deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: tElockv099SpecialBuildheXerforgot
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 5E DF FF FF 00 00 00 [4] E5 [2] 00 00 00 00 00 00 00 00 00 05 [2] 00 F5 [2] 00 ED [2] 00 00 00 00 00 00 00 00 00 12 [2] 00 FD [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D [2] 00 00 00 00 00 30 [2] 00 00 }
	$a1 = { E9 5E DF FF FF 00 00 00 [4] E5 [2] 00 00 00 00 00 00 00 00 00 05 [2] 00 F5 [2] 00 ED [2] 00 00 00 00 00 00 00 00 00 12 [2] 00 FD [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D [2] 00 00 00 00 00 30 [2] 00 00 00 00 00 1D [2] 00 00 00 00 00 30 [2] 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule tElockv099SpecialBuildheXerforgot
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5E DF FF FF 00 00 00 [4] E5 [2] 00 00 00 00 00 00 00 00 00 05 [2] 00 F5 [2] 00 ED [2] 00 00 00 00 00 00 00 00 00 12 [2] 00 FD [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D [2] 00 00 00 00 00 30 [2] 00 00 }
	$a1 = { E9 5E DF FF FF 00 00 00 [4] E5 [2] 00 00 00 00 00 00 00 00 00 05 [2] 00 F5 [2] 00 ED [2] 00 00 00 00 00 00 00 00 00 12 [2] 00 FD [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D [2] 00 00 00 00 00 30 [2] 00 00 00 00 00 1D [2] 00 00 00 00 00 30 [2] 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: VxBackfont900
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] B4 30 CD 21 3C 03 [2] B8 [2] BA [2] CD 21 81 FA [4] BA [2] 8C C0 48 8E C0 8E D8 80 [3] 5A [2] 03 [3] 40 8E D8 80 [3] 5A [2] 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxBackfont900
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] B4 30 CD 21 3C 03 [2] B8 [2] BA [2] CD 21 81 FA [4] BA [2] 8C C0 48 8E C0 8E D8 80 [3] 5A [2] 03 [3] 40 8E D8 80 [3] 5A [2] 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrunchPEv20xx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 E8 [4] 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 [4] 89 85 [4] 55 BB [4] 03 DD 53 64 67 FF 36 [2] 64 67 89 26 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrunchPEv20xx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 [4] 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 [4] 89 85 [4] 55 BB [4] 03 DD 53 64 67 FF 36 [2] 64 67 89 26 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Litev003a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 06 FC 1E 07 BE [4] 6A 04 68 ?? 10 [2] 68 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Litev003a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 06 FC 1E 07 BE [4] 6A 04 68 ?? 10 [2] 68 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimplePack1XMethod2bagie
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 [3] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule SimplePack1XMethod2bagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 [3] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: PEncryptv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEncryptv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: BJFntv12RC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BJFntv12RC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FishPEShield112116HellFish
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B }
	$a1 = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 [3] 00 [2] 00 00 [3] 00 00 [2] 00 [3] 00 [3] 00 ?? 00 00 00 00 [2] 00 [2] 00 00 ?? 00 00 00 00 [2] 00 00 10 00 00 [3] 00 40 [3] 00 00 [2] 00 00 [2] 00 [3] 00 40 [3] 00 00 ?? 00 00 00 [2] 00 [2] 00 00 40 }

Detection condition:
$a0 or $a1 at pe.entry_point

Full rule:
rule FishPEShield112116HellFish
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 BD FE FF FF 89 45 DC E8 E1 FD FF FF 8B 00 03 45 DC 89 45 E4 E8 DC FE FF FF 8B D8 BA 8E 4E 0E EC 8B C3 E8 2E FF FF FF 89 45 F4 BA 04 49 32 D3 8B C3 E8 1F FF FF FF 89 45 F8 BA 54 CA AF 91 8B C3 E8 10 FF FF FF 89 45 F0 BA AC 33 06 03 8B C3 E8 01 FF FF FF 89 45 EC BA 1B C6 46 79 8B C3 E8 F2 FE FF FF 89 45 E8 BA AA FC 0D 7C 8B C3 E8 E3 FE FF FF 89 45 FC 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B }
	$a1 = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 [3] 00 [2] 00 00 [3] 00 00 [2] 00 [3] 00 [3] 00 ?? 00 00 00 00 [2] 00 [2] 00 00 ?? 00 00 00 00 [2] 00 00 10 00 00 [3] 00 40 [3] 00 00 [2] 00 00 [2] 00 [3] 00 40 [3] 00 00 ?? 00 00 00 [2] 00 [2] 00 00 40 }

