deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MetrowerksCodeWarriorv20GUI
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 [2] 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 [12] E8 [2] 00 00 E8 [2] 00 00 E8 }

Detection condition:
$a0

Full rule:
rule MetrowerksCodeWarriorv20GUI
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 83 EC 44 55 B8 FF FF FF FF 50 50 68 [2] 40 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 [12] E8 [2] 00 00 E8 [2] 00 00 E8 }

condition:
		$a0
}
YARA Detection Rule: UnnamedScrambler21Beta211p0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A [2] E8 ?? EE FF FF 33 C0 55 68 ?? 43 [2] 64 FF 30 64 89 20 BA ?? 43 [2] B8 E4 64 [2] E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 [2] 8B C3 8B 0D E4 64 [2] E8 ?? D7 FF FF B8 F8 [3] BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 [3] BB [4] C7 45 EC E8 64 [2] C7 45 E8 [4] C7 45 E4 [4] BE [4] BF [4] B8 E0 [3] BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 [3] E8 ?? E5 FF FF B8 E4 [3] E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8 }

Detection condition:
$a0

Full rule:
rule UnnamedScrambler21Beta211p0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A [2] E8 ?? EE FF FF 33 C0 55 68 ?? 43 [2] 64 FF 30 64 89 20 BA ?? 43 [2] B8 E4 64 [2] E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 [2] 8B C3 8B 0D E4 64 [2] E8 ?? D7 FF FF B8 F8 [3] BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 [3] BB [4] C7 45 EC E8 64 [2] C7 45 E8 [4] C7 45 E4 [4] BE [4] BF [4] B8 E0 [3] BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 [3] E8 ?? E5 FF FF B8 E4 [3] E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8 }

condition:
		$a0
}
YARA Detection Rule: NoodleCryptv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 }
	$a1 = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 [2] 00 00 EB 01 9A E8 [2] 00 00 EB 01 }

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule NoodleCryptv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 }
	$a1 = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 [2] 00 00 EB 01 9A E8 [2] 00 00 EB 01 }

condition:
		$a0 at pe.entry_point or $a1
}
YARA Detection Rule: PoPa001PackeronPascalbagie
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 [4] 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PoPa001PackeronPascalbagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 [4] 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 33 D2 55 68 93 40 00 10 64 FF 32 64 89 22 83 3D 64 66 00 10 FF 0F 84 3A 01 00 00 6A 00 6A 00 6A 00 A1 64 66 00 10 50 E8 9B F6 FF FF 83 E8 10 50 A1 64 66 00 10 50 E8 BC F6 FF FF 6A 00 68 80 66 00 10 6A 10 68 68 66 00 10 A1 64 66 00 10 50 E8 8B F6 FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: BlindSpot10s134k
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50 }

Detection condition:
$a0

Full rule:
rule BlindSpot10s134k
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 50 02 00 00 8D 85 B0 FE FF FF 53 56 A3 90 12 40 00 57 8D 85 B0 FD FF FF 68 00 01 00 00 33 F6 50 56 FF 15 24 10 40 00 56 68 80 00 00 00 6A 03 56 56 8D 85 B0 FD FF FF 68 00 00 00 80 50 FF 15 20 10 40 00 56 56 68 00 08 00 00 50 89 45 FC FF 15 1C 10 40 00 8D 45 F8 8B 1D 18 10 40 00 56 50 6A 34 FF 35 90 12 40 00 FF 75 FC FF D3 85 C0 0F 84 7F 01 00 00 39 75 F8 0F 84 76 01 00 00 A1 90 12 40 00 66 8B 40 30 66 3D 01 00 75 14 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 14 10 40 00 EB 2C 66 3D 02 00 75 14 8D 85 E4 FE FF FF 50 68 04 01 00 00 FF 15 10 10 40 00 EB 12 8D 85 E4 FE FF FF 68 04 01 00 00 50 FF 15 0C 10 40 00 8B 3D 08 10 40 00 8D 85 E4 FE FF FF 68 54 10 40 00 50 }

condition:
		$a0
}
YARA Detection Rule: GamehouseMediaProtectorVersionUnknown
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] 6A 00 FF 15 [4] 50 FF 15 [3] 00 00 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule GamehouseMediaProtectorVersionUnknown
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] 6A 00 FF 15 [4] 50 FF 15 [3] 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv042
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv042
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEStealthv274WebToolMaster
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 00 EB 17 [23] 60 90 E8 00 00 00 00 5D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEStealthv274WebToolMaster
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 EB 17 [23] 60 90 E8 00 00 00 00 5D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEManagerVersion301994cSolarDesigner
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 30 1E 06 CD 21 2E [3] BF [2] B9 [2] 33 C0 2E [2] 47 E2 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEManagerVersion301994cSolarDesigner
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 1E 06 CD 21 2E [3] BF [2] B9 [2] 33 C0 2E [2] 47 E2 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv02BetaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 88 01 [2] AD 8B F8 95 A5 33 C0 33 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv02BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 [2] AD 8B F8 95 A5 33 C0 33 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DEFv100Engbartxt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 [2] 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DEFv100Engbartxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 [2] 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AnslymCrypter
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AnslymCrypter
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B D8 85 DB 0F 84 B6 02 00 00 53 A1 60 56 05 10 50 E8 F2 48 FB FF 8B F0 85 F6 0F 84 A0 02 00 00 E8 F3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ARMProtectorv02SMoKE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ARMProtectorv02SMoKE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrypKeyV56XDLLKenonicControlsLtd
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 1D [4] 83 FB 00 75 0A E8 [4] E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrypKeyV56XDLLKenonicControlsLtd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 1D [4] 83 FB 00 75 0A E8 [4] E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEiDBundlev102v104BoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 [3] 2E [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEiDBundlev102v104BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 [3] 2E [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxHeloween1172
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 81 EE [2] 56 50 06 0E 1F 8C C0 01 [2] 01 [2] 80 [4] 8B [2] A3 [2] 8A [2] A2 [2] B8 [2] CD 21 3D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxHeloween1172
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 81 EE [2] 56 50 06 0E 1F 8C C0 01 [2] 01 [2] 80 [4] 8B [2] A3 [2] 8A [2] A2 [2] B8 [2] CD 21 3D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PackedwithPKLITEv150withCRCcheck1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1F B4 09 BA [2] CD 21 B8 [2] CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PackedwithPKLITEv150withCRCcheck1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1F B4 09 BA [2] CD 21 B8 [2] CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Pe123v2006412
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Pe123v2006412
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DropperCreatorV01Conflict
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 8D 05 [4] 29 C5 8D 85 [4] 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 }

Detection condition:
$a0

Full rule:
rule DropperCreatorV01Conflict
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8D 05 [4] 29 C5 8D 85 [4] 31 C0 64 03 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 }

condition:
		$a0
}
YARA Detection Rule: XCRv013
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 93 71 08 [8] 8B D8 78 E2 [4] 9C 33 C3 [4] 60 79 CE [4] E8 01 [4] 83 C4 04 E8 AB FF FF FF [4] 2B E8 [4] 03 C5 FF 30 [4] C6 ?? EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule XCRv013
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 93 71 08 [8] 8B D8 78 E2 [4] 9C 33 C3 [4] 60 79 CE [4] E8 01 [4] 83 C4 04 E8 AB FF FF FF [4] 2B E8 [4] 03 C5 FF 30 [4] C6 ?? EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: XCRv012
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C E8 [4] 8B DD 5D 81 ED [4] 89 9D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule XCRv012
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C E8 [4] 8B DD 5D 81 ED [4] 89 9D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: InnoSetupModulev129
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule InnoSetupModulev129
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 EC 89 45 C0 E8 5B 73 FF FF E8 D6 87 FF FF E8 C5 A9 FF FF E8 E0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov3xx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov3xx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: dUP2xPatcherwwwdiablo2oo2cjbnet
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9 }

Detection condition:
$a0

Full rule:
rule dUP2xPatcherwwwdiablo2oo2cjbnet
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B CB 85 C9 74 ?? 80 3A 01 74 08 AC AE 75 0A 42 49 EB EF 47 46 42 49 EB E9 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner02PEProtect09Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02PEProtect09Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: pscrambler12byp0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 [4] 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6

Detection condition:
$a0 at pe.entry_point

Full rule:
rule pscrambler12byp0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 04 00 00 00 6A 00 6A 00 49 75 F9 51 53 [4] 10 E8 2D F3 FF FF 33 C0 55 68 E8 31 00 10 64 FF 30 64 89 20 8D 45 E0 E8 53 F5 FF FF 8B 45 E0 8D 55 E4 E8 30 F6 FF FF 8B 45 E4 8D 55 E8 E8 A9 F4 FF FF 8B 45 E8 8D 55 EC E8 EE F7 FF FF 8B 55 EC B8 C4 54 00 10 E8 D9 EC FF FF 83 3D C4 54 00 10 00 0F 84 05 01 00 00 80 3D A0 40 00 10 00 74 41 A1 C4 54 00 10 E8 D9 ED FF FF E8 48 E0 FF FF 8B D8 A1 C4 54 00 10 E8 C8 ED FF FF 50 B8 C4 54 00 10 E8 65 EF FF FF 8B D3 59 E8 69 E1 FF FF 8B C3 E8 12 FA FF FF 8B C3 E8 33 E0 FF FF E9 AD 00 00 00 B8 05 01 00 00 E8 0C E0 FF FF 8B D8 53 68 05 01 00 00 E8 57 F3 FF FF 8D 45 DC 8B D3 E8 39 ED FF FF 8B 55 DC B8 14 56 00 10 B9 00 32 00 10 E8 BB ED FF FF 8B 15 14 56 00 10 B8 C8 54 00 10 E8 53 E5 FF FF BA 01 00 00 00 B8 C8 54 00 10 E8 8C E8 FF FF E8 DF E0 FF FF 85 C0 75 52 6A 00 A1 C4 54 00 10 E8 3B ED FF FF 50 B8 C4 54 00 10 E8 D8 EE FF FF 8B D0 B8 C8 54 00 10 59 E8 3B E6 FF FF E8 76 E0 FF FF B8 C8 54 00 10 E8 4C E6 FF FF E8 67 E0 FF FF 6A 00 6A 00 6A 00 A1 14 56 00 10 E8 53 EE FF FF 50 6A 00 6A 00 E8 41 F3 FF FF 80 3D 9C 40 00 10 00 74 05 E8 EF FB FF FF 33 C0 5A 59 59 64 89 10 68 EF 31 00 10 8D 45 DC BA 05 00 00 00 E8 7D EB FF FF C3 E9 23 E9 FF FF EB EB 5B E8 63 EA FF FF 00 00 00 FF FF FF FF 08 00 00 00 74 65 6D 70 2E 65 78 65 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor2223compressedcodewwwstrongbitcom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 58 [5] 8B 1C 24 81 EB [4] B8 [4] 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 [3] 8B 04 18 FF D0 59 BA [4] 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 [4] 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
	$a1 = { E8 00 00 00 00 58 [5] 8B 1C 24 81 EB [4] B8 [4] 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 [3] 8B 04 18 FF D0 59 BA [4] 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 [4] 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 [3] 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC [5] C3 }

Detection condition:
$a0 or $a1

Full rule:
rule EXECryptor2223compressedcodewwwstrongbitcom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 [5] 8B 1C 24 81 EB [4] B8 [4] 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 [3] 8B 04 18 FF D0 59 BA [4] 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 [4] 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
	$a1 = { E8 00 00 00 00 58 [5] 8B 1C 24 81 EB [4] B8 [4] 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 [3] 8B 04 18 FF D0 59 BA [4] 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 [4] 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 [3] 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC [5] C3 }

condition:
		$a0 or $a1
}
YARA Detection Rule: Armadillov265b1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 38 [3] 68 40 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 28 [3] 33 D2 8A D4 89 15 F4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov265b1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 38 [3] 68 40 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 28 [3] 33 D2 8A D4 89 15 F4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackFullEdition117aPLibAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF [15] EB 0F FF 74 37 04 FF 34 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackFullEdition117aPLibAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 74 1F 00 00 8D 9D 1E 03 00 00 33 FF [15] EB 0F FF 74 37 04 FF 34 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PolyCryptPE214b215JLabSoftwareCreationshoep
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }

Detection condition:
$a0

Full rule:
rule PolyCryptPE214b215JLabSoftwareCreationshoep
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }

condition:
		$a0
}
YARA Detection Rule: yodasProtector10xAshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtector10xAshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upack_UnknownDLLDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upack_UnknownDLLDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 17 CD 00 00 E9 06 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AINEXEv21
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { A1 [2] 2D [2] 8E D0 BC [2] 8C D8 36 A3 [2] 05 [2] 36 A3 [2] 2E A1 [2] 8A D4 B1 04 D2 EA FE C9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AINEXEv21
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 [2] 2D [2] 8E D0 BC [2] 8C D8 36 A3 [2] 05 [2] 36 A3 [2] 2E A1 [2] 8A D4 B1 04 D2 EA FE C9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AppProtectorSilentTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AppProtectorSilentTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A }

condition:
		$a0 at pe.entry_point
}