deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PEncrypt20junkcode
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEncrypt20junkcode
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 25 00 00 F7 BF 00 00 00 00 00 00 00 00 00 00 12 00 E8 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 00 00 E8 00 00 00 00 5D 81 ED 2C 10 40 00 8D B5 14 10 40 00 E8 33 00 00 00 89 85 10 10 40 00 BF 00 00 40 00 8B F7 03 7F 3C 8B 4F 54 51 56 8D 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimbiOZExtranger
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SimbiOZExtranger
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 60 E8 00 00 00 00 5D 81 ED 07 10 40 00 68 80 0B 00 00 8D 85 1F 10 40 00 50 E8 84 0B 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: InnoSetupModulev304betav306v307
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }

Detection condition:
$a0

Full rule:
rule InnoSetupModulev304betav306v307
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }

condition:
		$a0
}
YARA Detection Rule: ASPackv107bAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED [4] B8 [4] 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE [2] 80 BD 01 DE }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv107bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED [4] B8 [4] 03 C5 2B 85 ?? 0B DE ?? 89 85 17 DE [2] 80 BD 01 DE }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PROPACKv208emphasisonpackedsizelocked
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC ?? 8B EC BE [2] FC E8 [2] 05 [2] 8B C8 E8 [2] 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PROPACKv208emphasisonpackedsizelocked
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC ?? 8B EC BE [2] FC E8 [2] 05 [2] 8B C8 E8 [2] 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HACKSTOPv110p1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 [2] 58 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HACKSTOPv110p1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 86 E0 3D 00 03 73 ?? B4 2F CD 21 B4 2A CD 21 B4 2C CD 21 B0 FF B4 4C CD 21 50 B8 [2] 58 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AdysGlue110
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2E [4] 0E 1F BF [2] 33 DB 33 C0 AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AdysGlue110
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E [4] 0E 1F BF [2] 33 DB 33 C0 AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxEddiebased1745
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 81 EE [2] FC ?? 2E [4] 4D 5A [2] FA ?? 8B E6 81 [3] FB ?? 3B [5] 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxEddiebased1745
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 81 EE [2] FC ?? 2E [4] 4D 5A [2] FA ?? 8B E6 81 [3] FB ?? 3B [5] 50 06 ?? 56 1E 8B FE 33 C0 ?? 50 8E D8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASDPackv10asd
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 [3] 00 00 00 00 00 00 00 40 00 00 [2] 00 00 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 00 [2] 00 00 10 00 00 00 ?? 00 00 00 [2] 00 00 [2] 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

Detection condition:
$a0

Full rule:
rule ASDPackv10asd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 53 E8 5C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 [3] 00 00 00 00 00 00 00 40 00 00 [2] 00 00 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 00 [2] 00 00 10 00 00 00 ?? 00 00 00 [2] 00 00 [2] 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 ?? 00 00 00 [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5B 81 EB E6 1D 40 00 83 7D 0C 01 75 11 55 E8 4F 01 00 00 E8 6A 01 00 00 5D E8 2C 00 00 00 8B B3 1A 1E 40 00 03 B3 FA 1D 40 00 8B 76 0C AD 0B C0 74 0D FF 75 10 FF 75 0C FF 75 08 FF D0 EB EE B8 01 00 00 00 5B 5E C9 C2 0C 00 55 6A 00 FF 93 20 21 40 00 89 83 FA 1D 40 00 6A 40 68 00 10 00 00 FF B3 02 1E 40 00 6A 00 FF 93 2C 21 40 00 89 83 06 1E 40 00 8B 83 F2 1D 40 00 03 83 FA 1D 40 00 50 FF B3 06 1E 40 00 50 E8 6D 01 00 00 5F }

condition:
		$a0
}
YARA Detection Rule: ORiENV1XV2XFisunAV
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D }

Detection condition:
$a0

Full rule:
rule ORiENV1XV2XFisunAV
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D }

condition:
		$a0
}
YARA Detection Rule: StonesPEEncryptorv113
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 57 56 52 51 53 E8 [4] 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule StonesPEEncryptorv113
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 [4] 5D 8B D5 81 ED 97 3B 40 ?? 2B 95 2D 3C 40 ?? 83 EA 0B 89 95 36 3C 40 ?? 01 95 24 3C 40 ?? 01 95 28 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv302v302aExtractable
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 33 C9 B1 ?? 51 06 06 BB [2] 53 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv302v302aExtractable
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 33 C9 B1 ?? 51 06 06 BB [2] 53 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ARMProtector03bySMoKE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }

Detection condition:
$a0

Full rule:
rule ARMProtector03bySMoKE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 13 24 40 00 EB 02 83 09 8D B5 A4 24 40 00 EB 02 83 09 BA 4B 15 00 00 EB 01 00 8D 8D EF 39 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }

condition:
		$a0
}
YARA Detection Rule: VxSlowload
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxSlowload
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 D6 B4 40 CD 21 B8 02 42 33 D2 33 C9 CD 21 8B D6 B9 78 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AntiDote10BetaSISTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AntiDote10BetaSISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 BB FF FF FF 84 C0 74 2F 68 04 01 00 00 68 C0 23 60 00 6A 00 FF 15 08 10 60 00 E8 40 FF FF FF 50 68 78 11 60 00 68 68 11 60 00 68 C0 23 60 00 E8 AB FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 66 8B 41 06 89 54 24 14 8D 68 FF 85 ED 7C 37 33 C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DzAPatcherv13Loader
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }

Detection condition:
$a0

Full rule:
rule DzAPatcherv13Loader
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }

condition:
		$a0
}
YARA Detection Rule: CDSSS10beta1CyberDoom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CDSSS10beta1CyberDoom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED CA 47 40 00 FF 74 24 20 E8 D3 03 00 00 0B C0 0F 84 13 03 00 00 89 85 B8 4E 40 00 66 8C D8 A8 04 74 0C C7 85 8C 4E 40 00 01 00 00 00 EB 12 64 A1 30 00 00 00 0F B6 40 02 0A C0 0F 85 E8 02 00 00 8D 85 F6 4C 40 00 50 FF B5 B8 4E 40 00 E8 FC 03 00 00 0B C0 0F 84 CE 02 00 00 E8 1E 03 00 00 89 85 90 4E 40 00 8D 85 03 4D 40 00 50 FF B5 B8 4E 40 00 E8 D7 03 00 00 0B C0 0F 84 A9 02 00 00 E8 F9 02 00 00 89 85 94 4E 40 00 8D 85 12 4D 40 00 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: y0dasCrypterv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule y0dasCrypterv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED E7 1A 40 00 E8 A1 00 00 00 E8 D1 00 00 00 E8 85 01 00 00 F7 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: y0dasCrypterv11
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule y0dasCrypterv11
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NullsoftPiMPInstallSystemv1x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 0C 53 56 57 FF 15 [2] 40 00 05 E8 03 00 00 BE [3] 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 [2] 40 00 50 56 FF 15 [2] 40 00 80 3D [3] 00 22 75 08 80 C3 02 BE [3] 00 8A 06 8B 3D [2] 40 00 84 C0 74 ?? 3A C3 74 }

Detection condition:
$a0

Full rule:
rule NullsoftPiMPInstallSystemv1x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 0C 53 56 57 FF 15 [2] 40 00 05 E8 03 00 00 BE [3] 00 89 44 24 10 B3 20 FF 15 28 ?? 40 00 68 00 04 00 00 FF 15 [2] 40 00 50 56 FF 15 [2] 40 00 80 3D [3] 00 22 75 08 80 C3 02 BE [3] 00 8A 06 8B 3D [2] 40 00 84 C0 74 ?? 3A C3 74 }

condition:
		$a0
}
YARA Detection Rule: ExeBundlev30smallloader
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeBundlev30smallloader
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 60 BE 00 F0 40 00 8D BE 00 20 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXAlternativestub
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXAlternativestub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EmbedPE113cyclotron
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EmbedPE113cyclotron
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 50 60 68 5D B9 52 5A E8 2F 99 00 00 DC 99 F3 57 05 68 B8 5E 2D C6 DA FD 48 63 05 3C 71 B8 5E 97 7C 36 7E 32 7C 08 4F 06 51 64 10 A3 F1 4E CF 25 CB 80 D2 99 54 46 ED E1 D3 46 86 2D 10 68 93 83 5C 46 4D 43 9B 8C D6 7C BB 99 69 97 71 2A 2F A3 38 6B 33 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor2223protectedIAT
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { CC [3] 00 00 00 00 FF FF FF FF 3C [3] B4 [3] 08 [3] 00 00 00 00 FF FF FF FF E8 [3] 04 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 [24] 4C [3] 60 [3] 70 [3] 84 [3] 94 [3] A4 [3] 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 }

Detection condition:
$a0

Full rule:
rule EXECryptor2223protectedIAT
{
      meta:
		author="malware-lu"
strings:
		$a0 = { CC [3] 00 00 00 00 FF FF FF FF 3C [3] B4 [3] 08 [3] 00 00 00 00 FF FF FF FF E8 [3] 04 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 [24] 4C [3] 60 [3] 70 [3] 84 [3] 94 [3] A4 [3] 00 00 00 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 4D 65 73 73 61 67 65 42 6F 78 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner01Armadillo300Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01Armadillo300Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptorvxxxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 24 [3] 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 [7] 31 C0 89 41 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptorvxxxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 [3] 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 [7] 31 C0 89 41 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Morphinev33SilentSoftwareSilentShieldc2005
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 28 [3] 00 00 00 00 00 00 00 00 40 [3] 34 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C [3] 5C [3] 00 00 00 00 4C [3] 5C [3] 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 }
	$a1 = { 28 [3] 00 00 00 00 00 00 00 00 40 [3] 34 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C [3] 5C [3] 00 00 00 00 4C [3] 5C [3] 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }

Detection condition:
$a0 or $a1

Full rule:
rule Morphinev33SilentSoftwareSilentShieldc2005
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 28 [3] 00 00 00 00 00 00 00 00 40 [3] 34 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C [3] 5C [3] 00 00 00 00 4C [3] 5C [3] 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 }
	$a1 = { 28 [3] 00 00 00 00 00 00 00 00 40 [3] 34 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C [3] 5C [3] 00 00 00 00 4C [3] 5C [3] 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }

condition:
		$a0 or $a1
}
YARA Detection Rule: DEF10bartxt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [2] 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 [2] 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DEF10bartxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [2] 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 [2] 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv0971v0976
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv0971v0976
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCShrinkv040b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 BD [4] 01 [5] FF [5] 6A ?? FF [5] 50 50 2D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCShrinkv040b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 BD [4] 01 [5] FF [5] 6A ?? FF [5] 50 50 2D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakePECrypt102emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakePECrypt102emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ORiENv211212FisunAlexander
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ORiENv211212FisunAlexander
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5D 01 00 00 CE D1 CE ?? 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }

condition:
		$a0 at pe.entry_point
}