deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Upackv037betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 }
	$a1 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 [2] 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE [3] 14 00 00 00 00 [6] 00 FF 76 38 AD 50 8B 3E BE F0 [3] 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 [5] 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 [4] E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Upackv037betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 }
	$a1 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 [2] 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE [3] 14 00 00 00 00 [6] 00 FF 76 38 AD 50 8B 3E BE F0 [3] 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 [5] 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 [4] E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PrivateExeProtector1xsetisoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 [3] C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PrivateExeProtector1xsetisoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] B9 ?? 90 01 ?? BE ?? 10 40 ?? 68 50 91 41 ?? 68 01 [3] C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Petitev14
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 66 9C 60 50 8B D8 03 00 68 [4] 6A 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Petitev14
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 66 9C 60 50 8B D8 03 00 68 [4] 6A 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NullsoftInstallSystemv20a0
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 }

Detection condition:
$a0

Full rule:
rule NullsoftInstallSystemv20a0
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 56 57 FF 15 B4 10 40 00 05 E8 03 00 00 BE E0 E3 41 00 89 44 24 10 B3 20 FF 15 28 10 40 00 68 00 04 00 00 FF 15 14 11 40 00 50 56 FF 15 10 11 40 00 80 3D E0 E3 41 00 22 75 08 80 C3 02 BE E1 E3 41 00 8A 06 8B 3D 14 12 40 00 84 C0 74 19 3A C3 74 }

condition:
		$a0
}
YARA Detection Rule: Obsidium1332ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 ?? E8 2B 00 00 00 EB 02 [2] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 24 EB 04 [4] 33 C0 EB 04 [4] C3 EB 02 [2] EB 01 ?? 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 01 ?? EB 02 [2] 50 EB 02 [2] 33 C0 EB 02 [2] 8B 00 EB 02 [2] C3 EB 04 [4] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 03 [3] EB 01 ?? 58 EB 01 ?? EB 02 [2] 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 02 [2] E8 3B 27 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1332ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 2B 00 00 00 EB 02 [2] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 24 EB 04 [4] 33 C0 EB 04 [4] C3 EB 02 [2] EB 01 ?? 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 01 ?? EB 02 [2] 50 EB 02 [2] 33 C0 EB 02 [2] 8B 00 EB 02 [2] C3 EB 04 [4] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 03 [3] EB 01 ?? 58 EB 01 ?? EB 02 [2] 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 02 [2] E8 3B 27 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: modifiedHACKSTOPv111f
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 52 B4 30 CD 21 52 FA ?? FB 3D [2] EB ?? CD 20 0E 1F B4 09 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule modifiedHACKSTOPv111f
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 B4 30 CD 21 52 FA ?? FB 3D [2] EB ?? CD 20 0E 1F B4 09 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxKuku886
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 [5] 90 B4 2F CD 21 53 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxKuku886
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 [5] 90 B4 2F CD 21 53 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxCIHVersion12TTITWIN95CIH
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8D [3] 33 DB 64 87 03 E8 [4] 5B 8D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxCIHVersion12TTITWIN95CIH
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8D [3] 33 DB 64 87 03 E8 [4] 5B 8D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ShegerdDongleV478MSCo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 32 00 00 00 B8 [4] 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ShegerdDongleV478MSCo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 32 00 00 00 B8 [4] 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SDProtectRandyLi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [4] 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SDProtectRandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SmokesCryptv12
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 B8 [4] B8 [4] 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SmokesCryptv12
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 [4] B8 [4] 8A 14 08 80 F2 ?? 88 14 08 41 83 F9 ?? 75 F1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEncryptv31
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [3] 00 F0 0F C6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEncryptv31
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [3] 00 F0 0F C6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEncryptv30
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB [4] AD 33 C3 E2 FA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEncryptv30
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 8D B5 24 10 40 00 8B FE B9 0F 00 00 00 BB [4] AD 33 C3 E2 FA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RJoiner12byVaska[PII_REDACTED]58
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RJoiner12byVaska[PII_REDACTED]58
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Minke101byCodius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 [5] 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF [4] C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Minke101byCodius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 [5] 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF [4] C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrypWrapvxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 B8 [3] E8 90 02 [2] 83 F8 ?? 75 07 6A ?? E8 [4] FF 15 49 8F 40 ?? A9 [3] 80 74 0E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrypWrapvxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 B8 [3] E8 90 02 [2] 83 F8 ?? 75 07 6A ?? E8 [4] FF 15 49 8F 40 ?? A9 [3] 80 74 0E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WarningmaybeSimbyOZpolycryptorby3xpl01tver2xx[PII_REDACTED]00
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WarningmaybeSimbyOZpolycryptorby3xpl01tver2xx[PII_REDACTED]00
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WARNINGTROJANHuiGeZi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WARNINGTROJANHuiGeZi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 C4 ?? FE FF FF 53 56 57 33 C0 89 85 ?? FE FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakeyodascryptor12emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeyodascryptor12emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EPv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C [4] C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EPv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC 86 C4 AC AA 86 C4 AA E2 F6 00 B8 40 00 03 00 3C 40 D2 33 8B 66 14 50 70 8B 8D 34 02 44 8B 18 10 48 70 03 BA 0C [4] C0 33 FE 8B 30 AC 30 D0 C1 F0 10 C2 D0 30 F0 30 C2 C1 AA 10 42 42 CA C1 E2 04 5F E9 5E B1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: D1S1Gv11betaD1N
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 [4] 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 [4] 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 [4] 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 [4] 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 [2] 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 [4] 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 }

Detection condition:
$a0

Full rule:
rule D1S1Gv11betaD1N
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 [4] 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 [4] 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 [4] 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 [4] 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 [2] 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 [4] 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: PROPACKv208
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8C D3 8E C3 8C CA 8E DA 8B 0E [2] 8B F1 83 [2] 8B FE D1 ?? FD F3 A5 53 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PROPACKv208
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C D3 8E C3 8C CA 8E DA 8B 0E [2] 8B F1 83 [2] 8B FE D1 ?? FD F3 A5 53 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: BlackEnergyDDoSBotCrypter
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 [2] 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 [2] 83 C4 10 ?? FF 89 7D F4 0F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BlackEnergyDDoSBotCrypter
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 [2] 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 [2] 83 C4 10 ?? FF 89 7D F4 0F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HACKSTOPv113
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 52 B8 [2] 1E CD 21 86 E0 3D [2] 73 ?? CD 20 0E 1F B4 09 E8 [2] 24 ?? EA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HACKSTOPv113
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 B8 [2] 1E CD 21 86 E0 3D [2] 73 ?? CD 20 0E 1F B4 09 E8 [2] 24 ?? EA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeJoiner151GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FreeJoiner151GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PeXv099EngbartCrackPl
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PeXv099EngbartCrackPl
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HACKSTOPv119
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 52 BA [2] 5A EB ?? 9A [4] 30 CD 21 [3] D6 02 [2] CD 20 0E 1F 52 BA [2] 5A EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HACKSTOPv119
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 BA [2] 5A EB ?? 9A [4] 30 CD 21 [3] D6 02 [2] CD 20 0E 1F 52 BA [2] 5A EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HACKSTOPv118
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 52 BA [2] 5A EB ?? 9A [4] 30 CD 21 [3] FD 02 [2] CD 20 0E 1F 52 BA [2] 5A EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HACKSTOPv118
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 BA [2] 5A EB ?? 9A [4] 30 CD 21 [3] FD 02 [2] CD 20 0E 1F 52 BA [2] 5A EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv200b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 B8 [2] BA [2] 05 [2] 3B 06 02 00 72 ?? B4 09 BA [2] CD 21 B8 01 4C CD 21 [30] 59 2D [2] 8E D0 51 2D [2] 8E C0 50 B9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv200b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 [2] BA [2] 05 [2] 3B 06 02 00 72 ?? B4 09 BA [2] CD 21 B8 01 4C CD 21 [30] 59 2D [2] 8E D0 51 2D [2] 8E C0 50 B9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv200c
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 B8 [2] BA [2] 3B C4 73 ?? 8B C4 2D [2] 25 [2] 8B F8 B9 [2] BE [2] FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv200c
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 [2] BA [2] 3B C4 73 ?? 8B C4 2D [2] 25 [2] 8B F8 B9 [2] BE [2] FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakeNeolite20emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeNeolite20emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 39 39 39 20 4E 65 6F 57 6F 72 78 20 49 6E 63 0D 0A 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 37 2D 31 39 39 39 20 4C 65 65 20 48 61 73 69 75 6B 0D 0A 41 6C 6C 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 00 00 00 00 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv300v301Relocationspack
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [2] BA [2] BF [2] B9 [2] 8C CD 8E DD 81 ED [2] 06 06 8B DD 2B DA 8B D3 FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv300v301Relocationspack
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [2] BA [2] BF [2] B9 [2] 8C CD 8E DD 81 ED [2] 06 06 8B DD 2B DA 8B D3 FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02CodeSafe20Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02CodeSafe20Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02ZCode101Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02ZCode101Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxCaz1204
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxCaz1204
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }

condition:
		$a0 at pe.entry_point
}