condition:
		$a0 or $a1 at pe.entry_point
}
YARA Detection Rule: CodeCryptv016bv0163b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CodeCryptv016bv0163b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VOBProtectCD
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5F 81 EF [4] BE [2] 40 ?? 8B 87 [4] 03 C6 57 56 8C A7 [4] FF 10 89 87 [4] 5E 5F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VOBProtectCD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5F 81 EF [4] BE [2] 40 ?? 8B 87 [4] 03 C6 57 56 8C A7 [4] FF 10 89 87 [4] 5E 5F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: diProtectorV1XdiProtectorSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule diProtectorV1XdiProtectorSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 00 A0 E3 14 00 00 EB 00 00 20 E0 44 10 9F E5 03 2A A0 E3 40 30 A0 E3 AE 00 00 EB 30 00 8F E5 00 20 A0 E1 3A 0E 8F E2 00 00 80 E2 1C 10 9F E5 20 30 8F E2 0E 00 00 EB 14 00 9F E5 14 10 9F E5 7F 20 A0 E3 C5 00 00 EB 04 C0 8F E2 00 F0 9C E5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PrivateexeProtector20SetiSoftTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 [4] 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule PrivateexeProtector20SetiSoftTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 [4] 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: AHTeamEPProtector03fakekkryptor9kryptoraFEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 60 E8 [4] 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakekkryptor9kryptoraFEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 60 E8 [4] 5E B9 00 00 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEBundlev310
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD [4] 40 00 01 }

Detection condition:
$a0

Full rule:
rule PEBundlev310
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 00 87 DD [4] 40 00 01 }

condition:
		$a0
}
YARA Detection Rule: NsPack34NorthStar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [2] FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 [2] FF FF FF B5 [2] FF FF 8B D6 8B CF 8B 85 [2] FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPack34NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [2] FF FF 80 38 01 0F 84 42 02 00 00 C6 00 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 [2] FF FF FF B5 [2] FF FF 8B D6 8B CF 8B 85 [2] FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PellesC280290EXEX86CRTLIB
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 6A FF 68 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 [4] 59 A3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PellesC280290EXEX86CRTLIB
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 6A FF 68 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 [4] 59 A3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackV115V117Dllap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackV115V117Dllap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PellesC28x45xPelleOrinius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 6A FF 68 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 83 EC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PellesC28x45xPelleOrinius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 6A FF 68 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 83 EC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Thinstallv2460Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Thinstallv2460Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110Engdulekxt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
	$a1 = { E8 01 00 00 00 [2] E8 ?? 00 00 00 }
	$a2 = { EB 01 ?? EB 02 [3] 80 [2] 00 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point

Full rule:
rule FSGv110Engdulekxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 ?? BF ?? 10 40 ?? BE }
	$a1 = { E8 01 00 00 00 [2] E8 ?? 00 00 00 }
	$a2 = { EB 01 ?? EB 02 [3] 80 [2] 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}
YARA Detection Rule: PECompactv2xx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

Detection condition:
$a0

Full rule:
rule PECompactv2xx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

condition:
		$a0
}
YARA Detection Rule: ASPackv10802AlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv10802AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 0A 5D EB 02 FF 25 45 FF E5 E8 E9 E8 F1 FF FF FF E9 81 ED 23 6A 44 00 BB 10 ?? 44 00 03 DD 2B 9D 72 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillo440SiliconRealmsToolworks
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 }

