deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PEcryptbyarchphase
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC [4] 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 [4] 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 [4] E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 [4] 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 [5] 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D [4] E8 A5 A3 FF FF 8B 45 E8 8D 55

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEcryptbyarchphase
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC [4] 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 [4] 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 [4] E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 [4] 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 [5] 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D [4] E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrunchPEv30xx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 10 [16] 55 E8 [4] 5D 81 ED 18 [3] 8B C5 55 60 9C 2B 85 [4] 89 85 [4] FF 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrunchPEv30xx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 [16] 55 E8 [4] 5D 81 ED 18 [3] 8B C5 55 60 9C 2B 85 [4] 89 85 [4] FF 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: LameCryptLaZaRus
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 66 9C BB 00 [2] 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 [2] 40 00 FF E0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule LameCryptLaZaRus
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 66 9C BB 00 [2] 00 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 B8 [2] 40 00 FF E0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPack29NorthStar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8A 06 3C 00 74 12 8B F5 8D B5 [2] FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPack29NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8A 06 3C 00 74 12 8B F5 8D B5 [2] FF FF 8A 06 3C 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: BeRoEXEPackerv100LZBRSBeRoFarbrausch
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BE [4] BF [4] FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 [4] 72 03 A4 EB F2 E8 [4] 8D 51 FF E8 [4] 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BeRoEXEPackerv100LZBRSBeRoFarbrausch
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] BF [4] FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 [4] 72 03 A4 EB F2 E8 [4] 8D 51 FF E8 [4] 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtBorlandC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 [2] 00 0F B6 C9 EB 02 CD 20 BB }
	$a1 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 [2] 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtBorlandC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 [2] 00 0F B6 C9 EB 02 CD 20 BB }
	$a1 = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 [2] 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: VIRUSIWormKLEZ
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0 }

Detection condition:
$a0

Full rule:
rule VIRUSIWormKLEZ
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 D2 40 ?? 68 04 AC 40 ?? 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 BC D0 }

condition:
		$a0
}
YARA Detection Rule: YZPack12UsAr
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule YZPack12UsAr
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02LocklessIntroPackAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02LocklessIntroPackAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITE3211
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITE3211
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv20bartxt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 87 25 [3] 00 61 94 55 A4 B6 80 FF 13 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv20bartxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 87 25 [3] 00 61 94 55 A4 B6 80 FF 13 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakeSVKP111emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeSVKP111emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMASM32TASM32MicrosoftVisualBasic
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F7 D8 0F BE C2 BE 80 [2] 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMASM32TASM32MicrosoftVisualBasic
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D8 0F BE C2 BE 80 [2] 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor239DLLminimumprotection
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 51 68 [4] 87 2C 24 8B CD 5D 81 E1 [4] E9 [3] 00 89 45 F8 51 68 [4] 59 81 F1 [4] 0B 0D [4] 81 E9 [4] E9 [3] 00 81 C2 [4] E8 [3] 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 [3] 00 F7 D6 2B D5 E9 [3] 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 [3] 00 83 C4 08 68 [4] E9 [3] 00 C3 E9 [3] 00 E9 [3] 00 50 8B C5 87 04 24 8B EC 51 0F 88 [3] 00 FF 05 [4] E9 [3] 00 87 0C 24 59 99 03 04 24 E9 [3] 00 C3 81 D5 [4] 9C E9 [3] 00 81 FA [4] E9 [3] 00 C1 C3 15 81 CB [4] 81 F3 [4] 81 C3 [4] 87 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptor239DLLminimumprotection
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 51 68 [4] 87 2C 24 8B CD 5D 81 E1 [4] E9 [3] 00 89 45 F8 51 68 [4] 59 81 F1 [4] 0B 0D [4] 81 E9 [4] E9 [3] 00 81 C2 [4] E8 [3] 00 87 0C 24 59 51 64 8B 05 30 00 00 00 8B 40 0C 8B 40 0C E9 [3] 00 F7 D6 2B D5 E9 [3] 00 87 3C 24 8B CF 5F 87 14 24 1B CA E9 [3] 00 83 C4 08 68 [4] E9 [3] 00 C3 E9 [3] 00 E9 [3] 00 50 8B C5 87 04 24 8B EC 51 0F 88 [3] 00 FF 05 [4] E9 [3] 00 87 0C 24 59 99 03 04 24 E9 [3] 00 C3 81 D5 [4] 9C E9 [3] 00 81 FA [4] E9 [3] 00 C1 C3 15 81 CB [4] 81 F3 [4] 81 C3 [4] 87 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Frusionbiff
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Frusionbiff
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 55 56 57 68 04 01 00 00 C7 44 24 14 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: OpenSourceCodeCrypterp0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00 }

