deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Packman0001bubba
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 [3] FF 8D [2] 01 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Packman0001bubba
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 [3] FF 8D [2] 01 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimplePackV11XV12XMethod1bagie
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD [4] 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SimplePackV11XV12XMethod1bagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD [4] 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEEncryptv40bJunkCode
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 66 [2] 00 66 83 ?? 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEEncryptv40bJunkCode
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 [2] 00 66 83 ?? 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEQuake006forgat
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 A5 00 00 00 2D [2] 00 00 00 00 00 00 00 00 00 3D [2] 00 2D [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A [2] 00 5B [2] 00 6E [2] 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 [2] 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule PEQuake006forgat
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 A5 00 00 00 2D [2] 00 00 00 00 00 00 00 00 00 3D [2] 00 2D [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A [2] 00 5B [2] 00 6E [2] 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 [2] 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: Kryptonv02
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Kryptonv02
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 0C 24 E9 0A 7C 01 ?? AD 42 40 BD BE 9D 7A 04 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakePELockNT204FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakePELockNT204FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressorPacK150XCGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC [4] 53 56 57 83 A5 [5] F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 [4] 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 [4] A3 [4] EB 04 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule eXPressorPacK150XCGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC [4] 53 56 57 83 A5 [5] F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 [4] 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 [4] A3 [4] EB 04 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: D1S1Gv11BetaScrambledEXED1N
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B }

Detection condition:
$a0

Full rule:
rule D1S1Gv11BetaScrambledEXED1N
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 C7 8D 51 6D 8B 12 03 D7 83 C1 71 8B 09 03 CF 2B CA 72 0A 41 87 D1 80 31 FF 41 4A 75 F9 89 45 F0 EB 71 8B }

condition:
		$a0
}
YARA Detection Rule: ReversingLabsProtector074betaAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 00 00 41 00 E8 01 00 00 00 C3 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ReversingLabsProtector074betaAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 00 41 00 E8 01 00 00 00 C3 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ACProtect109gRiscosoftwareInc
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ACProtect109gRiscosoftwareInc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NorthStarPEShrinker13Liuxingping
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NorthStarPEShrinker13Liuxingping
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressorV13CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule eXPressorV13CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeJoinerSmallbuild035GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FreeJoinerSmallbuild035GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 51 33 CB 86 C9 59 E8 9E FD FF FF 66 87 DB 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upack020betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upack020betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5E 89 F7 B9 [4] 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D [5] 8B 07 09 C0 74 3C 8B 5F 04 8D [6] 01 F3 50 83 C7 08 FF [5] 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF [5] 09 C0 74 07 89 03 83 C3 04 EB E1 FF [5] 8B AE [4] 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 [4] 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }

Detection condition:
$a0

Full rule:
rule UPX20030XMarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5E 89 F7 B9 [4] 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D [5] 8B 07 09 C0 74 3C 8B 5F 04 8D [6] 01 F3 50 83 C7 08 FF [5] 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF [5] 09 C0 74 07 89 03 83 C3 04 EB E1 FF [5] 8B AE [4] 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 [4] 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}
YARA Detection Rule: WinUpackv039finalByDwingc2005h1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WinUpackv039finalByDwingc2005h1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnnamedScrambler12Bp0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8 }

Detection condition:
$a0

Full rule:
rule UnnamedScrambler12Bp0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D8 53 56 57 33 C0 89 45 D8 89 45 DC 89 45 E0 89 45 E4 89 45 E8 B8 70 3A 40 00 E8 C4 EC FF FF 33 C0 55 68 5C 3F 40 00 64 FF 30 64 89 20 E8 C5 D7 FF FF E8 5C F5 FF FF B8 20 65 40 00 33 C9 BA 04 01 00 00 E8 D3 DB FF FF 68 04 01 00 00 68 20 65 40 00 6A 00 FF 15 10 55 40 00 BA 6C 3F 40 00 B8 14 55 40 00 E8 5A F4 FF FF 85 C0 0F 84 1B 04 00 00 BA 18 55 40 00 8B 0D 14 55 40 00 E8 16 D7 FF FF 8B 05 88 61 40 00 8B D0 B8 54 62 40 00 E8 D4 E3 FF FF B8 54 62 40 00 E8 F2 E2 FF FF 8B D0 B8 18 55 40 00 8B 0D 88 61 40 00 E8 E8 D6 FF FF FF 35 34 62 40 00 FF 35 30 62 40 00 FF 35 3C 62 40 00 FF 35 38 62 40 00 8D 55 E8 A1 88 61 40 00 E8 E3 F0 FF FF 8B 55 E8 }

condition:
		$a0
}
YARA Detection Rule: Upack010012betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upack010012betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEArmorV07Xhying
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED [4] 8D B5 [4] 55 56 81 C5 [4] 55 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEArmorV07Xhying
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED [4] 8D B5 [4] 55 56 81 C5 [4] 55 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: LauncherGeneratorv103
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }

Detection condition:
$a0

Full rule:
rule LauncherGeneratorv103
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }

condition:
		$a0
}
YARA Detection Rule: yodasProtector102103AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtector102103AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NakedPacker10byBigBoote
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 FC 0F B6 05 34 [3] 85 C0 75 31 B8 50 [3] 2B 05 04 [3] A3 30 [3] A1 00 [3] 03 05 30 [3] A3 38 [3] E8 9A 00 00 00 A3 50 [3] C6 05 34 [3] 01 83 3D 50 [3] 00 75 07 61 FF 25 38 [3] 61 FF 74 24 04 6A 00 FF 15 44 [3] 50 FF 15 40 [3] C3 FF 74 24 04 6A 00 FF 15 44 [3] 50 FF 15 48 [3] C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01 }

Detection condition:
$a0

Full rule:
rule NakedPacker10byBigBoote
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 FC 0F B6 05 34 [3] 85 C0 75 31 B8 50 [3] 2B 05 04 [3] A3 30 [3] A1 00 [3] 03 05 30 [3] A3 38 [3] E8 9A 00 00 00 A3 50 [3] C6 05 34 [3] 01 83 3D 50 [3] 00 75 07 61 FF 25 38 [3] 61 FF 74 24 04 6A 00 FF 15 44 [3] 50 FF 15 40 [3] C3 FF 74 24 04 6A 00 FF 15 44 [3] 50 FF 15 48 [3] C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01 }

condition:
		$a0
}
YARA Detection Rule: tElockv080
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 F9 11 00 00 C3 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv080
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 F9 11 00 00 C3 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01YodasProtector102Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 90 90 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01YodasProtector102Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 90 90 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VProtector11Xvcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VProtector11Xvcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMASM32
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMASM32
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Pohernah102byKas
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Pohernah102byKas
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED DE 26 40 00 8B BD 05 28 40 00 8B 8D 0D 28 40 00 B8 25 28 40 00 01 E8 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 09 28 40 00 31 C0 51 31 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 09 28 40 00 8B 85 11 28 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 89 CE E8 27 00 00 00 89 C1 5F B8 25 28 40 00 01 E8 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 01 28 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ActiveMARK5xTrymediaSystemsInc
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }

Detection condition:
$a0

Full rule:
rule ActiveMARK5xTrymediaSystemsInc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }

condition:
		$a0
}
YARA Detection Rule: RCryptorv20HideEPVaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RCryptorv20HideEPVaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 DC 20 ?? 00 F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov172v173
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 E8 C1 [2] 68 F4 86 [2] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov172v173
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E8 C1 [2] 68 F4 86 [2] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AsCryptv01SToRM2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 [3] 83 [4] 90 90 90 83 [2] E2 }

Detection condition:
$a0

Full rule:
rule AsCryptv01SToRM2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 [3] 83 [4] 90 90 90 83 [2] E2 }

condition:
		$a0
}
YARA Detection Rule: AsCryptv01SToRM3
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 [3] 83 [4] 90 90 90 51 [3] 01 00 00 00 83 [2] E2 }

Detection condition:
$a0

Full rule:
rule AsCryptv01SToRM3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 [3] 83 [4] 90 90 90 51 [3] 01 00 00 00 83 [2] E2 }

condition:
		$a0
}
YARA Detection Rule: ASProtectV2XDLLAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 03 00 00 00 E9 [2] 5D 45 55 C3 E8 01 00 00 00 EB 5D BB [4] 03 DD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectV2XDLLAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 [2] 5D 45 55 C3 E8 01 00 00 00 EB 5D BB [4] 03 DD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AsCryptv01SToRM4
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 [3] 83 [4] 90 90 90 E2 }

Detection condition:
$a0

Full rule:
rule AsCryptv01SToRM4
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 [3] 83 [4] 90 90 90 E2 }

condition:
		$a0
}