_Trojan_Autorun_Dump_Generic_Dacic_19E38D3B_A_AAF775A0_213_2_Vir_523

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_213_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@aCb9kto_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.EBZ@aCEmdoo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_25_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_27_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_28_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_30_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_31_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_32_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_33_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_34_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_35_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_36_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_37_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_38_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_39_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_40_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_41_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_42_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_43_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_44_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_45_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_46_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_47.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_25_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.EKZ@aeBHSxm_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eSW@aaT6Wyj_10.vir,...

rule _Trojan_Autorun_Dump_Generic_Dacic_19E38D3B_A_AAF775A0_213_2_Vir_523 {
  meta:
    description = "datamaliciousorder - from files Trojan.Autorun_Dump.Generic.Dacic.19E38D3B.A.AAF775A0_213_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@a41ciQg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@aCb9kto_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.E8Z@ay0914i_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.EBZ@aCEmdoo_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eCX@aijlKSl_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aaD1MCd_5.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_25_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_26_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_27_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_28_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_29_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_30_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_31_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_32_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_33_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_34_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_35_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_36_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_37_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_38_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_39_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_40_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_41_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_42_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_43_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_44_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_45_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_46_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_47.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGW@aCQuMlp_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_12_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_17_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_18_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_19_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_20_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_21_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_22_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_23_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_24_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_25_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_26.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eGY@augxLYc_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.EKZ@aeBHSxm_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.eSW@aaT6Wyj_10.vir,..."
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "4e6184eeed3393d2f0e15d009107a9b423233bff06f04668a710f5128930dd09"
    hash2       = "206f8c20726ceedf23e5ed0177788fcbbc8e4c0ed04e673cf2c273e8bbb352f3"
    hash3       = "8fbbbc9650ee1c33c3468707eeee9301f0ba928a552c18734d3f69505f83fdd1"
    hash4       = "1c688c82a86a7819b56995bad76b12391cb4eac0e2bb9e05926cabaeda8b9cd2"
    hash5       = "230101ed95548bf063ee7a2585fa9935504b126cfa181c30c4441740b78fe988"
    hash6       = "d95a4041549971173debd487b1d82259fe18ed1e9922c5e54662acd017cb1af3"
    hash7       = "552d116edd055b74485fe46231eab9062488c056fc2585c5e20ba53a5965b0aa"
    hash8       = "3c2ed7485cd3eabeb4f253bf9e16d0b65a59d108fc8ad685df68d3ed92132c09"
    hash9       = "94e2cb78ff7b6cedc16e31c7c63dc942ffaa5fa5342b4e68745a27ad003aecc5"
    hash10      = "c8e20c4252a74a971d91c6e9bea2994a09bce868c14ab4f7f78fb43556e426b6"
    hash11      = "c77f0cad0f8ac453be2d03c2c804481f917cb7f98ef55de99504b3b561d7c5fe"
    hash12      = "c11778c00de29a8b86488f2c81cd0ed89d9f1089d5255a1a1b2bf5ea0d1f89c4"
    hash13      = "f2f6496027bd3704c2e75bc0bda75de36384670dca65cdd3d9d57cf192b1af6d"
    hash14      = "a12a1457bc74248fc4cd5f1e6944f7583bf5d93d78bc62f81bd489e5be93b8e6"
    hash15      = "49df4e9e0279be1cdc5bf6d0937efea986bcc6c44aff02dc2ee66f91ae5ed612"
    hash16      = "6e404d438cf82d73349caa0bcf9906a60d40bb46afdcc6a1d33ed4b9fb3b40f9"
    hash17      = "ff4bfb95ca7027b1cc41ebf8fa06574b9dd5f1335ccc4718b46d5066d17c67cd"
    hash18      = "ba30010411749ef4b27fcb58a46332e1ea448b0e3a0cea931913fda5148912fb"
    hash19      = "55b9a9ce4f0331a43068bfa416c821a471a081e35995d8c4cf49ddb660f21be1"
    hash20      = "b88406311e152851aa86a900b354751bf996a615b8890e375e9d0bd0ec3c5d7f"
    hash21      = "aa57d927242bfbad6f39bf1ad25e7156d62754c3ef08b711aec69d3eadae9132"
    hash22      = "7cb61f79c8237a57b304fa79bee343429e8c51ec6aac9890c2963c19d73f3d24"
    hash23      = "296f26fa5d05de9a3aac7b5197dd852dc82d906193828d67555e33d647de44fe"
    hash24      = "48340595ea5d7e17bf7ab1fab7631c8aada2a9db4b09d790f3e9c10108e99141"
    hash25      = "dedd6b967809273c86fa0a1dba6bfe9f85cae7fd80571855f8312f8c29a75ce0"
    hash26      = "41fed36411a58c9d9a083b4e8336d5c4bde84d67aa81402632f7b26317d033c7"
    hash27      = "953ccf67f7244d7bf2aff852e3a75d0f852358e4c678d5cd84b6ccf4c1a3524c"
    hash28      = "09a28631eab307c2dbf4216ce875d968a3ea04085563851e727bc3dc2d4c3c32"
    hash29      = "959c493802184e96ad913d63f5255904e777f0fdef69264bf606bf560cf8c219"
    hash30      = "8abaafac74ef8467927b188acb595032b9fdcbb5f2ca73064abd4004e88ec0fd"
    hash31      = "fec5fed8a7e0f6114a8ec161fe374e9401ae76ea4b180fcaa04cd797163d2d15"
    hash32      = "1683aaccfa04fbee8b35c0f9c2401f6319d191bb425ddc2e09b5b9521cc568f4"
    hash33      = "50c3a18d5b4a66acfd2978328b439151eb7206f2add63bc0ccb2c50ddf3d407f"
    hash34      = "2ae3359950bb8e2fe0f5a96aa7f663019b871598eb9683e8f182b0f85b7fb6d0"
    hash35      = "2cf34738a366dd39dbbbca1acc9b808f2197a4847dd211fdd501fba37e7ddd8a"
    hash36      = "7a04ea9e68f4bd9fd1141e696422c34cdd0a52fbdfd4c8381b4f5e466ca1661c"
    hash37      = "ecf5d49ea33919513e89c0da128961aaa57d40942fa535994ac53db7c6ae4ac6"
    hash38      = "68dbcb1238ce4c6f15fd672bca0128785c62ea2f035aa7256281b87f77ecaed5"
    hash39      = "99eeac1b8363efad294d0d5c03863697c24510454fe04177fcd7474021540744"
    hash40      = "d28f1a6c9eb2fbc698f5d39a34179dcc19d46304933c2d88acb8f44968cf8700"
    hash41      = "681b329f11e1f0dbeb1ec0f921e2c5480f3a2a444607154500a1d0271fcd910e"
    hash42      = "00eca6a4fc25588c85e0d44b24b7024e50bc737eb4f4c34d019ad8ab04606599"
    hash43      = "df56085139ea750ab689a5bb88a6a5fe9eaffa4aaa6e63309300756b3f211663"
    hash44      = "af662dffdda9078da7ad3a4a164a7d6be844c1cd7de780be8fe5dcc33484b636"
    hash45      = "269608bf5068459802dc9c15549f48d6b0af84da199fc83ebbc1d62602fad62d"
    hash46      = "cfe27fd6a9609248bcf0be48a067b775ef5d05164335a71da95572858cace1e0"
    hash47      = "cccf1dce08c36e41f98dd419cd2b2842bc582497f71eb27c74cdee6609b2ef84"
    hash48      = "e49fa6da69bd73f17f1d52fee79777a7bd5b9602ea0935ae8990092b2d9b1917"
    hash49      = "2d14ad2ffda97d97f0ca33237ac62b25051057f099e00f65a397ab461711733d"
    hash50      = "af09d81d4db2ba0d5b569d546d22952636ffebef8d488686a76a3320273b316c"
    hash51      = "69ef502ca83c22cc33a9d466b12dadf536fe4438a9c424c5dae41a8a415dde88"
    hash52      = "5ac652d5d43e0af574e899d0b49b5d7d5edefe39acb57cee7a7e00e6ca460632"
    hash53      = "4a6fb05e1de5349aa037584c6a1efc34e2c6fff193c61c5d549f1a39fad5ba9a"
    hash54      = "1e33c613c8bbd7a8a208c3012618598e3c9ea4c40f5a95b27584defbb8fb3b67"
    hash55      = "b9eba717a9ae8aeabcfee69a0faa2d579524983fe6c8900d899469de015a13e1"
    hash56      = "111def478efe7ee69fe1efd905b7b71eec633e0c76ec19aeaf2c9837de778133"
    hash57      = "fe0c8be7d27677a5195022fe39289bf8a884f02118cb668833e35cb9ae6c7de2"
    hash58      = "c9171fc1680813e937ff13fb624097708ec78acd30d5b27a569a6e163e7ce2df"
    hash59      = "3cec0d2905eb14275d26e141a65c4490a78719ae5f4822181128651683e2a99a"
    hash60      = "b73435925ea5bff564ee603246061c65339a128762d5e1e3141a2f390038cc41"
    hash61      = "241b06b0dd64c36f1e3767ef63b1e142b20e7d803157aa2a6ef3330c897aa6f9"
    hash62      = "576aa0645ea46551b464abc749a994a14285ed651403dd2a67ce6cece9943b90"
    hash63      = "a074afa7d1cb1cef218c8ee1ecbc9a5aa62a347a5301deb027edc1521ea63542"
    hash64      = "2bbd05151b02cbca4cb20d078d24a2ce46fac5291b48008c6d68b898dd0b95d8"
    hash65      = "969e1f569e88b01f9ec6dd7300f9cb7fb326e072be02e716be7f9fc923d495fb"
    hash66      = "014b3d2bddd49dc5febeeb307d7dddd3b850290834046629a340cad5b7e97136"
    hash67      = "d76640490f19b7b7b6ccfa9d84fbd99b255ea6ca4d798a4e78f0c8ccf4d8a4a1"
    hash68      = "bf229eaa1d7b388e5e463d2692d364eab17ac2b9808be0a7dd65666cd312be0c"
    hash69      = "2c5bb32ee813012a0ca30285797b09a71dd7d127c742a2f6d5e1c626e509ff09"
    hash70      = "5f4a6ff82a17d34154fffb8282966cce866bebf1cd6df21c66769060ba39790e"
    hash71      = "f3544d6e45f63033cc7ec02d5039915f8ae33e3e132bef1ef38ebbd6da72e958"
    hash72      = "ff37a70d7cf1f69eb344c1c1c2b00d582d489156d5c43e8a2ca9588e16dde066"
    hash73      = "db24f40d8ae298f5aca94e8c537d10cca2e91bdd1a08b7b0bbbebec7ace20673"
    hash74      = "390329153addb70ddd4757c6abd6209c2fdf8f305c1acd35681528d116ac2108"
    hash75      = "f39abedafbf2ba02b80e704ecf53bbe1defc61db1aa9d64ad9571d78aeec95c3"
    hash76      = "a82cff158daf469a41c8910d1cd0a79258a05a8f1519f4e1c77a0458f54f87db"
    hash77      = "262025345caf4e5b4753f5e8f1a913220f800481fc5f3fca408815a3fa2c028e"
    hash78      = "967dcb5b7bfe393e4c3548142f0d00afd185723c411696e6374d1a028c3fd8d6"
    hash79      = "f8b2408cbbad5ece228df76f1d8993c95cc4fb57f05f6919904212b3266a27d7"
    hash80      = "fbd8bbc591710ab2156f276312ca3d41b4c1983f4a3b0b164b4e1232acd10fe0"
    hash81      = "814e1b2ddec6981bb47e8a70c91005de6d379d1ed05f2c80015527f4ffbb7837"
    hash82      = "d223bff28ea3d65118c68a028def388281a2375f3d4c75edcc4adb4355251530"
    hash83      = "1a5389a3a685a6d51934021e2dc3c573a75bcb5760aa91a49d3a177827b03305"
    hash84      = "acdb8f791dc1e17dcc96bd7733050465d6b917dd3ee352833e6819b1b3a4c98b"
    hash85      = "328795263d30466c48b0138ca9dc6ba83b46a4ff6d4d594cceb3ec2feec71802"
    hash86      = "76d3f49772b284efb973b430e62ac87d9128edb7510339843ec8b7f21b77de3f"
    hash87      = "7c939d29927ad3fbfc010a8fa259f3ec04c2cbdb2a00f1ed9ef810c0bc7154e2"
    hash88      = "0184e99e5991f54d70dfaecc49c6553c00a3ce1f2b12ae649dd5abbc089cbbe1"
    hash89      = "185ad47bb9751ecc51516f93bce7d313ba6b3093a045080930090bb610027447"
    hash90      = "a947713deb0ff3c6ce24950520f7c02e476798705997fe4b7a1d2bded17f9750"
    hash91      = "0dd90a23d5cafc1ae54bcef2ca455e3d8ed7044c78c4e05edea428e065e8e23e"
    hash92      = "dee4a953e1386cd7d33d399dbb8844c3388b5be5a88d6b5d5d7abb4768bdbb30"
    hash93      = "d17b0719d2dd8b2d6d0651683423ef81553c5d3f16efc090c26a64fbc76265de"
    hash94      = "2d06e0545758c0a2595735bd24b3e659eec30c2018b92a19af84d92163ef6a95"
    hash95      = "bea9ccc4e3a112044b44dcbdbae1049fc49309a728a738d53de76647dbda6bae"
    hash96      = "2bfd78dfb29efbb6253a2b90d24169da89c66d3d8f8d6c352b8725f8c628b932"
    hash97      = "9330321f7d669df36da2b83c62737a623687f7f2017fc10b215ab0dea1171b77"
    hash98      = "fc35468fa65db712321b47fd60873a57d16f424d098823e123421de882237592"
    hash99      = "1cfd16c2e75c6f0adb6349a275be9c9058ffb1680ef4bb103ca024ec50347715"
    hash100     = "d996a632cedce2995eac11e8d2a24b23511e5cdfeadbdbc7b7b8eae6c8d4d150"
    hash101     = "a24778b477615d3da0f913d5e1345498cf75f4691265aa14ff2ad0034e890645"
    hash102     = "0c2371638b2f2a3f8db1f3f53690b0f4abbc3b11e827ee8c72d210820cef0e41"
    hash103     = "5c505c10d26db322f149e14d15c6ac9ec5edc3c36bbdddbc32f80058e2625b34"
    hash104     = "6261b027f8f282240bba9842574f4b27eb19d330e0c0a3e1d415fae7dec67639"
    hash105     = "2d94d238081ada2bf36f0dca048ee0a6e450dd8faa7ac49868a2b2e46d8b35c1"
    hash106     = "a646f60ca7cc176f5acadbb01aacf7018bb7eccfda937f3bd492364b7ab89cbe"
    hash107     = "20dad784d8a0b346494b3cb6484f064a0c0f92edc5db54336aed8d5b59b5f23a"
    hash108     = "3303e2b908a493978517fb8d35d4162a7d7ac50c45e55923be69067a803a83aa"
    hash109     = "5482f42a922c06de4349bac71b689b598e18d5925e0767594ab0a9964a4d4e5b"
    hash110     = "420a7eb970986f2be852fae40426778da6da7dbdb1f415dcc5f5b60af48622c2"
    hash111     = "ccd098695e35749d2bf1ff592a421c99ae4e4ab7f4d2eddecfdeb583932f3d31"
    hash112     = "1ce55aa23394d1ec73dec184cdd5ac2c7fb41c4afb416eda554d45b70aaa3dc4"
    hash113     = "9bbcad9802fc0b234620b1f6999177e0795673a87fb09acbdfb79e8323566a04"
    hash114     = "495a8ef14fc315b34779ae9fcf10a56a9067f3f58b6ebc17d71c5d0362664445"
    hash115     = "52bdc439acd8f6ef3bacc97d0ab0f9d31993121b88812396088004cbd98c6c87"
    hash116     = "f0c0ea8c001221f83e2d100f12a479a61f9bc1c7863ff16b4f251b5ca43c52a7"
