"
    hash2       = "bcffd26661f42e5b7e5f406e6cfe5eb7ea1cb8b5101e638504345c35796fe595"
    hash3       = "2a04501ce8f773167c0cb27b34462dd0b5726d8e88bf6eae5dff79b33737e3e2"
    hash4       = "772222fe5c7cbadebf9b3a454c5bd28d05506fc4d87e18ff58a8a4ebda3f52f9"
    hash5       = "a8f43bf1130f4097ddda0d5c99d21667ae5397836e14609ff43ac7897e6b7fa0"
    hash6       = "495afbd0b5f9610d923b8b7c91e8c2a04f6365572102ef8ef01b9de5d696871f"
    hash7       = "af64d7e6549226eda9c8e29cb6ca0c6b393b5257a1cbdb9ee80e8e8d00240b60"
    hash8       = "29050d5fba1aa60586271df818a920480a8f75fa7007023a6303a6747f1ed086"
    hash9       = "a0c42478d63a4a645e057d6ae984bae8da01f590d8bea76251934b5a855813bf"
    hash10      = "e3d41fef5350a30a0fb0429e346b083b0230a357eb1dd144bc4147491fc1a484"
    hash11      = "c994dfe5bb7f5831babb8c5859b3b2cd21de327d67662a31efb2e5d7111faea0"
    hash12      = "e5147d7fe69645ea8f6d8214a5617ff8c01f5fa4e8677baf858ab3d07fc39b75"
    hash13      = "6d13a8b101b0c225fede434949cde295d861df00da0f68ad2c7d7acbc302a7ef"
    hash14      = "5b817ace6e3d813c6a31a46369105d404fd6301a8c96d40763a6217e79103ee4"
    hash15      = "1cf24144756e4ddb1db407eacfb63147c6b51b2c38e3f522cfb873a51fdb99a2"
    hash16      = "aa6a639bf2b5b7b67838bd0c2f9127fc34f7245ec5e44717d161cd2dfa5115ac"
    hash17      = "d75f0aff1987cd6bef2a707c21c9d2663d9343fbdc6826460df486e1dfe852fa"
    hash18      = "300bdbfd36fde43a1c4c420e2e026dbc46ab20b10a06730fae8a51249366519d"
    hash19      = "684993edc8a4aa5ec065f279ea554f835f7d37d47606b53668396dd137596c4c"
    hash20      = "09539ac5700f49c1ddc13f2c55f4285df1c5676def959f29d24fb7ee2e2a6786"
    hash21      = "f592448d4c3c5dd126d7e869050a472f3380cb8938e0db87abd0a2a64556c35f"
    hash22      = "fd76047cef243aece1a402a30d0f85995b5a2fa5761fc3af0848ec6bb1d3df1f"
    hash23      = "c2a6d744a8717a5a9a5dd457d7fa255f2d31d902539ca83fb0fa488064ba3d10"
    hash24      = "885112b69b85305081c2704658b3451897cc1feadc55d7a6ab9c336948fb3e9e"
    hash25      = "769b1e12dc06d615dce11931ec9c6665c2d9992b80a128efdccf0421a5c40d54"
    hash26      = "2934cb4ab65220906c88bacca3acae277e2c9386ae482a0177e65f1f36ed8c55"
    hash27      = "c7e8d5a87fef57c6b1f16c5ba3425fe8b13cf1657de7b54ecd3d81c2016e951f"
    hash28      = "082f1317183c0b187f384db62a6acb663ac600b9f1f0f6f00c722d5b97619dbf"
    hash29      = "6cf0e3bf3818a82082dd7de096fa84ba91a3bd4c4949a8687ca249709d2b444d"
    hash30      = "3d22c37e30e5d710920339dbb3c3c5abb97e7bbe0d55f9058adb59dcee8ca798"
    hash31      = "4c95654dec68030a920c1aeb54c1d73bdd06c363bed1c9bcee4c1e38dc240a6f"
    hash32      = "4d432d8ade6f74a73121ffed75340d5fa66b10b7661b0ea2a8483823088e57bf"
    hash33      = "200b5959ee5c697295ba7799fe9f2bf19d21c61e12bd3caa97052fd9f6f74fdb"
    hash34      = "f5b796143d2b20bf488cc2f3c9bea25693568a9ac095d1af8f1fbedae98c57b5"
    hash35      = "dcaed207abac1a9d0691a20c84c9c3c579e069c39b8ffda2c371284c2e23129d"
    hash36      = "e76c00fbab668ebf77dcf4480dfc7f3b431293f32df7877ff578520c4aeb8aa7"
    hash37      = "7d467a43227904f5e93d174e82786dcf458b6bb2bd7f7c11ec47df3ebbc850b5"
    hash38      = "4144d1875bc309aa7205b5412b3e89466aef7e88ca24e4ae938863c7a5fbf194"
    hash39      = "8e59de5cb8c6b1bbf48c318a737d1e1893b659b204e15f2b855e83daf577abcb"
    hash40      = "b1ecc9bc7787f65cf4b182c61e358279b4cb7ee01cdde449bd17f6883b478e35"
    hash41      = "ae9e10547d90258c43db9ef3d9a6a6fe4caa71037a73580b606c84a218e6d598"

  strings:
    $s1 = "circuit::extend_tap() [or: %s, state: destroyed]" fullword ascii
    $s2 = "circuit::create_tap() [or: %s, state: created]" fullword ascii
    $s3 = "circuit::extend_tap() [or: %s, state: extending]" fullword ascii
    $s4 = "circuit::create_tap() [or: %s, state: creating]" fullword ascii
    $s5 = "circuit::create_tap() [or: %s, state: destroyed]" fullword ascii
    $s6 = "circuit::extend_tap() [or: %s, state: extended]" fullword ascii
    $s7 = "circuit::create_tap() extend node isn't null" fullword ascii
    $s8 = "circuit::extend_tap() extend node isn't null" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

c94b942f-716c-46fc-9c25-35b7a684bd29

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion