deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PESpinV071cyberbob
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESpinV071cyberbob
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: XHider10GlobaL
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 [2] 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 [2] 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 [2] 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00 }
	$a1 = { 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90 }

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule XHider10GlobaL
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 33 C0 89 45 EC B8 54 20 44 44 E8 DF F8 FF FF 33 C0 55 68 08 21 44 44 64 FF 30 64 89 20 8D 55 EC B8 1C 21 44 44 E8 E0 F9 FF FF 8B 55 EC B8 40 [2] 44 E8 8B F5 FF FF 6A 00 6A 00 6A 02 6A 00 6A 01 68 00 00 00 40 A1 40 [2] 44 E8 7E F6 FF FF 50 E8 4C F9 FF FF 6A 00 50 E8 4C F9 FF FF A3 28 [2] 44 E8 CE FE FF FF 33 C0 5A 59 59 64 89 10 68 0F 21 44 44 8D 45 EC E8 F1 F4 FF FF C3 E9 BB F2 FF FF EB F0 E8 FC F3 FF FF FF FF FF FF 0E 00 00 00 63 3A 5C 30 30 30 30 30 30 31 2E 64 61 74 00 }
	$a1 = { 85 D2 74 23 8B 4A F8 41 7F 1A 50 52 8B 42 FC E8 30 00 00 00 89 C2 58 52 8B 48 FC E8 48 FB FF FF 5A 58 EB 03 FF 42 F8 87 10 85 D2 74 13 8B 4A F8 49 7C 0D FF 4A F8 75 08 8D 42 F8 E8 5C FA FF FF C3 8D 40 00 85 C0 7E 24 50 83 C0 0A 83 E0 FE 50 E8 2F FA FF FF 5A 66 C7 44 02 FE 00 00 83 C0 08 5A 89 50 FC C7 40 F8 01 00 00 00 C3 31 C0 C3 90 }

condition:
		$a0 at pe.entry_point or $a1
}
YARA Detection Rule: PseudoSigner01MicrosoftVisualC70DLLAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 [4] E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01MicrosoftVisualC70DLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 [4] E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEShieldV05Smoke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
	$a1 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule EXEShieldV05Smoke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
	$a1 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: UnnamedScrambler25Ap0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00 }

Detection condition:
$a0

Full rule:
rule UnnamedScrambler25Ap0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 0B 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 6C 3E 40 00 E8 F7 EA FF FF 33 C0 55 68 60 44 40 00 64 FF 30 64 89 20 BA 70 44 40 00 B8 B8 6C 40 00 E8 62 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 A1 EB FF FF BA E8 64 40 00 8B C3 8B 0D B8 6C 40 00 E8 37 D3 FF FF C7 05 BC 6C 40 00 0A 00 00 00 BB 68 6C 40 00 BE 90 6C 40 00 BF E8 64 40 00 B8 C0 6C 40 00 BA 04 00 00 00 E8 07 EC FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 09 F3 FF FF 89 03 83 3B 00 0F 84 BB 04 00 00 B8 C0 6C 40 00 8B 16 E8 06 E2 FF FF B8 C0 6C 40 00 E8 24 E1 FF FF 8B D0 8B 03 8B 0E E8 D1 D2 FF FF 8B C7 A3 20 6E 40 00 8D 55 EC 33 C0 E8 0C D4 FF FF 8B 45 EC B9 1C 6E 40 00 BA 18 6E 40 00 }

condition:
		$a0
}
YARA Detection Rule: Armadillov177
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov177
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B0 71 40 00 68 6C 37 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxTrivial25
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxTrivial25
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 4E FE C6 CD 21 B8 ?? 3D BA ?? 00 CD 21 93 B4 40 CD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov171
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [4] 68 [4] 64 A1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov171
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] 68 [4] 64 A1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: KBySV022shoooo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 [4] E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule KBySV022shoooo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 [4] E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: InnoSetupModule
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43 }
	$a1 = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF }

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule InnoSetupModule
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 49 6E 6E 6F 53 65 74 75 70 4C 64 72 57 69 6E 64 6F 77 00 00 53 54 41 54 49 43 }
	$a1 = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 ?? 89 45 ?? E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF E8 [2] FF FF }

condition:
		$a0 at pe.entry_point or $a1
}
YARA Detection Rule: piritv15
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5B 24 55 50 44 FB 32 2E 31 5D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule piritv15
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 24 55 50 44 FB 32 2E 31 5D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftSentryv30
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftSentryv30
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EncryptPEV22007411WFS
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EncryptPEV22007411WFS
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov19x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 98 [3] 68 10 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov19x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 98 [3] 68 10 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov285
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 68 [3] 68 [4] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 28 [3] 33 D2 8A D4 89 15 24 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov285
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 68 [3] 68 [4] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 28 [3] 33 D2 8A D4 89 15 24 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectvxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 [5] 90 5D [11] 03 DD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectvxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 [5] 90 5D [11] 03 DD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeShieldv17
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeShieldv17
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 90 1F 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Splasherv10v30
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 8B 44 24 24 E8 [4] 5D 81 ED [4] 50 E8 ED 02 [2] 8C C0 0F 84 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Splasherv10v30
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 8B 44 24 24 E8 [4] 5D 81 ED [4] 50 E8 ED 02 [2] 8C C0 0F 84 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeCryptor01build002GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 [2] 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }

Detection condition:
$a0

Full rule:
rule FreeCryptor01build002GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 [2] 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }

condition:
		$a0
}
YARA Detection Rule: EXEShieldV06SMoKE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
	$a1 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule EXEShieldV06SMoKE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
	$a1 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02MicrosoftVisualBasic5060Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02MicrosoftVisualBasic5060Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPack118DllLZMA430ap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 9F 01 00 00 6A ?? 68 [4] 68 [4] 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 [4] 68 [4] 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPack118DllLZMA430ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 ?? 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 9F 01 00 00 6A ?? 68 [4] 68 [4] 6A ?? FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 83 BD 0D 0B 00 00 00 74 0E 83 BD 11 0B 00 00 00 74 05 E8 F6 01 00 00 8D 74 37 04 53 6A ?? 68 [4] 68 [4] 6A ?? FF 95 AA 0A 00 00 89 85 1D 0B 00 00 5B 60 FF B5 F9 0A 00 00 56 FF B5 1D 0B 00 00 FF D3 61 8B B5 1D 0B 00 00 8B C6 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv100v103
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] BA [2] 8C DB 03 D8 3B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv100v103
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 8C DB 03 D8 3B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Shrinkerv34
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 3D B4 [4] 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 [3] 85 F6 74 23 83 7D 0C 03 77 1D 68 FF }
	$a1 = { BB [2] BA [2] 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Shrinkerv34
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D B4 [4] 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 [3] 85 F6 74 23 83 7D 0C 03 77 1D 68 FF }
	$a1 = { BB [2] BA [2] 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: Shrinkerv32
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 3D [5] 55 8B EC 56 57 75 65 68 00 01 [2] E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 [4] 85 F6 74 1D 68 FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Shrinkerv32
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D [5] 55 8B EC 56 57 75 65 68 00 01 [2] E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 [4] 85 F6 74 1D 68 FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Shrinkerv33
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 3D [3] 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Shrinkerv33
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D [3] 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01JDPack1xJDProtect09Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01JDPack1xJDProtect09Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upack024027beta028alphaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upack024027beta028alphaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01LocklessIntroPackAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01LocklessIntroPackAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov250b3
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 B8 [3] 68 F8 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 20 [3] 33 D2 8A D4 89 15 D0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov250b3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B8 [3] 68 F8 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 20 [3] 33 D2 8A D4 89 15 D0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEBundlev02v20x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB [2] 40 ?? 87 DD 6A 04 68 ?? 10 [2] 68 ?? 02 [2] 6A ?? FF 95 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEBundlev02v20x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB [2] 40 ?? 87 DD 6A 04 68 ?? 10 [2] 68 ?? 02 [2] 6A ?? FF 95 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftProtectwwwsoftprotectbyru
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] 8D [5] C7 00 00 00 00 00 E8 [4] E8 [4] 8D [5] 50 E8 [4] 83 [5] 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftProtectwwwsoftprotectbyru
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 8D [5] C7 00 00 00 00 00 E8 [4] E8 [4] 8D [5] 50 E8 [4] 83 [5] 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NTPackerV2XErazerZ
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00 }

Detection condition:
$a0

Full rule:
rule NTPackerV2XErazerZ
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4B 57 69 6E 64 6F 77 73 00 10 55 54 79 70 65 73 00 00 3F 75 6E 74 4D 61 69 6E 46 75 6E 63 74 69 6F 6E 73 00 00 47 75 6E 74 42 79 70 61 73 73 00 00 B7 61 50 4C 69 62 75 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: SiliconRealmsInstallStub
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 ?? 92 40 00 68 [2] 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 [2] 40 00 33 D2 8A D4 89 15 [2] 40 00 8B C8 81 E1 FF 00 00 00 89 0D [2] 40 00 C1 E1 08 03 CA 89 0D [2] 40 00 C1 E8 10 A3 }

Detection condition:
$a0

Full rule:
rule SiliconRealmsInstallStub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 ?? 92 40 00 68 [2] 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 [2] 40 00 33 D2 8A D4 89 15 [2] 40 00 8B C8 81 E1 FF 00 00 00 89 0D [2] 40 00 C1 E1 08 03 CA 89 0D [2] 40 00 C1 E8 10 A3 }

condition:
		$a0
}