deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FSGv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE [4] 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE [4] 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv120EngdulekxtMicrosoftVisualC6070
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 CD 20 EB 01 91 8D 35 80 [2] 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv120EngdulekxtMicrosoftVisualC6070
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 EB 01 91 8D 35 80 [2] 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SuperDAT
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SuperDAT: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 F3 42 00 68 A4 BF 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 08 F2 42 00 33 D2 8A D4 89 15 60 42 43 00 8B C8 81 E1 FF 00 00 00 89 0D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv200alpha38
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F }

Detection condition:
$a0

Full rule:
rule PECompactv200alpha38
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 80 B8 BF 10 00 10 01 74 7A C6 80 BF 10 00 10 01 9C 55 53 51 57 52 56 8D 98 0F 10 00 10 8B 53 14 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 8B F8 50 8B 33 8B 53 14 03 F2 8B 4B 0C 03 CA 8D 85 B7 10 00 10 FF 73 04 8F }

condition:
		$a0
}
YARA Detection Rule: RCryptor16cVaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 [4] B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RCryptor16cVaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 [4] B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: TheGuardLibrary
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 E8 [4] 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule TheGuardLibrary
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 E8 [4] 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeCryptor01build001GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 [2] 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }

Detection condition:
$a0

Full rule:
rule FreeCryptor01build001GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 68 26 [2] 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner02BJFNT12Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02BJFNT12Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DingBoysPElockPhantasmv08
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DingBoysPElockPhantasmv08
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Thinstall2736Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Thinstall2736Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnnamedScrambler11Cp0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 [5] FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10 }

Detection condition:
$a0

Full rule:
rule UnnamedScrambler11Cp0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 E4 53 56 33 C0 89 45 E4 89 45 E8 89 45 EC B8 C0 47 00 10 E8 4F F3 FF FF BE 5C 67 00 10 33 C0 55 68 D2 4A 00 10 64 FF 30 64 89 20 E8 EB DE FF FF E8 C6 F8 FF FF BA E0 4A 00 10 B8 CC 67 00 10 E8 5F F8 FF FF 8B D8 8B D6 8B C3 8B 0D CC 67 00 10 E8 3A DD FF FF 8B 46 50 8B D0 B8 D4 67 00 10 E8 5B EF FF FF B8 D4 67 00 10 E8 09 EF FF FF 8B D0 8D 46 14 8B 4E 50 E8 14 DD FF FF 8B 46 48 8B D0 B8 D8 67 00 [5] FF B8 D8 67 00 10 E8 E3 EE FF FF 8B D0 8B C6 8B 4E 48 E8 EF DC FF FF FF 76 5C FF 76 58 FF 76 64 FF 76 60 B9 D4 67 00 10 8B 15 D8 67 00 10 A1 D4 67 00 10 E8 76 F6 FF FF A1 D4 67 00 10 E8 5C EE FF FF 8B D0 B8 CC 67 00 10 E8 CC F7 FF FF 8B D8 B8 DC 67 00 10 }

condition:
		$a0
}
YARA Detection Rule: y0dasCrypterv1xModified
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED [4] B9 [2] 00 00 8D BD [4] 8B F7 AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule y0dasCrypterv1xModified
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED [4] B9 [2] 00 00 8D BD [4] 8B F7 AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov252b2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 B0 [3] 68 60 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 24 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov252b2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B0 [3] 68 60 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 24 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv036betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE E0 11 [2] FF 36 E9 C3 00 00 00 48 01 [2] 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
	$a1 = { BE E0 11 [2] FF 36 E9 C3 00 00 00 48 01 [2] 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C [162] 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 [54] 82 8E FE FF FF 58 8B 4E 40 5F E3 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Upackv036betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE E0 11 [2] FF 36 E9 C3 00 00 00 48 01 [2] 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
	$a1 = { BE E0 11 [2] FF 36 E9 C3 00 00 00 48 01 [2] 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C [162] 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 [54] 82 8E FE FF FF 58 8B 4E 40 5F E3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: VxNecropolis
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 FC AD 33 C2 AB 8B D0 E2 F8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxNecropolis
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 FC AD 33 C2 AB 8B D0 E2 F8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WinUpackv039finalrelocatedimagebaseByDwingc2005h2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 09 00 00 00 [3] 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WinUpackv039finalrelocatedimagebaseByDwingc2005h2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 [3] 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 ?? F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv1061bAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv1061bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED EA A8 43 ?? B8 E4 A8 43 ?? 03 C5 2B 85 78 AD 43 ?? 89 85 84 AD 43 ?? 80 BD 6E AD 43 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: aPackv062
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E 06 8C C8 8E D8 [3] 8E C0 50 BE [2] 33 FF FC B6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule aPackv062
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C8 8E D8 [3] 8E C0 50 BE [2] 33 FF FC B6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv071
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 ED 10 00 00 C3 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv071
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ED 10 00 00 C3 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv070
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv070
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 BD 10 00 00 C3 83 E2 00 F9 75 FA 70 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Ningishzida10CyberDoom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC [48] AA E2 CC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Ningishzida10CyberDoom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 96 E8 00 00 00 00 5D 81 ED 03 25 40 00 B9 04 1B 00 00 8D BD 4B 25 40 00 8B F7 AC [48] AA E2 CC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectSKE21xdllAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [3] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectSKE21xdllAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [3] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PAVCryptorPawningAntiVirusCryptormasha_dev
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 56 57 55 BB 2C [2] 70 BE 00 30 00 70 BF 20 [2] 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 [2] 70 00 74 06 FF 15 10 [2] 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3 }

