deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RODHighTECHAyman
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RODHighTECHAyman
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B 15 1D 13 40 00 F7 E0 8D 82 83 19 00 00 E8 58 0C 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ICrypt10byBuGGz
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 [4] 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ICrypt10byBuGGz
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B D8 53 E8 D4 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 64 56 00 10 E8 25 F6 FF FF B8 64 56 00 10 E8 13 F6 FF FF 8B CF 8B D6 E8 E6 FA FF FF 53 E8 90 FA FF FF 8D 4D EC BA 8C 3C 00 10 A1 64 56 00 10 E8 16 FB FF FF 8B 55 EC B8 64 56 00 10 E8 C5 F4 FF FF B8 64 56 00 10 E8 DB F5 FF FF E8 56 FC FF FF 33 C0 5A 59 59 64 89 10 68 73 3C 00 10 8D 45 EC E8 4D F4 FF FF C3 E9 E3 EE FF FF EB F0 5F 5E 5B E8 4D F3 FF FF 00 53 45 54 [4] 00 FF FF FF FF 08 00 00 00 76 6F 74 72 65 63 6C 65 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEPackv099
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 83 ED 06 80 BD E0 04 [2] 01 0F 84 F2 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEPackv099
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 83 ED 06 80 BD E0 04 [2] 01 0F 84 F2 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackV115V117LZMA430ap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 83 01 00 00 6A ?? 68 [4] 68 [4] 6A ?? FF 95 [4] 89 85 [4] EB 14 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackV115V117LZMA430ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 83 01 00 00 6A ?? 68 [4] 68 [4] 6A ?? FF 95 [4] 89 85 [4] EB 14 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxQuake518
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E 06 8C C8 8E D8 [7] B8 21 35 CD 21 81 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxQuake518
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C8 8E D8 [7] B8 21 35 CD 21 81 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv305c4UnextractableVirusShield
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 05 40 1B B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv305c4UnextractableVirusShield
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 40 1B B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium13013ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 ?? E8 26 00 00 00 EB 02 [2] EB 02 [2] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 [4] 33 C0 EB 02 [2] C3 EB 01 ?? EB 04 [4] 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 01 ?? 33 C0 EB 03 [3] 8B 00 EB 02 [2] C3 EB 02 [2] E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 [3] EB 02 [2] 58 EB 03 [3] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 03 [3] E8 13 26 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium13013ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 26 00 00 00 EB 02 [2] EB 02 [2] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 21 EB 04 [4] 33 C0 EB 02 [2] C3 EB 01 ?? EB 04 [4] 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 01 ?? 33 C0 EB 03 [3] 8B 00 EB 02 [2] C3 EB 02 [2] E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 03 [3] EB 02 [2] 58 EB 03 [3] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 03 [3] E8 13 26 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ObsidiumV130XObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 03 [3] E8 2E 00 00 00 EB 04 [4] EB 04 [4] 8B [3] EB 04 [4] 83 [6] EB 01 ?? 33 C0 EB 04 [4] C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV130XObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 [3] E8 2E 00 00 00 EB 04 [4] EB 04 [4] 8B [3] EB 04 [4] 83 [6] EB 01 ?? 33 C0 EB 04 [4] C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MetrowerksCodeWarriorv20Console
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 [4] 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 [4] E8 [12] E8 [2] 00 00 E8 [2] 00 00 E8 }

Detection condition:
$a0

Full rule:
rule MetrowerksCodeWarriorv20Console
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 [4] 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 [4] E8 [12] E8 [2] 00 00 E8 [2] 00 00 E8 }

condition:
		$a0
}
YARA Detection Rule: PESpinv07Cyberbob
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESpinv07Cyberbob
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimpleUPXCryptorV3042005MANtiCORE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 B8 [4] B9 [8] E2 FA 61 68 [4] C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SimpleUPXCryptorV3042005MANtiCORE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 [4] B9 [8] E2 FA 61 68 [4] C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WinRAR32bitSFXModule
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [2] 00 00 00 00 00 00 90 90 90 [6] 00 ?? 00 [5] FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WinRAR32bitSFXModule
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [2] 00 00 00 00 00 00 90 90 90 [6] 00 ?? 00 [5] FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: iPBProtect013017forgot
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule iPBProtect013017forgot
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakeASPack211demadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeASPack211demadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv036alphaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }

Detection condition:
$a0

Full rule:
rule Upackv036alphaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }

condition:
		$a0
}
YARA Detection Rule: CrinklerV03V04RuneLHStubbeandAskeSimonChristensen
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 00 00 42 00 31 DB 43 EB 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrinklerV03V04RuneLHStubbeandAskeSimonChristensen
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 42 00 31 DB 43 EB 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DingBoysPElockPhantasmv10v11
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DingBoysPElockPhantasmv10v11
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactV2XBitsumTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactV2XBitsumTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CRYPTVersion17cDismember
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0E 17 9C 58 F6 [2] 74 ?? E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CRYPTVersion17cDismember
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 17 9C 58 F6 [2] 74 ?? E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxXPEH4768
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5B 81 [3] 50 56 57 2E [5] 2E [6] B8 01 00 50 B8 [2] 50 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxXPEH4768
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5B 81 [3] 50 56 57 2E [5] 2E [6] B8 01 00 50 B8 [2] 50 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECrypt32v102
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5B 83 [2] EB ?? 52 4E 44 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECrypt32v102
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 83 [2] EB ?? 52 4E 44 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01PESHiELD025Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PESHiELD025Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NETDLLMicrosoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25 }

Detection condition:
$a0

Full rule:
rule NETDLLMicrosoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 44 6C 6C 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 ?? 00 00 FF 25 }

condition:
		$a0
}
YARA Detection Rule: MSLRH
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 }
        $b = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MSLRH: Packer PEiD
{
      meta:
		author="malware-lu"
        note="Added some checks"
strings:
		$a0 = { 60 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 }
        $b = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF 0F 00 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD
YARA Detection Rule: BeRoEXEPackerv100DLLLZMABeRoFarbrausch
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 7C 24 08 01 0F 85 [4] 60 68 [4] 68 [4] 68 [4] E8 [4] BE [4] B9 [4] 8B F9 81 FE [4] 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BeRoEXEPackerv100DLLLZMABeRoFarbrausch
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 [4] 60 68 [4] 68 [4] 68 [4] E8 [4] BE [4] B9 [4] 8B F9 81 FE [4] 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02ExeSmasherAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02ExeSmasherAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ObsidiumV125ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV125ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv107bDLLAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D [6] B8 [4] 03 C5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv107bDLLAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D [6] B8 [4] 03 C5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MicroJoiner17coban2k
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MicroJoiner17coban2k
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakeVOBProtectCDFEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeVOBProtectCDFEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 5F 81 EF 00 00 00 00 BE 00 00 40 00 8B 87 00 00 00 00 03 C6 57 56 8C A7 00 00 00 00 FF 10 89 87 00 00 00 00 5E 5F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CelsiusCrypt21Z3r0
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule CelsiusCrypt21Z3r0
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 84 92 44 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 84 92 44 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D C4 92 44 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D AC 92 44 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 77 C2 00 00 90 90 90 90 90 90 90 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3 }
	$a1 = { 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 1C 1A 01 00 89 C1 8B 45 08 8B 55 E8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 8D 45 E8 FF 00 EB BF 83 7D F0 00 74 34 80 7D EF 00 74 2E 8B 45 F0 89 44 24 04 8B 45 10 89 04 24 E8 DD 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 0F 94 C0 88 45 EF 8D 45 F0 FF 08 EB C6 C7 44 24 04 00 00 00 00 8B 45 10 89 04 24 E8 AE 19 01 00 89 C1 8B 45 08 8B 55 F8 01 C2 0F B6 01 3A 02 7F 0C 0F B6 45 EF 83 E0 01 88 45 E7 EB 04 C6 45 E7 00 0F B6 45 E7 88 45 EF 0F B6 45 EF C9 C3 }

condition:
		$a0 at pe.entry_point
YARA Detection Rule: Armadillov260
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 D0 [3] 68 34 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 68 [3] 33 D2 8A D4 89 15 84 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov260
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 D0 [3] 68 34 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 68 [3] 33 D2 8A D4 89 15 84 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov261
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 28 [3] 68 E4 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 6C [3] 33 D2 8A D4 89 15 0C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov261
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 28 [3] 68 E4 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 6C [3] 33 D2 8A D4 89 15 0C }

condition:
		$a0 at pe.entry_point
}