_Virus_Hijack_Gen_Trojan_ShellObject_h8W_a853Pwn_7_2_Virus_Hijac_545

YARA detection rule by HydraDragonAntivirus · GPL-2.0

datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_2_2.vir, VirusShareTrojanClick257946_1.vir

rule _Virus_Hijack_Gen_Trojan_ShellObject_h8W_a853Pwn_7_2_Virus_Hijac_545 {
  meta:
    description = "datamaliciousorder - from files Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@a853Pwn_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_10_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_8_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aCZnhbe_9_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_2_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_3_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@aqG68Ic_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_13.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_5_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8W@auCCoZb_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_4_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_6_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_7_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a0kuefc_9.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_1_2.vir, Virus.Hijack_Gen.Trojan.ShellObject.h8X@a853Pwn_2_2.vir, VirusShareTrojanClick257946_1.vir"
    author      = "HydraDragonAntivirus"
    reference   = "https://github.com/HydraDragonAntivirus"
    date        = "2026-04-26"
    hash1       = "c682e361f77ae05470a76065c7a3641d40a2707ab5bece61798a7542d7b48a04"
    hash2       = "9ab21b3b90a745ed3353a4d36c9a672433a2766d83aebcfbc91344ae184f2123"
    hash3       = "9e68803ee118256c8a1729b7d1f0b761ccdfd50cff611cfcd9d98f879a15410e"
    hash4       = "cea0f6579e0a9fc4f65c6d764a391e16713718b2ae8f9d02ec0b5aab0052f275"
    hash5       = "64d877c8985bce6cf68247548555db3628547393c883e98cbb4c7262c904aa24"
    hash6       = "fcfa5783774e74956d95e0deedf9d25babe25559d2ba4e81addbda1b4a626f52"
    hash7       = "41d963d7c51619230bc56592a6e4d39c96e90c04d45292e87727f96761a16541"
    hash8       = "7302e964793f853740b92325b2308b5537a880881a4acd99e6cb5ffbddc300ae"
    hash9       = "6ae945d9454e7c28385aa815b66e1fb51ef97fe11478e18426b316f45d20a3d6"
    hash10      = "6c370604b5ca0e249cd91085b6ef0b3b7814e99151565d00bf2859b29ad4637e"
    hash11      = "5336a38be33b2f8f6afba2ca60483c7b17e16565f5b073d2e712f96a104c626e"
    hash12      = "0c3087201b875290716203109c116aa67092952b7b0b983ca0414fc95c913c6e"
    hash13      = "d470656d006564f0f5d23c44f21c3633a8eb677c2906888e48b52df716020f64"
    hash14      = "ab3d9cc812f93a0497e03ce65bf12058dc4bccb72d4c14d61e0b533f73a00ded"
    hash15      = "fc08f422e4679b557dcc2c34468c4ef2df0ad33aa3b96e249cf098fae94167ff"
    hash16      = "3c0e62668297340d7c921f31ff8b93aef4045fd8451e2ed1af51487b4b840a0b"
    hash17      = "40a67ef952c61ca95324b6611b23fce774c422ef6bba33152eff55bd38488acc"
    hash18      = "e25748fc0a21f5828cad702244731a582eb13e87950adadf0ac99906d769edb3"
    hash19      = "774c11fe3a27eac0b4625398b65a1de4e7f3394087ad2330bc27345f36e390a2"
    hash20      = "59410b9fcb6dfbc62f5fa8a5bc2d7d98d992230a3b67585794aa57fde692f7e1"
    hash21      = "f4a9429c26be601756d46b19c9e3f2916fa1968b2b1ec9658310e6db6bbccb55"
    hash22      = "12ee7d854db5ab4ed51117aba115e75b258f54aff30972d7718f7502316d8a0f"
    hash23      = "22fa522d7bb7644a76f58332a41943de55772ce9aeb4935923362498816bfc91"
    hash24      = "54b03fbf5be7fa0ef285bf53401363c267bf23a2fde21c4a096d7d85078ccdd7"
    hash25      = "62a14b7a4498548b834b6e8b9fd51580efdfe695a3db8601a32229e4325a0732"
    hash26      = "2232141d329267f88679decd77f3992b67862e751aa2deaa6585cf8116eddeda"

  strings:
    $s1 = "# feel free to customise it to create a shell" fullword ascii
    $s2 = "# base-files version 4.3-2" fullword ascii
    $s3 = "# setup from updating it." fullword ascii
    $s4 = "# would be benifitial to all, please feel free to send" fullword ascii
    $s5 = "# a patch to the cygwin mailing list." fullword ascii
    $s6 = "# environment to your liking.  If you feel a change" fullword ascii
    $s7 = "# The latest version as installed by the Cygwin Setup program can" fullword ascii

  condition:
    (uint16(0) == 0x5a4d and (all of them)
    ) or (all of them)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

97c40636-af75-44e6-98ac-2d6ba7dd3204

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion