_Virus_Hijack_Gen_Trojan_ShellObject_GyZ_am0pOwg_4_1_Virus_Hijac_532

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@ayMBdto_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@ayMBdto_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Z@aKTibuk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Z@aKTibuk_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.HuZ@aiy413e_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.HuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hyZ@aWevApi_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hyZ@aWevApi_1_1.vir, Virus.Sysbot_Win32.Worm.MyDoom.NF_9_1.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_GyZ_am0pOwg_4_1_Virus_Hijac_532 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@am0pOwg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_11_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_13_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_15_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_16_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_17.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aO@sVhl_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_10.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.gyZ@aSgChKg_9_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@ayMBdto_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.GyZ@ayMBdto_8.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@a8J@6Kg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Y@auFLy0g_6.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Z@aKTibuk_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8Z@aKTibuk_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hHZ@ayM4QWg_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_3_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_4_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_5_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_6_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_7_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_8_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hSZ@aK5f0Yn_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.HuZ@aiy413e_1_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.HuZ@aiy413e_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_14_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.huZ@amBwvTb_2_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hyZ@aWevApi_10_1.vir, Virus.Hijack_Gen.Trojan.ShellObject.hyZ@aWevApi_1_1.vir, Virus.Sysbot_Win32.Worm.MyDoom.NF_9_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "f7e51843ed4e69d1d3073ff8b73e05e9d003e1eda117f325fec1190362fa0015"
    hash2       = "224754cf717838f4af1d151fc81da758dcf18ee439ab2553fbcffd148b626198"
    hash3       = "8883cc13e0f391979e828931e59168cd8bdb1814598323622a51f85ab302f3f8"
    hash4       = "5689db62c40666d63ef63ecb320d6dc65e02089823ab2cd3ea4df3a618957c94"
    hash5       = "e3b8b1a3e157be8984ac6884c7890f8a0b190866d42bed46da6248a94c50ab4a"
    hash6       = "8ac62cd67f11bb3bbc4a0b4f633cb8e67c5ffb91c71805a278c781c2a7340a55"
    hash7       = "a303927ac1959f47e7bec8c64c769d8bfe9555c683a03231f254708498589545"
    hash8       = "2bac5ee120f1e43a63553cef86ba6f3940cf539b48ab1bf703056974867f73d3"
