deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: AHTeamEPProtector03fakeBorlandDelphi6070FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeBorlandDelphi6070FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: STProtectorV15SilentSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }

Detection condition:
$a0

Full rule:
rule STProtectorV15SilentSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }

condition:
		$a0
}
YARA Detection Rule: ASPackv105bAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv105bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor226minimumprotection
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 68 [4] 58 81 E0 [4] E9 [3] 00 87 0C 24 59 E8 [3] 00 89 45 F8 E9 [4] 0F 83 [3] 00 E9 [4] 87 14 24 5A 57 68 [4] E9 [4] 58 81 C0 [4] 2B 05 [4] 81 C8 [4] 81 E0 [4] E9 [3] 00 C3 E9 [4] C3 BF [4] 81 CB [4] BA [4] 52 E9 [3] 00 E8 [3] 00 E9 [3] 00 E9 [4] 87 34 24 5E 66 8B 00 66 25 [2] E9 [4] 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 [4] 09 C0 E9 [4] 59 81 C1 [4] C1 C1 ?? 23 0D [4] 81 F9 [4] E9 [4] C3 E9 [3] 00 13 D0 0B F9 E9 [4] 51 E8 [4] 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 [4] 3C A4 0F 85 [3] 00 8B 45 FC 66 81 38 [2] 0F 84 05 00 00 00 E9 [4] 0F 84 [4] E9 [4] 87 3C 24 5F 31 DB 31 C9 31 D2 68 [4] E9 [4] 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 [4] 53 52 8B D1 87 14 24 81 C0 [4] 0F 88 [4] 3B CB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptor226minimumprotection
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 68 [4] 58 81 E0 [4] E9 [3] 00 87 0C 24 59 E8 [3] 00 89 45 F8 E9 [4] 0F 83 [3] 00 E9 [4] 87 14 24 5A 57 68 [4] E9 [4] 58 81 C0 [4] 2B 05 [4] 81 C8 [4] 81 E0 [4] E9 [3] 00 C3 E9 [4] C3 BF [4] 81 CB [4] BA [4] 52 E9 [3] 00 E8 [3] 00 E9 [3] 00 E9 [4] 87 34 24 5E 66 8B 00 66 25 [2] E9 [4] 8B CD 87 0C 24 8B EC 51 89 EC 5D 8B 05 [4] 09 C0 E9 [4] 59 81 C1 [4] C1 C1 ?? 23 0D [4] 81 F9 [4] E9 [4] C3 E9 [3] 00 13 D0 0B F9 E9 [4] 51 E8 [4] 8B 64 24 08 31 C0 64 8F 05 00 00 00 00 5A E9 [4] 3C A4 0F 85 [3] 00 8B 45 FC 66 81 38 [2] 0F 84 05 00 00 00 E9 [4] 0F 84 [4] E9 [4] 87 3C 24 5F 31 DB 31 C9 31 D2 68 [4] E9 [4] 89 45 FC 33 C0 89 45 F4 83 7D FC 00 E9 [4] 53 52 8B D1 87 14 24 81 C0 [4] 0F 88 [4] 3B CB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEProtector093CRYPToCRACk
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEProtector093CRYPToCRACk
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PellesC300400450EXEX86CRTLIB
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 6A FF 68 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 [4] 59 A3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PellesC300400450EXEX86CRTLIB
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 6A FF 68 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 [4] 59 A3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackv118BasicaPLibAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackv118BasicaPLibAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: vfpexeNcV500WangJianGuo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D [12] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule vfpexeNcV500WangJianGuo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D [12] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeJoiner153Stubengine17GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FreeJoiner153Stubengine17GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 33 FD FF FF 50 E8 0D 00 00 00 CC FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: TheHypersprotectorTheHyper
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 [2] 01 01 [2] 01 01 [3] 00 [2] 01 01 [2] 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule TheHypersprotectorTheHyper
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 14 8B FC E8 14 00 00 00 [2] 01 01 [2] 01 01 [3] 00 [2] 01 01 [2] 02 01 5E E8 0D 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8B 46 04 FF 10 8B D8 E8 0D 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 53 8B 06 FF 10 89 07 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ANDpakk2006DmitryAndreev
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }

Detection condition:
$a0

Full rule:
rule ANDpakk2006DmitryAndreev
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD 00 FB FF FF 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }

condition:
		$a0
}
YARA Detection Rule: Thinstall2628Jtit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }
	$a1 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B 

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Thinstall2628Jtit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }
	$a1 = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: UPXModifierv01x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 BE [4] 8D BE [4] 57 83 CD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXModifierv01x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 BE [4] 8D BE [4] 57 83 CD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium1333ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 03 [3] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 [3] 33 C0 EB 01 ?? C3 EB 04 [4] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 04 }
	$a1 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 03 [3] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 [3] 33 C0 EB 01 ?? C3 EB 04 [4] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 04 [4] 33 C0 EB 01 ?? 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 04 [4] EB 04 [4] 58 EB 01 ?? EB 03 [3] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 04 [4] E8 2B 27 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Obsidium1333ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 03 [3] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 [3] 33 C0 EB 01 ?? C3 EB 04 [4] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 04 }
	$a1 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 03 [3] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 [3] 33 C0 EB 01 ?? C3 EB 04 [4] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 04 [4] 33 C0 EB 01 ?? 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 04 [4] EB 04 [4] 58 EB 01 ?? EB 03 [3] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 04 [4] E8 2B 27 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PureBasic4xNeilHodgson
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [2] 00 00 68 00 00 00 00 68 [3] 00 E8 [3] 00 83 C4 0C 68 00 00 00 00 E8 [3] 00 A3 [3] 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 [3] 00 A3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PureBasic4xNeilHodgson
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [2] 00 00 68 00 00 00 00 68 [3] 00 E8 [3] 00 83 C4 0C 68 00 00 00 00 E8 [3] 00 A3 [3] 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 [3] 00 A3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxAugust16thIronMaiden
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxAugust16thIronMaiden
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA 79 02 03 D7 B4 1A CD 21 B8 24 35 CD 21 5F 57 89 9D 4E 02 8C 85 50 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VProtector10Xvcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [4] 68 [4] 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VProtector10Xvcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] 68 [4] 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 E8 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 05 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEPACK099
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEPACK099
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 80 BD E0 04 00 00 01 0F 84 F2 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Freshbindv20gFresh
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Freshbindv20gFresh
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXSCRAMBLER306OnToL
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE [4] 83 EC 04 89 34 24 B9 80 00 00 00 81 36 [4] 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXSCRAMBLER306OnToL
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE [4] 83 EC 04 89 34 24 B9 80 00 00 00 81 36 [4] 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompact2xxBitSumTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompact2xxBitSumTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PESpinv01Cyberbob
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
	$a1 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 [4] 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule PESpinv01Cyberbob
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
	$a1 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 5C CB 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 B3 28 40 00 8B 42 3C 03 C2 89 85 BD 28 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D D1 28 40 00 53 8F 85 C4 27 40 00 BB ?? 00 00 00 B9 A5 08 00 00 8D BD 75 29 40 00 4F 30 1C 39 FE CB E2 F9 68 2D 01 00 00 59 8D BD AA 30 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 07 4F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B8 [4] 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D C4 28 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 59 81 C1 1D 00 00 00 52 51 C1 E9 05 23 D1 FF }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: VxEddie2100
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 4F 4F 0E E8 [2] 47 47 1E FF [2] CB E8 [2] 84 C0 [2] 50 53 56 57 1E 06 B4 51 CD 21 8E C3 [7] 8B F2 B4 2F CD 21 AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxEddie2100
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 4F 4F 0E E8 [2] 47 47 1E FF [2] CB E8 [2] 84 C0 [2] 50 53 56 57 1E 06 B4 51 CD 21 8E C3 [7] 8B F2 B4 2F CD 21 AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NETexecutableMicrosoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }

Detection condition:
$a0

Full rule:
rule NETexecutableMicrosoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 5F 43 6F 72 45 78 65 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C 00 00 00 00 00 FF 25 }

condition:
		$a0
}
YARA Detection Rule: tElockv098
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 25 E4 FF FF 00 00 00 [4] 1E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv098
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 25 E4 FF FF 00 00 00 [4] 1E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AZProtect0001byAlexZakaAZCRC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 [2] 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 [3] 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C [2] 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 }
	$a1 = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule AZProtect0001byAlexZakaAZCRC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 BE 00 [2] 00 BF 00 00 40 00 EB 17 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 FF 25 [3] 00 8B C6 03 C7 8B F8 57 55 8B EC 05 7F 00 00 00 50 E8 E5 FF FF FF BA 8C [2] 00 89 02 E9 1A 01 00 00 ?? 00 00 00 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 47 65 74 56 6F 6C 75 6D 65 49 6E 66 6F 72 6D 61 74 69 6F 6E 41 00 4D 65 73 73 61 67 65 42 6F 78 41 00 45 78 69 74 50 72 6F 63 65 73 73 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 }
	$a1 = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 FB 08 72 05 33 DB 43 EB 01 43 33 C0 8A 04 31 8A 24 13 2A C4 88 04 31 E2 E6 5E 5B C9 C2 0C }

condition:
		$a0 at pe.entry_point or $a1
}