deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Themida10xx18xxnocompressionOreansTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA [4] 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 [4] FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 }
	$a1 = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA [4] 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 [4] FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA [4] 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA [4] 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }

Detection condition:
$a0 or $a1

Full rule:
rule Themida10xx18xxnocompressionOreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA [4] 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 [4] FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 }
	$a1 = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA [4] 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 [4] FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA [4] 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA [4] 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }

condition:
		$a0 or $a1
}
YARA Detection Rule: StonesPEEncryptorv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 57 56 52 51 53 E8 [4] 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule StonesPEEncryptorv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 [4] 5D 8B D5 81 ED 63 3A 40 ?? 2B 95 C2 3A 40 ?? 83 EA 0B 89 95 CB 3A 40 ?? 8D B5 CA 3A 40 ?? 0F B6 36 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PolyBoxDAnskya
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF }

Detection condition:
$a0

Full rule:
rule PolyBoxDAnskya
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF }

condition:
		$a0
}
YARA Detection Rule: Mew10execoder10NorthfoxHCC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 C0 E9 [2] FF FF 6A [5] 70 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Mew10execoder10NorthfoxHCC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 E9 [2] FF FF 6A [5] 70 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECrypt102
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECrypt102
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DIETv100d
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC 06 1E 0E 8C C8 01 [3] BA [2] 03 [14] 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DIETv100d
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 06 1E 0E 8C C8 01 [3] BA [2] 03 [14] 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackV119LZMA430ap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 [4] 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackV119LZMA430ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 [4] 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 [4] FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 [4] 61 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ENIGMAProtectorV112SukhovVladimir
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 83 C5 FA 81 ED [3] 00 [31] E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ENIGMAProtectorV112SukhovVladimir
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 C5 FA 81 ED [3] 00 [31] E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakeASPack212FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeASPack212FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MacromediaWindowsFlashProjectorPlayerv50
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MacromediaWindowsFlashProjectorPlayerv50
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: IDApplicationProtector12IDSecuritySuite
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule IDApplicationProtector12IDSecuritySuite
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F2 0B 47 00 B9 19 22 47 00 81 E9 EA 0E 47 00 89 EA 81 C2 EA 0E 47 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv305c4ExtractablePasswordchecking
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 05 80 1A B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv305c4ExtractablePasswordchecking
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 80 1A B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HASPHLProtectionV1XAladdin
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 56 57 60 8B C4 A3 [4] B8 [4] 2B 05 [4] A3 [4] 83 3D [4] 00 74 15 8B 0D [4] 51 FF 15 [4] 83 C4 04 E9 A5 00 00 00 68 [4] FF 15 [4] A3 [4] 68 [4] FF 15 }
	$a1 = { 55 8B EC 53 56 57 60 8B C4 A3 [4] B8 [4] 2B 05 [4] A3 [4] 83 3D [4] 00 74 15 8B 0D [4] 51 FF 15 [4] 83 C4 04 E9 A5 00 00 00 68 [4] FF 15 [4] A3 [4] 68 [4] FF 15 [4] A3 [4] 8B 15 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule HASPHLProtectionV1XAladdin
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 8B C4 A3 [4] B8 [4] 2B 05 [4] A3 [4] 83 3D [4] 00 74 15 8B 0D [4] 51 FF 15 [4] 83 C4 04 E9 A5 00 00 00 68 [4] FF 15 [4] A3 [4] 68 [4] FF 15 }
	$a1 = { 55 8B EC 53 56 57 60 8B C4 A3 [4] B8 [4] 2B 05 [4] A3 [4] 83 3D [4] 00 74 15 8B 0D [4] 51 FF 15 [4] 83 C4 04 E9 A5 00 00 00 68 [4] FF 15 [4] A3 [4] 68 [4] FF 15 [4] A3 [4] 8B 15 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: ASProtectv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 01 [3] 90 5D 81 ED [4] BB [4] 03 DD 2B 9D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 [3] 90 5D 81 ED [4] BB [4] 03 DD 2B 9D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectv11
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E9 ?? 04 [2] E9 [7] EE }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectv11
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 ?? 04 [2] E9 [7] EE }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov275a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 68 [3] 68 D0 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 28 [3] 33 D2 8A D4 89 15 24 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov275a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 68 [3] 68 D0 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 28 [3] 33 D2 8A D4 89 15 24 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner0132Lite003Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 [4] E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner0132Lite003Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 [4] E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxDoom666
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [3] 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B [2] 0E 1F 81 C6 [2] BF [2] B9 [2] FC F3 A4 06 1F 06 B8 [2] 50 CB B4 48 BB 2C 00 CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxDoom666
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [3] 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B [2] 0E 1F 81 C6 [2] BF [2] B9 [2] FC F3 A4 06 1F 06 B8 [2] 50 CB B4 48 BB 2C 00 CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxSpanz
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 5E 81 EE [2] 8D 94 [2] B4 1A CD 21 C7 84 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxSpanz
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 5E 81 EE [2] 8D 94 [2] B4 1A CD 21 C7 84 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: BeRoEXEPackerv100DLLLZBRSBeRoFarbrausch
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 7C 24 08 01 0F 85 [4] 60 BE [4] BF [4] FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 [4] 72 03 A4 EB F2 E8 [4] 8D 51 FF E8 [4] 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BeRoEXEPackerv100DLLLZBRSBeRoFarbrausch
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 [4] 60 BE [4] BF [4] FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 [4] 72 03 A4 EB F2 E8 [4] 8D 51 FF E8 [4] 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Pksmart10b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BA [2] 8C C8 8B C8 03 C2 81 [3] 51 B9 [2] 51 1E 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Pksmart10b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA [2] 8C C8 8B C8 03 C2 81 [3] 51 B9 [2] 51 1E 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PELockv106
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 [8] 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PELockv106
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 [8] 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: LaunchAnywherev4001
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule LaunchAnywherev4001
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 83 EC 48 55 B8 FF FF FF FF 50 50 68 E0 3E 42 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 C0 69 44 00 E8 E4 80 FF FF 59 E8 4E 29 00 00 E8 C9 0D 00 00 85 C0 75 08 6A FF E8 6E 2B 00 00 59 E8 A8 2C 00 00 E8 23 2E 00 00 FF 15 4C C2 44 00 89 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv033v034BetaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv033v034BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: GameGuardnProtect
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE [4] 31 FF 74 06 61 E9 4A 4D 50 30 8D BE [4] 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule GameGuardnProtect
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE [4] 31 FF 74 06 61 E9 4A 4D 50 30 8D BE [4] 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: yodasProtectorV1032AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtectorV1032AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: nBinderv40
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79 }

Detection condition:
$a0

Full rule:
rule nBinderv40
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5C 6E 62 34 5F 74 6D 70 5F 30 31 33 32 34 35 34 33 35 30 5C 00 00 00 00 00 00 00 00 00 E9 55 43 4C FF 01 1A 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79 }

condition:
		$a0
}
YARA Detection Rule: AnslymFUDCrypter
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AnslymFUDCrypter
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EPExEPackV10EliteCodingGroup
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 68 [4] B8 [4] FF 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EPExEPackV10EliteCodingGroup
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 [4] B8 [4] FF 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimplePack12build3009Method2bagie
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 [3] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule SimplePack12build3009Method2bagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 [3] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: WinZip32bitSFXv6xmodule
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FF 15 [3] 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 [4] FF 15 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WinZip32bitSFXv6xmodule
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 15 [3] 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 [4] FF 15 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxEinstein
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxEinstein
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }

condition:
		$a0 at pe.entry_point
}