    hash9       = "9ea06cd1f56ed75fe491a833d795860e7d1a098cde9bad12e5e37a01ca42daab"
    hash10      = "b8db351d8d3f9a95a48dbdf7c94a4725d772150fdd632d62a9070e9ad39f243b"
    hash11      = "e102db8a8c35cd3e03c348102da7c13d8b4b4c451eb125439bbc8c2822701dd1"
    hash12      = "1fbca3e9530cba2a549e69b8ceec6182998bcf0245d0000aa2ffc9ce3d033174"
    hash13      = "553f208826dc161e158cfb11004689292c3aa0968c73f049a3621fd721547e14"
    hash14      = "73ecc9f8486ba1bedf5511aa47bd858465529d6def4ef60441795608806ec219"
    hash15      = "cf4b0ac1854ba85f283cf7ad339523d593fadc9420cc9f73928db771978ab88f"
    hash16      = "863554520a4b52d05828943218c7e7c6115a87d3836cddc16d6c484f89fb6a66"
    hash17      = "84c12a44dec625fe29fb446b3677f35aada91619851c98a930fc77ad2cd42000"
    hash18      = "466b2bbc78cf5d22e379f9c5a6f03b230225a4cbde0433e3f299c24de4959bbd"
    hash19      = "dd5736d76f5ac364b5af69e389e23db7c68b49538867ff3edbdbe7e74e24b4fa"
    hash20      = "56ec9a1da5bc3d405a1f839cbe0cc0c70aac2192b37bb269e43152b7677a7b95"
    hash21      = "918323370638e60a75310ca23a0509f578d40f4b5511efe5c38cf58acdd56357"
    hash22      = "52d6b8e3f385451889ad975310b0a8f93b25895cfa4bd634b393f7213466c0b2"
    hash23      = "6121727b1b75b0c85e3c546827712e3151e61aa6267fc7f16a808de1b6ccb788"
    hash24      = "0d2de7ad522950d3e7aeeea5346bdb36a3d8b8739d51ff413c4c10bb2dd93cd4"
    hash25      = "8b82e75d74aaa00eef588a3875366908845c64e6f31197f0c6278d392056187a"
    hash26      = "2d5ec57a110fcefb6eec634d694c9c1999b9add82316b914500c719e38b7d4b5"
    hash27      = "66978316d52394b145ccd737a0203d20b01753a115b668ca976ca2e855cb5fc5"
    hash28      = "ff48c2bbe7041e51d80d645ab33f62be643c85500bba8705c23f19c36f6b09e1"
    hash29      = "6c1d87bc2cc66dd1bb007fda1bd96a6401e6eaa6df18e5e699760abec4209262"
    hash30      = "884029ed7fedeb818a11ac7fb866618c1d3d62da3f4777509975374ea0fabdae"
    hash31      = "e0e9a77e11210cd555d10fa8b1f6fc4cdec4274841b145a21bd3e8502e9bb7a6"
    hash32      = "62a4ca97822f59c9f1b6d53706ce8d9387576c256c08751d877bd3cb59e4868d"
    hash33      = "cfebde5708080522a30cd3977afe278005eae205bbb54f0df596d84dcb5bfe94"
    hash34      = "f3621d40188f122384a8431b3521324a644915f56377cf702a824b7b1023e313"
    hash35      = "5134ccaed29a58bd24d6ad6746109c7c61c9bdabd35346bbcced133973869c29"
    hash36      = "959b7437e887885cf06cd30a2366200b130506490e9a83549c257fe1a2d4c701"
    hash37      = "efa5d1a0aaa7f12bf8efef0acbb6d0cf78330be2d5666ba41dfd925885d1efc3"
    hash38      = "0213fb49267a8538644345f0684deb0fa474136be7534cdf1fd92196b286b916"
    hash39      = "68a6fb14ca8c89bbce60b700977ce144d1249b245637e1b5b7bf4c9a8276c0f0"
    hash40      = "234aa36f5c3897579e4ccce6340f8e72713765359219cadbebaf053264c291af"
    hash41      = "f1853c2f0a32c477f5442bbb79f8346da48e47225548ef55c7e4d04dec48ff19"
    hash42      = "bf44a0453a5588a972408d1f4d6de98e43f88eb653a468fe9b5013f6e701c238"
    hash43      = "5168142e71599a98e9cc84e159574e48e1e7dea179127b179ddc007f8f187d70"
    hash44      = "a4c835ec5822c7d48a6906a49bd8bc5a8d9652a2b3566cbde2a4683222076d86"
    hash45      = "ccc1aff4ab2fd635360d02e6a9bf2a212b3f03c3943f0fd21ab69e4819213d78"
    hash46      = "7096ea6f5878db719c55c43974fbf59d5b405e917b1333f80cb5441e3f5253d9"
    hash47      = "bc56609236febd51fd4453869f64775e6747ed68a5ea1160e9200083bf954d11"
