deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MSLRHv032afakeASPack212emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeASPack212emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RatPackerGluestub
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RatPackerGluestub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CreateInstallv200335
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }

Detection condition:
$a0

Full rule:
rule CreateInstallv200335
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }

condition:
		$a0
}
YARA Detection Rule: SPECb3
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5B 53 50 45 43 5D E8 [4] 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SPECb3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 53 50 45 43 5D E8 [4] 5D 8B C5 81 ED 41 24 40 ?? 2B 85 89 26 40 ?? 83 E8 0B 89 85 8D 26 40 ?? 0F B6 B5 91 26 40 ?? 8B FD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SPECb2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 57 51 53 E8 [4] 5D 8B C5 81 ED [4] 2B 85 [4] 83 E8 09 89 85 [4] 0F B6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SPECb2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 51 53 E8 [4] 5D 8B C5 81 ED [4] 2B 85 [4] 83 E8 09 89 85 [4] 0F B6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FF D5 8D 87 [4] 80 20 ?? 80 60 [2] 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

Detection condition:
$a0

Full rule:
rule UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF D5 8D 87 [4] 80 20 ?? 80 60 [2] 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner01MicrosoftVisualBasic5060Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01MicrosoftVisualBasic5060Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXModifiedStubbFarbrauschConsumerConsulting
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXModifiedStubbFarbrauschConsumerConsulting
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: E2CbyDoP
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [2] BF [2] B9 [2] FC 57 F3 A5 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule E2CbyDoP
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [2] BF [2] B9 [2] FC 57 F3 A5 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SVKProtectorv111
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED 06 [3] 64 A0 23 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SVKProtectorv111
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED 06 [3] 64 A0 23 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCShrinkerv071
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 BD [4] 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D [4] 89 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCShrinkerv071
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 BD [4] 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D [4] 89 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Petite21
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 }

Detection condition:
$a0

Full rule:
rule Petite21
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 }

condition:
		$a0
}
YARA Detection Rule: BeRoEXEPackerv100DLLLZBRRBeRoFarbrausch
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 7C 24 08 01 0F 85 [4] 60 BE [4] BF [4] FC B2 80 33 DB A4 B3 02 E8 [4] 73 F6 33 C9 E8 [4] 73 1C 33 C0 E8 [4] 73 23 B3 02 41 B0 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BeRoEXEPackerv100DLLLZBRRBeRoFarbrausch
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 [4] 60 BE [4] BF [4] FC B2 80 33 DB A4 B3 02 E8 [4] 73 F6 33 C9 E8 [4] 73 1C 33 C0 E8 [4] 73 23 B3 02 41 B0 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: hmimysPackerV12hmimys
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 95 00 00 00 [149] 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 [4] E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 [4] 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule hmimysPackerV12hmimys
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 95 00 00 00 [149] 5E AD 50 AD 50 97 AD 50 AD 50 AD 50 E8 C0 01 00 00 AD 50 AD 93 87 DE B9 [4] E3 1D 8A 07 47 04 ?? 3C ?? 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 05 [4] 2B C7 AB E2 E3 AD 85 C0 74 2B 97 56 FF 13 8B E8 AC 84 C0 75 FB 66 AD 66 85 C0 74 E9 AC 83 EE 03 84 C0 74 08 56 55 FF 53 04 AB EB E4 AD 50 55 FF 53 04 AB EB E0 C3 8B 0A 3B 4A 04 75 0A C7 42 10 01 00 00 00 0C FF C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EnigmaProtector131Build20070615DllSukhovVladimirSergeNMarkin
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED [4] E9 49 00 00 00 [40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 [4] FF E0 E9 04 00 00 00 [4] B8 [4] 03 C5 81 C0 [4] B9 [4] BA [4] 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EnigmaProtector131Build20070615DllSukhovVladimirSergeNMarkin
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED [4] E9 49 00 00 00 [40] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 84 24 28 00 00 00 80 F8 01 0F 84 07 00 00 00 B8 [4] FF E0 E9 04 00 00 00 [4] B8 [4] 03 C5 81 C0 [4] B9 [4] BA [4] 30 10 40 49 0F 85 F6 FF FF FF E9 04 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PureBasicDLLNeilHodgson
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 [3] 10 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PureBasicDLLNeilHodgson
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 75 ?? 8B 44 24 04 A3 [3] 10 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HPA
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 8B D6 83 [2] 83 [2] 06 0E 1E 0E 1F 33 FF 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HPA
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 8B D6 83 [2] 83 [2] 06 0E 1E 0E 1F 33 FF 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov310
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov310
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upack012betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 48 01 40 00 AD [3] A5 ?? C0 33 C9 [7] F3 AB [2] 0A [4] AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 [15] B6 5F FF C1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upack012betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 48 01 40 00 AD [3] A5 ?? C0 33 C9 [7] F3 AB [2] 0A [4] AD 50 97 51 ?? 87 F5 58 8D 54 86 5C ?? D5 72 [15] B6 5F FF C1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxNcuLi1688
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxNcuLi1688
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VProtectorvcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65

Detection condition:
$a0 or $a1 or $a2

Full rule:
rule VProtectorvcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65 74 4D 65 73 73 61 67 65 41 00 00 00 44 65 73 74 72 6F 79 57 69 6E 64 6F 77 00 00 00 53 65 74 50 69 78 65 6C }
	$a1 = { 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 47 44 49 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 53 6C 65 65 70 00 00 00 47 65 74 56 65 72 73 69 6F 6E 00 00 00 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 00 00 47 65 74 53 74 61 72 74 75 70 49 6E 66 6F 41 00 00 00 47 65 74 41 43 50 00 00 00 43 72 65 61 74 65 54 68 72 65 61 64 00 00 00 44 65 66 57 69 6E 64 6F 77 50 72 6F 63 41 00 00 00 52 65 67 69 73 74 65 72 43 6C 61 73 73 45 78 41 00 00 00 43 72 65 61 74 65 57 69 6E 64 6F 77 45 78 41 00 00 00 47 65 74 53 79 73 74 65 6D 4D 65 74 72 69 63 73 00 00 00 53 68 6F 77 57 69 6E 64 6F 77 00 00 00 47 65 74 44 43 00 00 00 52 65 6C 65 61 73 65 44 43 00 00 00 46 69 6E 64 57 69 6E 64 6F 77 41 00 00 00 47 65
YARA Detection Rule: XPackv142
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 72 ?? C3 8B DE 83 [2] C1 [2] 8C D8 03 C3 8E D8 8B DF 83 [2] C1 [2] 8C C0 03 C3 8E C0 C3 }

Detection condition:
$a0

Full rule:
rule XPackv142
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 72 ?? C3 8B DE 83 [2] C1 [2] 8C D8 03 C3 8E D8 8B DF 83 [2] C1 [2] 8C C0 03 C3 8E C0 C3 }

condition:
		$a0
}
YARA Detection Rule: W32JeefoPEFileInfector
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 [3] FF D0 E8 [4] C9 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule W32JeefoPEFileInfector
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 [3] FF D0 E8 [4] C9 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeSplitter13SplitCryptMethodBillPrisonerTPOC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64 }
	$a1 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 [4] 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 [7] 66 }

Detection condition:
$a0 or $a1 at pe.entry_point

Full rule:
rule ExeSplitter13SplitCryptMethodBillPrisonerTPOC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 15 10 05 23 14 56 57 57 48 12 0B 16 66 66 66 66 66 66 66 66 66 02 C7 56 66 66 66 ED 26 6A ED 26 6A ED 66 E3 A6 69 E2 39 64 66 66 ED 2E 56 E6 5F 0D 12 61 E6 5F 2D 12 64 8D 81 E6 1F 6A 55 12 64 8D B9 ED 26 7E A5 33 ED 8A 8D 69 21 03 12 36 14 09 05 27 02 02 14 03 15 15 27 ED 2B 6A ED 13 6E ED B8 65 10 5A EB 10 7E EB 10 06 ED 50 65 95 30 ED 10 46 65 95 55 B4 ED A0 ED 50 65 95 37 ED 2B 6A EB DF AB 76 26 66 3F DF 68 66 66 66 9A 95 C0 6D AF 13 64 }
	$a1 = { E8 00 00 00 00 5D 81 ED 05 10 40 00 B9 [4] 8D 85 1D 10 40 00 80 30 66 40 E2 FA 8F 98 67 66 66 [7] 66 }

condition:
		$a0 or $a1 at pe.entry_point
}
YARA Detection Rule: AntiDote12BetaDemoSISTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AntiDote12BetaDemoSISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 69 D6 00 00 E8 C6 FD FF FF 68 69 D6 00 00 E8 BC FD FF FF 83 C4 08 E8 A4 FF FF FF 84 C0 74 2F 68 04 01 00 00 68 B0 21 60 00 6A 00 FF 15 08 10 60 00 E8 29 FF FF FF 50 68 88 10 60 00 68 78 10 60 00 68 B0 21 60 00 E8 A4 FD FF FF 83 C4 10 33 C0 C2 10 00 90 90 90 90 90 90 90 90 90 90 90 90 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 90 8B 44 24 04 53 55 56 8B 48 3C 57 03 C8 33 D2 8B 79 54 8B 71 38 8B C7 F7 F6 85 D2 74 0C 8B C7 33 D2 F7 F6 8B F8 47 0F AF FE 33 C0 33 DB 66 8B 41 14 8D 54 08 18 33 C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv211bAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv211bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 E9 3D 04 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor224StrongbitSoftCompleteDevelopmenth1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 F7 FE FF FF 05 [2] 00 00 FF E0 E8 EB FE FF FF 05 [2] 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptor224StrongbitSoftCompleteDevelopmenth1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F7 FE FF FF 05 [2] 00 00 FF E0 E8 EB FE FF FF 05 [2] 00 00 FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor224StrongbitSoftCompleteDevelopmenth2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 F7 FE FF FF 05 [2] 00 00 FF E0 E8 EB FE FF FF 05 [2] 00 00 FF E0 E8 ?? 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptor224StrongbitSoftCompleteDevelopmenth2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F7 FE FF FF 05 [2] 00 00 FF E0 E8 EB FE FF FF 05 [2] 00 00 FF E0 E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor224StrongbitSoftCompleteDevelopmenth3
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

Detection condition:
$a0

Full rule:
rule EXECryptor224StrongbitSoftCompleteDevelopmenth3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0
}
YARA Detection Rule: ProActivateV10XTurboPowerSoftwareCompany
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 [4] 90 90 90 90 90 33 C0 55 68 [4] 64 FF 30 64 89 20 A1 [4] 83 C0 05 A3 [4] C7 05 [4] 0D 00 00 00 E8 85 E2 FF FF 81 3D [4] 21 7E 7E 40 75 7A 81 3D [4] 43 52 43 33 75 6E 81 3D [4] 32 40 7E 7E 75 62 81 3D [4] 21 7E 7E 40 75 56 81 3D [4] 43 52 43 33 75 4A 81 3D [4] 32 40 7E 7E 75 3E 81 3D [4] 21 7E 7E 40 75 32 81 3D [4] 43 52 43 33 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ProActivateV10XTurboPowerSoftwareCompany
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 0E 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 [4] 90 90 90 90 90 33 C0 55 68 [4] 64 FF 30 64 89 20 A1 [4] 83 C0 05 A3 [4] C7 05 [4] 0D 00 00 00 E8 85 E2 FF FF 81 3D [4] 21 7E 7E 40 75 7A 81 3D [4] 43 52 43 33 75 6E 81 3D [4] 32 40 7E 7E 75 62 81 3D [4] 21 7E 7E 40 75 56 81 3D [4] 43 52 43 33 75 4A 81 3D [4] 32 40 7E 7E 75 3E 81 3D [4] 21 7E 7E 40 75 32 81 3D [4] 43 52 43 33 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PackMasterv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }
	$a1 = { 60 E8 01 [3] E8 83 C4 04 E8 01 [3] E9 5D 81 ED D3 22 40 ?? E8 04 02 [2] E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule PackMasterv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED D3 22 40 00 E8 04 02 00 00 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }
	$a1 = { 60 E8 01 [3] E8 83 C4 04 E8 01 [3] E9 5D 81 ED D3 22 40 ?? E8 04 02 [2] E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: DBPEv153
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 55 57 56 52 51 53 9C FA E8 [4] 5D 81 ED 5B 53 40 ?? B0 ?? E8 [4] 5E 83 C6 11 B9 27 [3] 30 06 46 49 75 FA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DBPEv153
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 55 57 56 52 51 53 9C FA E8 [4] 5D 81 ED 5B 53 40 ?? B0 ?? E8 [4] 5E 83 C6 11 B9 27 [3] 30 06 46 49 75 FA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeJoiner152Stubengine16GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FreeJoiner152Stubengine16GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

condition:
		$a0 at pe.entry_point
}