deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: VxKuku448
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { AE 75 ED E2 F8 89 3E [2] BA [2] 0E 07 BF [2] EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxKuku448
{
      meta:
		author="malware-lu"
strings:
		$a0 = { AE 75 ED E2 F8 89 3E [2] BA [2] 0E 07 BF [2] EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectv12xNewStrain
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 01 [3] E8 01 [3] C3 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectv12xNewStrain
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 [3] E8 01 [3] C3 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimpleUPXCryptorv3042005OnelayerencryptionMANtiCORE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 B8 [3] 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 [3] 00 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SimpleUPXCryptorv3042005OnelayerencryptionMANtiCORE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 [3] 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 [3] 00 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AntiDote10Demo12SISTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C }

Detection condition:
$a0

Full rule:
rule AntiDote10Demo12SISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C }

condition:
		$a0
}
YARA Detection Rule: FSGv110EngbartxtWinRARSFX
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
	$a1 = { EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule FSGv110EngbartxtWinRARSFX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
	$a1 = { EB 01 02 EB 02 CD 20 B8 80 ?? 42 00 EB 01 55 BE F4 00 00 00 13 DF 13 D8 0F B6 38 D1 F3 F7 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: BJFntv11b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BJFntv11b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThinstallEmbedded26202623Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 [4] 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded26202623Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 [4] 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SLVc0deProtector11xSLVICU
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C [2] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SLVc0deProtector11xSLVICU
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 C6 00 EB C6 40 01 08 FF E0 E9 4C [2] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RJoinerbyVaskaSignfrompinch[PII_REDACTED]00
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RJoinerbyVaskaSignfrompinch[PII_REDACTED]00
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 6C 10 40 00 FF 25 70 10 40 00 FF 25 74 10 40 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AverCryptor10os1r1s
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AverCryptor10os1r1s
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: nSpackV23LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 70 61 63 6B 24 40 }

Detection condition:
$a0

Full rule:
rule nSpackV23LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 70 61 63 6B 24 40 }

condition:
		$a0
}
YARA Detection Rule: SENDebugProtector
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB [4] 00 [5] 29 [2] 4E E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SENDebugProtector
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB [4] 00 [5] 29 [2] 4E E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: xPEP03xxIkUg
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 53 56 51 52 57 E8 16 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule xPEP03xxIkUg
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 53 56 51 52 57 E8 16 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AntiDote14SESISTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AntiDote14SESISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPack30NorthStar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 [2] FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPack30NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 [2] FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ORiENV212FisunAV
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 5D 01 00 00 CE D1 CE CD 0D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ORiENV212FisunAV
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5D 01 00 00 CE D1 CE CD 0D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPackv23NorthStar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8B 06 83 F8 00 74 11 8D B5 [2] FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 [2] FF FF 2B D0 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 8B 36 8B FD }
	$a1 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8B 06 83 F8 00 74 11 8D B5 [2] FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 [2] FF FF 2B D0 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 56 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61 }

Detection condition:
$a0 or $a1

Full rule:
rule NsPackv23NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8B 06 83 F8 00 74 11 8D B5 [2] FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 [2] FF FF 2B D0 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 8B 36 8B FD }
	$a1 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [2] FF FF 8B 06 83 F8 00 74 11 8D B5 [2] FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 [2] FF FF 2B D0 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 8B 36 8B FD 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 56 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 54 03 00 00 03 D9 50 53 E8 9D 02 00 00 61 }

condition:
		$a0 or $a1
}
YARA Detection Rule: ObsidiumV1342ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 26 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 24 EB 03 [3] 33 C0 EB 01 ?? C3 EB 02 [2] EB 02 [2] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 03 [3] EB 03 [3] 50 EB 04 [4] 33 C0 EB 03 [3] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 01 ?? EB 03 [3] 58 EB 04 [4] EB 04 [4] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 01 ?? E8 C3 27 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV1342ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 26 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 24 EB 03 [3] 33 C0 EB 01 ?? C3 EB 02 [2] EB 02 [2] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 03 [3] EB 03 [3] 50 EB 04 [4] 33 C0 EB 03 [3] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 01 ?? EB 03 [3] 58 EB 04 [4] EB 04 [4] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 01 ?? E8 C3 27 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SplashBitmapv100WithUnpackCodeBoBBobsoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED [4] 8D BD [4] 8D 8D [4] 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 [4] 6A 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SplashBitmapv100WithUnpackCodeBoBBobsoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED [4] 8D BD [4] 8D 8D [4] 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 [4] 6A 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: KBySV028shoooo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule KBySV028shoooo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ObsidiumV12XObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV12XObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPackV13LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPackV13LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01PENinja131Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PENinja131Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidiumv1300ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
	$a1 = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Obsidiumv1300ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
	$a1 = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B 50 EB 03 8A 0B 93 33 C0 EB 02 28 B9 8B 00 EB 01 04 C3 EB 04 65 B3 54 0A E9 FA 00 00 00 EB 01 A2 E8 D5 FF FF FF EB 02 2B 49 EB 03 7C 3E 76 58 EB 04 B8 94 92 56 EB 01 72 64 67 8F 06 00 00 EB 02 23 72 83 C4 04 EB 02 A9 CB E8 47 26 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: Feokt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 89 25 A8 11 40 00 BF [3] 00 31 C0 B9 [3] 00 29 F9 FC F3 AA [61] E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Feokt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 89 25 A8 11 40 00 BF [3] 00 31 C0 B9 [3] 00 29 F9 FC F3 AA [61] E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NTkrnlSecureSuite01015NTkrnlSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 [4] E8 01 00 00 00 C3 C3 }

Detection condition:
$a0

Full rule:
rule NTkrnlSecureSuite01015NTkrnlSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 [4] E8 01 00 00 00 C3 C3 }

condition:
		$a0
}
YARA Detection Rule: PEPROTECT09
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEPROTECT09
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 CF 00 00 00 0D 0A 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXERefactorV01random
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXERefactorV01random
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrunchPEv40
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 10 [16] 55 E8 [4] 5D 81 ED 18 [3] 8B C5 55 60 9C 2B 85 E9 06 [2] 89 85 E1 06 [2] FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }

Detection condition:
$a0

Full rule:
rule CrunchPEv40
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 [16] 55 E8 [4] 5D 81 ED 18 [3] 8B C5 55 60 9C 2B 85 E9 06 [2] 89 85 E1 06 [2] FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }

condition:
		$a0
}
YARA Detection Rule: NullsoftPIMPInstallSystemv1x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 5C 53 55 56 57 FF 15 [3] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NullsoftPIMPInstallSystemv1x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 5C 53 55 56 57 FF 15 [3] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Pohernah100byKas
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Pohernah100byKas
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: dUP2diablo2oo2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] E8 [4] 8B F0 6A 00 68 [4] 56 E8 [4] A2 [4] 6A 00 68 [4] 56 E8 [4] A2 [4] 6A 00 68 [4] 56 E8 [4] A2 [4] 68 [4] 68 [4] 56 E8 [4] 3C 01 75 19 BE [4] 68 00 02 00 00 56 68 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule dUP2diablo2oo2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] E8 [4] 8B F0 6A 00 68 [4] 56 E8 [4] A2 [4] 6A 00 68 [4] 56 E8 [4] A2 [4] 6A 00 68 [4] 56 E8 [4] A2 [4] 68 [4] 68 [4] 56 E8 [4] 3C 01 75 19 BE [4] 68 00 02 00 00 56 68 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01ASPack2xxHeuristicAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01ASPack2xxHeuristicAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXpressorv145CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule eXpressorv145CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C }

condition:
		$a0 at pe.entry_point
}