Detection condition:
$a0

Full rule:
rule OpenSourceCodeCrypterp0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 34 44 40 00 E8 28 F8 FF FF 33 C0 55 68 9F 47 40 00 64 FF 30 64 89 20 BA B0 47 40 00 B8 1C 67 40 00 E8 07 FD FF FF 8B D8 85 DB 75 07 6A 00 E8 C2 F8 FF FF BA 28 67 40 00 8B C3 8B 0D 1C 67 40 00 E8 F0 E0 FF FF BE 01 00 00 00 B8 2C 68 40 00 E8 E1 F0 FF FF BF 0A 00 00 00 8D 55 EC 8B C6 E8 92 FC FF FF 8B 4D EC B8 2C 68 40 00 BA BC 47 40 00 E8 54 F2 FF FF A1 2C 68 40 00 E8 52 F3 FF FF 8B D0 B8 20 67 40 00 E8 A2 FC FF FF 8B D8 85 DB 0F 84 52 02 00 00 B8 24 67 40 00 8B 15 20 67 40 00 E8 78 F4 FF FF B8 24 67 40 00 E8 7A F3 FF FF 8B D0 8B C3 8B 0D 20 67 40 00 E8 77 E0 FF FF 8D 55 E8 A1 24 67 40 00 E8 42 FD FF FF 8B 55 E8 B8 24 67 40 00 }

condition:
		$a0
}
YARA Detection Rule: QrYPt0rbyNuTraL
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 F9 00 0F 84 8D 01 00 00 8A C3 [50] 32 C1 3C F3 75 89 [50] BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01 }
	$a1 = { 86 18 CC 64 FF 35 00 00 00 00 [50] 64 89 25 00 00 00 00 BB 00 00 F7 BF [50] B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3 }
	$a2 = { EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 [50] 64 89 25 00 00 00 00 8B 44 24 04 }

Detection condition:
$a0 or $a1 or $a2 at pe.entry_point

Full rule:
rule QrYPt0rbyNuTraL
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 F9 00 0F 84 8D 01 00 00 8A C3 [50] 32 C1 3C F3 75 89 [50] BA D9 04 00 00 E8 00 00 00 00 5F 81 C7 16 01 00 00 80 2C 3A 01 }
	$a1 = { 86 18 CC 64 FF 35 00 00 00 00 [50] 64 89 25 00 00 00 00 BB 00 00 F7 BF [50] B8 78 56 34 12 87 03 E8 CD FE FF FF E8 B3 }
	$a2 = { EB 00 E8 B5 00 00 00 E9 2E 01 00 00 64 FF 35 00 00 00 00 [50] 64 89 25 00 00 00 00 8B 44 24 04 }

condition:
		$a0 or $a1 or $a2 at pe.entry_point
}
YARA Detection Rule: EXECryptor2xxmaxcompressedresources
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }

Detection condition:
$a0

Full rule:
rule EXECryptor2xxmaxcompressedresources
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }

condition:
		$a0
}
YARA Detection Rule: Upackv024v028AlphaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 88 01 40 00 AD [2] 95 AD 91 F3 A5 AD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv024v028AlphaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 40 00 AD [2] 95 AD 91 F3 A5 AD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThinstallEmbedded24222428Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 [4] 81 75 04 [4] 81 75 08 [4] 81 75 0C [4] 81 75 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded24222428Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 [4] 81 75 04 [4] 81 75 08 [4] 81 75 0C [4] 81 75 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SVKProtectorv1051
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SVKProtectorv1051
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 EB 03 C7 84 E8 EB 03 C7 84 9A E8 00 00 00 00 5D 81 ED 10 00 00 00 EB 03 C7 84 E9 64 A0 23 00 00 00 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakeZCode101FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeZCode101FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEPacker
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEPacker
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 8B 35 70 01 40 ?? 83 EE 40 6A 40 68 ?? 30 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ProgramProtectorXPv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] 58 83 D8 05 89 C3 81 C3 [4] 8B 43 64 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ProgramProtectorXPv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 58 83 D8 05 89 C3 81 C3 [4] 8B 43 64 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimplePack111Method2NTbagieTMX
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SimplePack111Method2NTbagieTMX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032aemadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 }
	$a1 = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
	$a2 = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 0

Detection condition:
$a0 or $a1 or $a2 at pe.entry_point

Full rule:
rule MSLRHv032aemadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 }
	$a1 = { EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 }
	$a2 = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 3D FF FF FF 00 EB 01 68 EB 02 CD 20 EB 01 E8 76 1B EB 01 68 EB 02 CD 20 EB 01 E8 CC 66 B8 FE 00 74 04 75 02 EB 02 EB 01 81 66 E7 64 74 04 75 02 EB 02 EB 01 81 E8 0A 00 00 00 E8 EB 0C }

condition:
		$a0 or $a1 or $a2 at pe.entry_point
}
YARA Detection Rule: VxHafen1641
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 01 [3] CE CC 25 [2] 25 [2] 25 [2] 40 51 D4 [3] CC 47 CA [2] 46 8A CC 44 88 CC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxHafen1641
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 01 [3] CE CC 25 [2] 25 [2] 25 [2] 40 51 D4 [3] CC 47 CA [2] 46 8A CC 44 88 CC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NativeUDPacker11ModdedPoisonIvyShellcodeokkixot
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NativeUDPacker11ModdedPoisonIvyShellcodeokkixot
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40 }

condition:
		$a0 at pe.entry_point
}