    hash117     = "8da550f61d3b39b21af1fa6143876cb76cc00deb80c070188ecd5eb1cf405ca0"
    hash118     = "77d641946c2f50a17f664f21c4833c1f51f599190d31270935bf9b7aecf028f5"
    hash119     = "1f95f8062632caee0380299037120b4346e8455a3d2bb49deed1d6d901e7e439"
    hash120     = "03d4ba3210623d4ff658081fe5544b10ee9bd5a6a16f51ac55e71786ca61a64d"
    hash121     = "caec166c86b66d7d5a7d1e888aa9545e478a11c2dd01deca371598778e59f6c8"
    hash122     = "9da430c5c49f1a3ddffac833bd45c2d10a84bf26b346d6eb53dccd2810cd2647"
    hash123     = "aecca16675e13bd8419154545b655986771d118b6a1a4f40ef7cb6c70a718971"
    hash124     = "2168b2e0b3065b81926cd12f0dfeafe0483860ee8fb19d6633685deffd65d8b5"
    hash125     = "b70868ef77b6604194a984a818d4887865f97aec581ebfe125cdf2b8bcc1dcb7"
    hash126     = "a6a6824ed2f652b71dde84453bf4d59700eda89651314e3cc955542ce89e2421"
    hash127     = "290437193deec91dee447c4c3648e042ed205faca51d6efbc7e0b2932bfcec26"
    hash128     = "4d2f1aa5588ef85616b5f70c0e2983a9dee2236b1157525751427f14d71f27e2"
    hash129     = "a47b83c79128098004621c41b6dfd2e3f878957438127903072dae4c6b243a9a"
    hash130     = "10f99f7090b5797e06d81c10b9fbfb3b140502ac08f388d4999b86ad311268b7"
    hash131     = "9b1506883c71a4b1f74269d768a4ddad6f086596b45eeda49bf0d89c540976ab"
    hash132     = "eec1798fd7837ab56c079b1af8ad5fed185e1f5c4dfc6bd8ca276351ce4b6d96"
    hash133     = "141dd85fee395f93a5f8dd78fe34e6a2c0d2a86a87ef3708ab83d5381a6e2d95"
    hash134     = "d893075b8b6a4dd5069e3bf1644827a76fd0fa110965977da696995decbba879"
    hash135     = "4fd1a559a67d2f0be04e433a7cbaa2b479f1be344420a5594df1c65f567e9fa1"
    hash136     = "ad15de82f505c7df917adb64c74a93b8664a1e2b944467ab660d1cc10404dce4"
    hash137     = "cca256f737423e3eb19794b5752ff18d0d32e36b5182d72bea9e9ba87e98ba8e"
    hash138     = "88a5cea943a7926c37aee6ae10de373ecee5cccbe87cfe139b5667d4da9d5d38"
    hash139     = "baca8ce67923130106131decd678f737320c320b4820f0002e58e3fc9b3e4bba"
    hash140     = "74cecd65d4e3a60784850ac33ab52c23d75f43f3f8db8b7ad289e418770e735c"
    hash141     = "ef2225dee51daeaba73a40823e70cc5646e50e0f9915f580b0af8cdd1b27abce"
    hash142     = "012e9f32b27a81f40686f37a0fefc9047ad72923d0fa1dc39f00ba3bf08945fb"
    hash143     = "c1da2a9f3648f8c658ca0b6677d9627a876de0690b93f6f4429a47c2a18a0f30"
    hash144     = "f2b53dc975c52b54e3caf1609b7bc180059f33fd780f3193d5bf68079b1016cc"
    hash145     = "427cd88744b981600b5ae97bceb9203dfc7475b9f51d7d11f824c26d809b22ed"
    hash146     = "c9e2ab565f7a4b2f5e56a55f2308fa024dfd766c192f01475abc722d83ecf2a1"
    hash147     = "6eff249aef0d8b68a2e434f1e06e964491f54a06976ce043709f16d4328494f9"
    hash148     = "6a42ce63d439422a8ed28966c4c80ba58fe3238c0514b5b6a97ae648dc8e0e78"
    hash149     = "97fe66aba77179588b64bf2b2a5953ff22eb6ce2c4898711534803b44c1b5592"
    hash150     = "3271ae8de78a665a9935098d08fc371c15ababed117f18902a608094b4bae94c"
    hash151     = "7e861b6bddee847bc6c37876bf65927e284c1fff10e808bcacd8c33b9986c184"
    hash152     = "003927eefda23d38ad84342ef94dd72a68a45b5c16ad21653f843b811af4aaad"

  strings:
    $s1 = "Please enter the password." fullword ascii
    $s2 = "An unknown error occured. The program will be terminated." fullword ascii
    $s3 = " already exists in the current directory. Overwrite?" fullword ascii
    $s4 = "Can not allocate the memory." fullword ascii
    $s5 = "Choose a location to save the files." fullword ascii
    $s6 = "Can not create some of your include files." fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

35694ae5-7c4e-4eb2-8f23-fdc5e59f10f0

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion