deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PackmanV0001Bubbasoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 58 8D [5] 8D [5] 8D [5] 8D [2] 48 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PackmanV0001Bubbasoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 8D [5] 8D [5] 8D [5] 8D [2] 48 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DJoinv07publicxorencryptiondrmist
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C6 05 [2] 40 00 00 [8] 00 [4] 00 [5] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DJoinv07publicxorencryptiondrmist
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C6 05 [2] 40 00 00 [8] 00 [4] 00 [5] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeJoinerSmallbuild033GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FreeJoinerSmallbuild033GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AnticrackSoftwareProtectorv109ACProtect
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 [8] 00 00 [12] E8 01 00 00 00 ?? 83 04 24 06 C3 [5] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AnticrackSoftwareProtectorv109ACProtect
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 [8] 00 00 [12] E8 01 00 00 00 ?? 83 04 24 06 C3 [5] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnderGroundCrypterbyBooster2000
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0 }

Detection condition:
$a0

Full rule:
rule UnderGroundCrypterbyBooster2000
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0 }

condition:
		$a0
}
YARA Detection Rule: MicroJoiner16coban2k
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MicroJoiner16coban2k
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WiseInstallerStubv11010291
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WiseInstallerStubv11010291
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 40 0F 00 00 53 56 57 6A 04 FF 15 F4 30 40 00 FF 15 74 30 40 00 8A 08 89 45 E8 80 F9 22 75 48 8A 48 01 40 89 45 E8 33 F6 84 C9 74 0E 80 F9 22 74 09 8A 48 01 40 89 45 E8 EB EE 80 38 22 75 04 40 89 45 E8 80 38 20 75 09 40 80 38 20 74 FA 89 45 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PrivateEXEProtector18
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0 }

Detection condition:
$a0

Full rule:
rule PrivateEXEProtector18
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB DC EE 0D 76 D9 D0 8D 16 85 D8 90 D9 D0 }

condition:
		$a0
}
YARA Detection Rule: SimpleUPXCryptorv3042005multilayerencryptionMANtiCORE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 B8 [3] 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 [3] 00 C3 }
	$a1 = { 60 B8 [4] B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 [4] C3 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule SimpleUPXCryptorv3042005multilayerencryptionMANtiCORE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 [3] 00 B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 [3] 00 C3 }
	$a1 = { 60 B8 [4] B9 18 00 00 00 80 34 08 ?? E2 FA 61 68 [4] C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: Themida1201compressedOreansTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 00 00 [2] 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Themida1201compressedOreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 [2] 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv155
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv155
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PolyCryptPE214b215JLabSoftwareCreationshsigned
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }

Detection condition:
$a0

Full rule:
rule PolyCryptPE214b215JLabSoftwareCreationshsigned
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }

condition:
		$a0
}
YARA Detection Rule: PECompactv156
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv156
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PGMPACKv013
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE [2] BF [2] E8 [2] E8 [2] BB [2] BA [2] 8A C3 8B F3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PGMPACKv013
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE [2] BF [2] E8 [2] E8 [2] BB [2] BA [2] 8A C3 8B F3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PGMPACKv014
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE [2] BF [2] E8 [2] E8 [2] BB [2] BA [2] 8A C3 8B F3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PGMPACKv014
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE [2] BF [2] E8 [2] E8 [2] BB [2] BA [2] 8A C3 8B F3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner0232Lite003Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner0232Lite003Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakePEtite22FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakePEtite22FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 B8 00 00 00 00 68 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MEW10byNorthfox
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 C0 E9 [2] FF FF ?? 1C [2] 40 }

Detection condition:
$a0

Full rule:
rule MEW10byNorthfox
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 E9 [2] FF FF ?? 1C [2] 40 }

condition:
		$a0
}
YARA Detection Rule: theWRAPbyTronDoc
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule theWRAPbyTronDoc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 48 D2 4B 00 E8 BC 87 F4 FF BB 04 0B 4D 00 33 C0 55 68 E8 D5 4B 00 64 FF 30 64 89 20 E8 9C F4 FF FF E8 F7 FB FF FF 6A 40 8D 55 F0 A1 F0 ED 4B 00 8B 00 E8 42 2E F7 FF 8B 4D F0 B2 01 A1 F4 C2 40 00 E8 F7 20 F5 FF 8B F0 B2 01 A1 B4 C3 40 00 E8 F1 5B F4 FF 89 03 33 D2 8B 03 E8 42 1E F5 FF 66 B9 02 00 BA FC FF FF FF 8B C6 8B 38 FF 57 0C BA B8 A7 4D 00 B9 04 00 00 00 8B C6 8B 38 FF 57 04 83 3D B8 A7 4D 00 00 0F 84 5E 01 00 00 8B 15 B8 A7 4D 00 83 C2 04 F7 DA 66 B9 02 00 8B C6 8B 38 FF 57 0C 8B 0D B8 A7 4D 00 8B D6 8B 03 E8 2B 1F F5 FF 8B C6 E8 B4 5B F4 FF 33 D2 8B 03 E8 DF 1D F5 FF BA F0 44 4E 00 B9 01 00 00 00 8B 03 8B 30 FF 56 04 80 3D F0 44 4E 00 0A 75 3F BA B8 A7 4D 00 B9 04 00 00 00 8B 03 8B 30 FF 56 04 8B 15 B8 A7 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Petitev211
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 68 [4] 64 [6] 64 [6] 66 9C 60 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Petitev211
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 68 [4] 64 [6] 64 [6] 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Petitev212
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 6A 00 68 [4] 64 [6] 64 [6] 66 9C 60 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Petitev212
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 6A 00 68 [4] 64 [6] 64 [6] 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MaskPEV20yzkzero
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3 }

Detection condition:
$a0

Full rule:
rule MaskPEV20yzkzero
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 18 00 00 00 64 8B 18 83 C3 30 C3 40 3E 0F B6 00 C1 E0 ?? 83 C0 ?? 36 01 04 24 C3 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner01Morphine12Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01Morphine12Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EZIPv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EZIPv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 19 32 00 00 E9 7C 2A 00 00 E9 19 24 00 00 E9 FF 23 00 00 E9 1E 2E 00 00 E9 88 2E 00 00 E9 2C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: y0dasCrypterv12
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC [48] AA E2 CC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule y0dasCrypterv12
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC [48] AA E2 CC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ChinaProtectdummy
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C3 E8 [4] B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 56 8B [3] 6A 40 68 00 10 00 00 8D [2] 50 6A 00 E8 [4] 89 30 83 C0 04 5E C3 8B 44 [2] 56 8D [2] 68 00 40 00 00 FF 36 56 E8 [4] 68 00 80 00 00 6A 00 56 E8 [4] 5E C3 }

Detection condition:
$a0

Full rule:
rule ChinaProtectdummy
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C3 E8 [4] B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 B9 [4] E8 [4] FF 30 C3 56 8B [3] 6A 40 68 00 10 00 00 8D [2] 50 6A 00 E8 [4] 89 30 83 C0 04 5E C3 8B 44 [2] 56 8D [2] 68 00 40 00 00 FF 36 56 E8 [4] 68 00 80 00 00 6A 00 56 E8 [4] 5E C3 }

condition:
		$a0
}
YARA Detection Rule: BopCryptv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BD [4] E8 [2] 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BopCryptv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BD [4] E8 [2] 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MinkeV101Codius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73 }

Detection condition:
$a0

Full rule:
rule MinkeV101Codius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 26 3D 4F 38 C2 82 37 B8 F3 24 42 03 17 9B 3A 83 01 00 00 CC 00 00 00 00 06 00 00 00 01 64 53 74 75 62 00 10 55 54 79 70 65 73 00 00 C7 53 79 73 74 65 6D 00 00 81 53 79 73 49 6E 69 74 00 0C 4B 57 69 6E 64 6F 77 73 00 00 8A 75 46 75 6E 63 74 69 6F 6E 73 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner02BorlandDelphiDLLAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02BorlandDelphiDLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: bambam004bedrock
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF [4] 83 C9 FF 33 C0 68 [4] F2 AE F7 D1 49 51 68 [4] E8 11 0A 00 00 83 C4 0C 68 [4] FF 15 [4] 8B F0 BF [4] 83 C9 FF 33 C0 F2 AE F7 D1 49 BF [4] 8B D1 68 [4] C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF [4] 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 [4] E8 C0 09 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule bambam004bedrock
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF [4] 83 C9 FF 33 C0 68 [4] F2 AE F7 D1 49 51 68 [4] E8 11 0A 00 00 83 C4 0C 68 [4] FF 15 [4] 8B F0 BF [4] 83 C9 FF 33 C0 F2 AE F7 D1 49 BF [4] 8B D1 68 [4] C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF [4] 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 [4] E8 C0 09 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackFullEdition117DLLLZMAAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 [4] 6A 40 68 [4] 68 [4] 6A 00 FF 95 EB 09 00 00 89 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackFullEdition117DLLLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 [4] 6A 40 68 [4] 68 [4] 6A 00 FF 95 EB 09 00 00 89 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEtitev22
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 66 9C 60 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEtitev22
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 68 [4] 64 FF 35 [4] 64 89 25 [4] 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEtitev20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 66 9C 60 50 8B D8 03 ?? 68 54 BC [2] 6A ?? FF 50 18 8B CC 8D A0 54 BC [2] 8B C3 8D 90 E0 15 [2] 68 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEtitev20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 66 9C 60 50 8B D8 03 ?? 68 54 BC [2] 6A ?? FF 50 18 8B CC 8D A0 54 BC [2] 8B C3 8D 90 E0 15 [2] 68 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEtitev21
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 6A ?? 68 [4] 64 FF 35 [4] 64 89 25 [4] 66 9C 60 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEtitev21
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 6A ?? 68 [4] 64 FF 35 [4] 64 89 25 [4] 66 9C 60 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ElicenseSystemV4000ViaTechInc
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule ElicenseSystemV4000ViaTechInc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 63 79 62 00 65 6C 69 63 65 6E 34 30 2E 64 6C 6C 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: VProtectorV10Build20041213testvcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VProtectorV10Build20041213testvcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 1A 89 40 00 68 56 89 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Themida18xxOreansTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 [3] FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 }
	$a1 = { B8 [4] 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 [3] FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 [4] 03 C7 B9 [4] 03 CF EB 0A B8 [4] B9 [4] 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Themida18xxOreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 [3] FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 }
	$a1 = { B8 [4] 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 [3] FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 [4] 03 C7 B9 [4] 03 CF EB 0A B8 [4] B9 [4] 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: EXEJoinerv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 [4] 68 [4] 6A 00 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEJoinerv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 C6 00 5C 68 [4] 68 [4] 6A 00 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MicroJoiner11coban2k
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MicroJoiner11coban2k
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01FSG10Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01FSG10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov200b2200b3
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov200b2200b3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 00 F2 40 00 68 C4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}