Detection condition:
$a0

Full rule:
rule PAVCryptorPawningAntiVirusCryptormasha_dev
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 56 57 55 BB 2C [2] 70 BE 00 30 00 70 BF 20 [2] 70 80 7B 28 00 75 16 83 3F 00 74 11 8B 17 89 D0 33 D2 89 17 8B E8 FF D5 83 3F 00 75 EF 83 3D 04 30 00 70 00 74 06 FF 15 54 30 00 70 80 7B 28 02 75 0A 83 3E 00 75 05 33 C0 89 43 0C FF 15 1C 30 00 70 80 7B 28 01 76 05 83 3E 00 74 22 8B 43 10 85 C0 74 1B FF 15 14 30 00 70 8B 53 10 8B 42 10 3B 42 04 74 0A 85 C0 74 06 50 E8 8F FA FF FF FF 15 20 30 00 70 80 7B 28 01 75 03 FF 53 24 80 7B 28 00 74 05 E8 35 FF FF FF 83 3B 00 75 17 83 3D 10 [2] 70 00 74 06 FF 15 10 [2] 70 8B 06 50 E8 A9 FA FF FF 8B 03 56 8B F0 8B FB B9 0B 00 00 00 F3 A5 5E E9 73 FF FF FF 5D 5F 5E 5B C3 A3 00 30 00 70 E8 26 FF FF FF C3 90 8F 05 04 30 00 70 E9 E9 FF FF FF C3 }

condition:
		$a0
}
YARA Detection Rule: ExeShieldCryptor13RCTomCommander
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeShieldCryptor13RCTomCommander
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 8C 21 40 00 B9 51 2D 40 00 81 E9 E6 21 40 00 8B D5 81 C2 E6 21 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrinklerV01V02RuneLHStubbeandAskeSimonChristensen
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B9 [4] 01 C0 68 [4] 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE [4] E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrinklerV01V02RuneLHStubbeandAskeSimonChristensen
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 [4] 01 C0 68 [4] 6A 00 58 50 6A 00 5F 48 5D BB 03 00 00 00 BE [4] E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxGRUNT4Family
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxGRUNT4Family
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: nPackV112002006BetaNEOxuinC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 3D 40 [3] 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 [3] 2B 05 08 [3] A3 3C [3] E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C [3] C7 05 40 [3] 01 00 00 00 01 05 00 [3] FF 35 00 [3] C3 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule nPackV112002006BetaNEOxuinC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D 40 [3] 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 [3] 2B 05 08 [3] A3 3C [3] E8 5E 00 00 00 E8 EC 01 00 00 E8 F8 06 00 00 E8 03 06 00 00 A1 3C [3] C7 05 40 [3] 01 00 00 00 01 05 00 [3] FF 35 00 [3] C3 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxEddie1800
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 81 EE [2] FC 2E [4] 4D 5A [2] FA 8B E6 81 C4 [2] FB 3B [5] 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 [3] 2E [4] 2E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxEddie1800
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 81 EE [2] FC 2E [4] 4D 5A [2] FA 8B E6 81 C4 [2] FB 3B [5] 50 06 56 1E 8B FE 33 C0 50 8E D8 C4 [3] 2E [4] 2E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EncryptPEV22006115WFS
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35 }

Detection condition:
$a0

Full rule:
rule EncryptPEV22006115WFS
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 45 50 45 3A 20 45 6E 63 72 79 70 74 50 45 20 56 32 2E 32 30 30 36 2E 31 2E 31 35 }

condition:
		$a0
}
YARA Detection Rule: PrincessSandyv10eMiNENCEProcessPatcherPatch
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }

Detection condition:
$a0

Full rule:
rule PrincessSandyv10eMiNENCEProcessPatcherPatch
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }

condition:
		$a0
}
YARA Detection Rule: aPackv082
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E 06 8C CB BA [2] 03 DA 8D [3] FC 33 F6 33 FF 48 4B 8E C0 8E DB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule aPackv082
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C CB BA [2] 03 DA 8D [3] FC 33 F6 33 FF 48 4B 8E C0 8E DB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NJoiner01AsmVersionNEX
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NJoiner01AsmVersionNEX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 68 00 14 40 00 68 00 10 40 00 6A 00 E8 14 00 00 00 6A 00 E8 13 00 00 00 CC FF 25 AC 12 40 00 FF 25 B0 12 40 00 FF 25 B4 12 40 00 FF 25 B8 12 40 00 FF 25 BC 12 40 00 FF 25 C0 12 40 00 FF 25 C4 12 40 00 FF 25 C8 12 40 00 FF 25 CC 12 40 00 FF 25 D0 12 40 00 FF 25 D4 12 40 00 FF 25 D8 12 40 00 FF 25 DC 12 40 00 FF 25 E4 12 40 00 FF 25 EC 12 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsiduim1304ObsiduimSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsiduim1304ObsiduimSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02FSG131Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02FSG131Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01CodeSafe20Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01CodeSafe20Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01NorthStarPEShrinker13Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01NorthStarPEShrinker13Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}