Detection condition:
$a0

Full rule:
rule Armadillo440SiliconRealmsToolworks
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 2E 31 2E 34 00 00 00 C2 E0 94 BE 93 FC DE C6 B6 24 83 F7 D2 A4 92 77 40 27 CF EB D8 6F 50 B4 B5 29 24 FA 45 08 04 52 D5 1B D2 8C 8A 1E 6E FF 8C 5F 42 89 F1 83 B1 27 C5 69 57 FC 55 0A DD 44 BE 2A 02 97 6B 65 15 AA 31 E9 28 7D 49 1B DF B5 5D 08 A8 BA A8 }

condition:
		$a0
}
YARA Detection Rule: Armadillov1xxv2xx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov1xxv2xx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HACKSTOPv111c
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 30 CD 21 86 E0 3D [2] 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB [2] 5B EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HACKSTOPv111c
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 86 E0 3D [2] 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB [2] 5B EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEStealth276UnregisteredWebtoolMaster
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20 }

Detection condition:
$a0

Full rule:
rule EXEStealth276UnregisteredWebtoolMaster
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner02LCCWin32DLLAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02LCCWin32DLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CDSSSv10Beta1CyberDoomTeamX
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CDSSSv10Beta1CyberDoomTeamX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv041x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 [2] 59 EB 01 EB AC 54 E8 03 [3] 5C EB 08 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv041x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 [2] 59 EB 01 EB AC 54 E8 03 [3] 5C EB 08 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ZCodeWin32PEProtectorv101
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 12 00 00 00 [12] E9 FB FF FF FF C3 68 [4] 64 FF 35 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ZCodeWin32PEProtectorv101
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 12 00 00 00 [12] E9 FB FF FF FF C3 68 [4] 64 FF 35 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ABCCryptor10byZloY
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 [4] BF 00 [3] B9 00 [3] 80 37 ?? 47 39 CF 75 F8 [54] BF 00 [3] B9 00 [3] 80 37 ?? 47 39 CF 75 F8 }

Detection condition:
$a0

Full rule:
rule ABCCryptor10byZloY
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 FF 64 24 F0 68 58 58 58 58 90 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 [4] BF 00 [3] B9 00 [3] 80 37 ?? 47 39 CF 75 F8 [54] BF 00 [3] B9 00 [3] 80 37 ?? 47 39 CF 75 F8 }

condition:
		$a0
}
YARA Detection Rule: FSGv120EngdulekxtMicrosoftVisualC60
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv120EngdulekxtMicrosoftVisualC60
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 E0 06 EB 02 CD 20 EB 01 27 EB 01 24 BE 80 ?? 42 00 49 EB 01 99 8D 1D F4 00 00 00 EB 01 5C F7 D8 1B CA EB 01 31 8A 16 80 E9 41 EB 01 C2 C1 E0 0A EB 01 A1 81 EA A8 8C 18 A1 34 46 E8 01 00 00 00 62 59 32 D3 C1 C9 02 EB 01 68 80 F2 1A 0F BE C9 F7 D1 2A D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SLVc0deProtectorv061SLV
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 }
	$a1 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule SLVc0deProtectorv061SLV
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 }
	$a1 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD FF FF FF 38 E8 E3 FF FF FF 66 E8 0D 00 00 00 04 E8 E3 FF FF FF 70 E8 CB FF FF FF 69 E8 DD FF FF FF 58 E8 DD FF FF FF 69 E8 E3 FF FF FF 79 E8 BF FF FF FF 69 83 C4 40 E8 00 00 00 00 5D 81 ED 9D 11 40 00 8D 95 B4 11 40 00 E8 CB 2E 00 00 33 C0 F7 F0 69 8D B5 05 12 40 00 B9 5D 2E 00 00 8B FE AC }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: FSG131dulekxt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [3] 00 BF [3] 00 BB [3] 00 53 BB [3] 00 B2 80 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSG131dulekxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [3] 00 BF [3] 00 BB [3] 00 53 BB [3] 00 B2 80 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackV112V114aPlib043ap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF EB 0F FF [3] FF [3] D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }

Detection condition:
$a0

Full rule:
rule RLPackV112V114aPlib043ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF EB 0F FF [3] FF [3] D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }

condition:
		$a0
}
YARA Detection Rule: Crypter31SLESH
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }

Detection condition:
$a0

Full rule:
rule Crypter31SLESH
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 FF 64 24 F0 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner01VBOX43MTEAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01VBOX43MTEAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }

condition:
		$a0 at pe.entry_point
}