    hash48      = "15c6619a96c86cd31b08ba5300c0e97d9815f5be16f28bae3ea7b17d0d23a9cb"
    hash49      = "e55134b7b8769dbca1a0e2520b73ae28eca78f94c685b549c59b1f26256d751c"
    hash50      = "41647adfbd31ab15114d31748244c521ee730c2d419e32f940f8ecfc98b46c8f"
    hash51      = "f455b59172fc55e54340f17238a4607d77a6ac401b965b949837273f4e4606c9"
    hash52      = "551e829f4b06bef6149b5228a87581ed891f1f8b95c7892fb2c2429426a3d59c"
    hash53      = "a397aadb51105c7b589c85c8c2782843e2a7adb3a28cc1cb92b62fbec6108c1a"
    hash54      = "3b8b0ba4badd66cb572fdab09133a25b5bb6fcfbd3c49106b30b1064b92e1116"
    hash55      = "e5db74204e2795102c521b76ff3ff47188d19c23476794295dc6d5bb0898832c"
    hash56      = "9f3285b6da89cb455e61a06f3ff71bed988c1dbf3cbd5dd25acd9bb2a89a3c32"
    hash57      = "3975c946aee8f85c2639bfa811b5feba5e26a60be6b31533ecdb615521d3d3ba"
    hash58      = "5e3e7d905bf4950e257a3898a21c0f1372b37d272e6f2ca62935a3fff5dfe8ca"
    hash59      = "9c1db80d67617e3c35a70003b7241442e06fddca13ae0eb9f3b12d0e5cdd385f"
    hash60      = "3e313c4458bc8eaa49cc6fac623eed0c8d31c9813960494941fb023a521e3fea"
    hash61      = "87cb6c55e24d78de5e70cfe2f8624014d21ac30529836da1dab59a7a43d7b285"
    hash62      = "fecf49a38774fb215c2213fb3c265844de363be50f850052edd84ea92d1538e2"
    hash63      = "dde2b1f08f8c2aa4c72b1abc0193dbb056dec43966fce9512451202c3e60841a"
    hash64      = "5f988d4b5ceceb5960df099168549d67fefcb7bfe67976ab0aef4e2d82c561f6"
    hash65      = "ae24b13c154a97b2ddf2d66f977bdfd1ae500af4c6b116713aa7bb0479ed991c"
    hash66      = "a8f226bdf5acaaeb3a8a021b70a54faf903147f7428cd84fc8a76cc2cffdfa4f"
    hash67      = "72e8bf994a215b8d6d1817f313886a9bfa46c1206e0d724b2ece00bcf78ccc68"
    hash68      = "d8cdeb7c4b5ebc3f19913f45e19811b92902171151de362694738e1a626ff41b"
    hash69      = "1a75942592e601930b0125b90e65972b6fc2504741510f193eb798db028300d9"
    hash70      = "70098c7733c1088dedeb1b6fcf9d26b95c833e98936a40f49b9c52a70365937f"
    hash71      = "7850cd8305cbe8dad0d8366017dcffdd5f9d1f1c1e9aeddc081f344735f4c8c1"
    hash72      = "94913a1b60891d8b417e773473f9be4c36552895cb0460662fe61972bf501415"
    hash73      = "fed2237c846019cf06d44a1b1549dba7bd459bc15602d19ab056e1a6a8afbb39"
    hash74      = "87da54c45178ab6d259fe556f9211b017601df019dda54315e5e7384f262f55a"
    hash75      = "9da5ec70b5317bf89e43903d718b004ba77c8785a9efe55fed497bb90d542e1d"
    hash76      = "d292e7388d4cd59fc1fc5efe2e933e453bbbe53a29503a5c6447849afd6f3c09"

  strings:
    $s1 = "circuit::create_ntor() [or: %s does not support NTOR handshake]" fullword ascii
    $s2 = "circuit::extend_ntor() [or: %s does not support NTOR handshake]" fullword ascii
    $s3 = "circuit::extend_ntor() [or: %s, state: destroyed]" fullword ascii
    $s4 = "circuit::extend_ntor() [or: %s, state: extended]" fullword ascii
    $s5 = "circuit::extend_ntor() [or: %s, state: extending]" fullword ascii
    $s6 = "circuit::create_ntor() [or: %s, state: created]" fullword ascii
    $s7 = "circuit::create_ntor() [or: %s, state: destroyed]" fullword ascii
    $s8 = "circuit::create_ntor() [or: %s, state: creating]" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6262fc9c-edf4-48d7-b480-90f46ec58556

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion