deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FSGv110EngdulekxtMicrosoftVisualC60
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }
	$a1 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
	$a2 = { 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 [2] 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00 }
	$a3 = { C1 CE 10 C1 F6 0F 68 00 [2] 00 2B FA 5B 23 F9 8D 15 80 [2] 00 E8 01 00 00 00 B6 5E 0B }
	$a4 = { D1 E9 03 C0 68 80 [2] 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E }
	$a5 = { E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 [2] 00 EB 02 61 E9 68 F4 00 00 00 C1 C8 }
	$a6 = { EB 01 4D 83 F6 4C 68 80 [2] 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38 }
	$a7 = { EB 02 AB 35 EB 02 B5 C6 8D 05 80 [2] 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8 }
	$a8 = { EB 02 CD 20 ?? CF [2] 80 [2] 00 [

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point or $a5 at pe.entry_point or $a6 at pe.entry_point or $a7 at pe.entry_point or $a8 at pe.entry_point or $a9 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMicrosoftVisualC60
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }
	$a1 = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
	$a2 = { 91 EB 02 CD 20 BF 50 BC 04 6F 91 BE D0 [2] 6F EB 02 CD 20 2B F7 EB 02 F0 46 8D 1D F4 00 }
	$a3 = { C1 CE 10 C1 F6 0F 68 00 [2] 00 2B FA 5B 23 F9 8D 15 80 [2] 00 E8 01 00 00 00 B6 5E 0B }
	$a4 = { D1 E9 03 C0 68 80 [2] 00 EB 02 CD 20 5E 40 BB F4 00 00 00 33 CA 2B C7 0F B6 16 EB 01 3E }
	$a5 = { E8 01 00 00 00 0E 59 E8 01 00 00 00 58 58 BE 80 [2] 00 EB 02 61 E9 68 F4 00 00 00 C1 C8 }
	$a6 = { EB 01 4D 83 F6 4C 68 80 [2] 00 EB 02 CD 20 5B EB 01 23 68 48 1C 2B 3A E8 02 00 00 00 38 }
	$a7 = { EB 02 AB 35 EB 02 B5 C6 8D 05 80 [2] 00 C1 C2 11 BE F4 00 00 00 F7 DB F7 DB 0F BE 38 E8 }
	$a8 = { EB 02 CD 20 ?? CF [2] 80 [2] 00 [8] 00 }
	$a9 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF [2] BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point or $a5 at pe.entry_point or $a6 at pe.entry_point or $a7 at pe.entry_point or $a8 at pe.entry_point or $a9 at pe.entry_point
}
YARA Detection Rule: TPPpackclane
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule TPPpackclane
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 81 ED F5 8F 40 00 60 33 ?? E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMicrosoftVisualC6070
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 [2] 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 }
	$a1 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 [3] EB 02 CD 20 03 D3 8D 35 F4 00 }
	$a2 = { 87 FE E8 02 00 00 00 98 CC 5F BB 80 [2] 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 }
	$a3 = { F7 D8 40 49 EB 02 E0 0A 8D 35 80 [3] 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80 }
	$a4 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMicrosoftVisualC6070
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 [2] 00 EB 02 CD 20 03 D3 8D 35 F4 00 00 00 EB 01 35 EB 01 88 80 CA 7C 80 F3 74 8B 38 EB 02 AC BA 03 DB E8 01 00 00 00 A5 5B C1 C2 0B 81 C7 DA 10 0A 4E EB 01 08 2B D1 83 EF 14 EB 02 CD 20 33 D3 83 EF 27 }
	$a1 = { 0B D0 8B DA E8 02 00 00 00 40 A0 5A EB 01 9D B8 80 [3] EB 02 CD 20 03 D3 8D 35 F4 00 }
	$a2 = { 87 FE E8 02 00 00 00 98 CC 5F BB 80 [2] 00 EB 02 CD 20 68 F4 00 00 00 E8 01 00 00 00 E3 }
	$a3 = { F7 D8 40 49 EB 02 E0 0A 8D 35 80 [3] 0F B6 C2 EB 01 9C 8D 1D F4 00 00 00 EB 01 3C 80 }
	$a4 = { F7 DB 80 EA BF B9 2F 40 67 BA EB 01 01 68 AF ?? A7 BA 80 EA 9D 58 C1 C2 09 2B C1 8B D7 68 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point
}
YARA Detection Rule: Thinstall24x25xJititSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D [4] B9 [4] BA [4] BE [4] BF [4] BD [4] 03 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Thinstall24x25xJititSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D [4] B9 [4] BA [4] BE [4] BF [4] BD [4] 03 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: LocklessIntroPack
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2C E8 [4] 5D 8B C5 81 ED F6 73 [2] 2B 85 [4] 83 E8 06 89 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule LocklessIntroPack
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 [4] 5D 8B C5 81 ED F6 73 [2] 2B 85 [4] 83 E8 06 89 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03faketElock061FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03faketElock061FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 E9 00 00 00 00 60 E8 00 00 00 00 58 83 C0 08 F3 EB FF E0 83 C0 28 50 E8 00 00 00 00 5E B3 33 8D 46 0E 8D 76 31 28 18 F8 73 00 C3 8B FE B9 3C 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeStealth275aWebtoolMaster
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeStealth275aWebtoolMaster
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEArmor046Hying
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 AA 00 00 00 2D [2] 00 00 00 00 00 00 00 00 00 3D [2] 00 2D [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B [2] 00 5C [2] 00 6F [2] 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
	$a1 = { E8 AA 00 00 00 2D [3] 00 00 00 00 00 00 00 00 3D }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule PEArmor046Hying
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 AA 00 00 00 2D [2] 00 00 00 00 00 00 00 00 00 3D [2] 00 2D [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B [2] 00 5C [2] 00 6F [2] 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
	$a1 = { E8 AA 00 00 00 2D [3] 00 00 00 00 00 00 00 00 3D }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: eXPressorv13CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
	$a1 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 [4] 2B 05 [4] A3 [4] 83 3D [4] 00 74 13 A1 [4] 03 05 [4] 89 [2] E9 [2] 00 00 C7 05 }

Detection condition:
$a0 or $a1 at pe.entry_point

Full rule:
rule eXPressorv13CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
	$a1 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 [4] 2B 05 [4] A3 [4] 83 3D [4] 00 74 13 A1 [4] 03 05 [4] 89 [2] E9 [2] 00 00 C7 05 }

condition:
		$a0 or $a1 at pe.entry_point
}
YARA Detection Rule: Upackv032BetaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 88 01 [2] AD 50 [2] AD 91 F3 A5 }
	$a1 = { BE 88 01 [2] AD 50 ?? AD 91 ?? F3 A5 }

Detection condition:
$a0 or $a1

Full rule:
rule Upackv032BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 [2] AD 50 [2] AD 91 F3 A5 }
	$a1 = { BE 88 01 [2] AD 50 ?? AD 91 ?? F3 A5 }

condition:
		$a0 or $a1
}
YARA Detection Rule: MSLRHV031emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHV031emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv184
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv184
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCGuardforWin32v500SofProBlagojeCeklic
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 [3] 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCGuardforWin32v500SofProBlagojeCeklic
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 [3] 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WiseInstallerStub
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF }
	$a1 = { 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A [7] FF 15 [2] 40 00 [56] 80 ?? 20 }
	$a2 = { 55 8B EC 81 EC [2] 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2

Full rule:
rule WiseInstallerStub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF }
	$a1 = { 55 8B EC 81 EC ?? 04 00 00 53 56 57 6A [7] FF 15 [2] 40 00 [56] 80 ?? 20 }
	$a2 = { 55 8B EC 81 EC [2] 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2
}
YARA Detection Rule: AnskyaNTPackerGeneratorAnskya
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54 }

Detection condition:
$a0

Full rule:
rule AnskyaNTPackerGeneratorAnskya
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54 }

condition:
		$a0
}
YARA Detection Rule: ThinstallVirtualizationSuite30493080ThinstallCompany
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
	$a1 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule ThinstallVirtualizationSuite30493080ThinstallCompany
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
	$a1 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 2C 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: NsPack14byNorthStarLiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }

Detection condition:
$a0

Full rule:
rule NsPack14byNorthStarLiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }

condition:
		$a0
}
YARA Detection Rule: FSGv110EngbartxtWatcomCCEXE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 CD 20 03 ?? 8D ?? 80 [2] 00 [9] EB 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngbartxtWatcomCCEXE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 03 ?? 8D ?? 80 [2] 00 [9] EB 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AcidCrypt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 B9 [3] 00 BA [3] 00 BE [3] 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }
	$a1 = { BE [4] 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule AcidCrypt: Packer
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B9 [3] 00 BA [3] 00 BE [3] 00 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }
	$a1 = { BE [4] 02 38 40 4E 75 FA 8B C2 8A 18 32 DF C0 CB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: eXPressorv1451CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 [3] 05 00 [3] A3 08 [3] A1 08 [3] B9 81 [3] 2B 48 18 89 0D 0C [3] 83 3D 10 [3] 00 74 16 A1 08 [3] 8B 0D 0C [3] 03 48 14 }
	$a1 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 [3] 05 00 [3] A3 08 [3] A1 08 [3] B9 81 [3] 2B 48 18 89 0D 0C [3] 83 3D 10 [3] 00 74 16 A1 08 [3] 8B 0D 0C [3] 03 48 14 89 4D CC }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule eXPressorv1451CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 [3] 05 00 [3] A3 08 [3] A1 08 [3] B9 81 [3] 2B 48 18 89 0D 0C [3] 83 3D 10 [3] 00 74 16 A1 08 [3] 8B 0D 0C [3] 03 48 14 }
	$a1 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 [3] 05 00 [3] A3 08 [3] A1 08 [3] B9 81 [3] 2B 48 18 89 0D 0C [3] 83 3D 10 [3] 00 74 16 A1 08 [3] 8B 0D 0C [3] 03 48 14 89 4D CC }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: BeRoEXEPackerv100LZMABeRoFarbrausch
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 68 [4] 68 [4] 68 [4] E8 [4] BE [4] B9 04 00 00 00 8B F9 81 FE [4] 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BeRoEXEPackerv100LZMABeRoFarbrausch
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 [4] 68 [4] 68 [4] E8 [4] BE [4] B9 04 00 00 00 8B F9 81 FE [4] 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PackanoidArkanoid
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF 00 10 40 00 BE [3] 00 E8 9D 00 00 00 B8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PackanoidArkanoid
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 10 40 00 BE [3] 00 E8 9D 00 00 00 B8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DAEMONProtectv067
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DAEMONProtectv067
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 60 9C 8C C9 32 C9 E3 0C 52 0F 01 4C 24 FE 5A 83 C2 0C 8B 1A 9D 61 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EmbedPEV100V124cyclotron
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 [4] 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [12] 00 00 00 00 [12] 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule EmbedPEV100V124cyclotron
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 [4] 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [12] 00 00 00 00 [12] 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: VProtectorV10Avcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VProtectorV10Avcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 8A 8E 40 00 68 C6 8E 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EncryptPE[PII_REDACTED]005314WFS
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 7A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EncryptPE[PII_REDACTED]005314WFS
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 7A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02JDPack1xJDProtect09Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02JDPack1xJDProtect09Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EmbedPEV1Xcyclotron
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 50 60 68 [4] E8 [2] 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EmbedPEV1Xcyclotron
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 50 60 68 [4] E8 [2] 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EncryptPEV220070411WFS
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EncryptPEV220070411WFS
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0 at pe.entry_point
}