deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: yzpack20UsAr
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 25 [4] 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD [4] FF 65 28 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yzpack20UsAr
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 25 [4] 61 87 CC 55 45 45 55 81 ED CA 00 00 00 55 A4 B3 02 FF 14 24 73 F8 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 1F B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3C AA EB DC FF 54 24 04 2B CB 75 0F FF 54 24 08 EB 27 AC D1 E8 74 30 13 C9 EB 1B 91 48 C1 E0 08 AC FF 54 24 08 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 99 BD [4] FF 65 28 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PasswordprotectormySMT
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] 5D 8B FD 81 [5] 81 [5] 83 [2] 89 [5] 8D [5] 8D [5] 46 80 [2] 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PasswordprotectormySMT
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 5D 8B FD 81 [5] 81 [5] 83 [2] 89 [5] 8D [5] 8D [5] 46 80 [2] 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ObsidiumV1258V133XObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 ?? E8 ?? 00 00 00 EB 02 [2] EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV1258V133XObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 ?? 00 00 00 EB 02 [2] EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ReflexiveArcadeWrapper
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ReflexiveArcadeWrapper
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 98 68 42 00 68 14 FA 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 F8 50 42 00 33 D2 8A D4 89 15 3C E8 42 00 8B C8 81 E1 FF 00 00 00 89 0D 38 E8 42 00 C1 E1 08 03 CA 89 0D 34 E8 42 00 C1 E8 10 A3 30 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxTrojanTelefoon
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxTrojanTelefoon
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv030betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [4] 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 [20] 30 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv030betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [4] 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 [20] 30 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxACMEClonewarMutant
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxACMEClonewarMutant
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov2xxCopyMemII
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A ?? 8B B5 [4] C1 E6 04 8B 85 [4] 25 07 [2] 80 79 05 48 83 C8 F8 40 33 C9 8A 88 [4] 8B 95 [4] 81 E2 07 [2] 80 79 05 4A 83 CA F8 42 33 C0 8A 82 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov2xxCopyMemII
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A ?? 8B B5 [4] C1 E6 04 8B 85 [4] 25 07 [2] 80 79 05 48 83 C8 F8 40 33 C9 8A 88 [4] 8B 95 [4] 81 E2 07 [2] 80 79 05 4A 83 CA F8 42 33 C0 8A 82 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: TPACKv05cm1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [2] FD 60 BE [2] BF [2] B9 [2] F3 A4 8B F7 BF [2] FC 46 E9 8E FE }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule TPACKv05cm1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [2] FD 60 BE [2] BF [2] B9 [2] F3 A4 8B F7 BF [2] FC 46 E9 8E FE }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEStealthv271
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEStealthv271
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED B0 27 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: TPACKv05cm2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [2] FD 60 BE [2] BF [2] B9 [2] F3 A4 8B F7 BF [2] FC 46 E9 CE FD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule TPACKv05cm2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [2] FD 60 BE [2] BF [2] B9 [2] F3 A4 8B F7 BF [2] FC 46 E9 CE FD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeJoiner10Yodaf2f
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeJoiner10Yodaf2f
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv101bAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv101bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED D2 2A 44 ?? B8 CC 2A 44 ?? 03 C5 2B 85 A5 2E 44 ?? 89 85 B1 2E 44 ?? 80 BD 9C 2E 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MacromediaWindowsFlashProjectorPlayerv30
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MacromediaWindowsFlashProjectorPlayerv30
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 44 56 FF 15 94 13 42 00 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E 06 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PESpinV11cyberbob
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESpinV11cyberbob
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPack118aPlib043ap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 [4] 68 [4] 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPack118aPlib043ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 [4] 68 [4] 6A 00 FF 95 A7 03 00 00 89 85 16 04 00 00 5B FF B5 16 04 00 00 56 FF D3 83 C4 ?? 8B B5 16 04 00 00 8B C6 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DotFixNiceProtectvna
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 [3] 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DotFixNiceProtectvna
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 [3] 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv032betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [4] 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 [20] 32 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv032betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [4] 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 [20] 32 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PackItBitch10archphase
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 28 [3] 35 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 [3] 50 [3] 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 [7] 79 [3] 7D [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule PackItBitch10archphase
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 28 [3] 35 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 41 [3] 50 [3] 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 [7] 79 [3] 7D [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: JDPack2xJDPack
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule JDPack2xJDPack
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RPolyCryptv10personalpolycryptorsignfrompinch
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RPolyCryptv10personalpolycryptorsignfrompinch
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv031betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [4] 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 [20] 31 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv031betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [4] 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 [20] 31 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Packmanv0001
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 58 8D A8 [2] FF FF 8D 98 [3] FF 8D [2] 01 00 00 [28] 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Packmanv0001
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 8D A8 [2] FF FF 8D 98 [3] FF 8D [2] 01 00 00 [28] 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01PEPack099Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PEPack099Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor239minimumprotection
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] E9 [3] FF 50 C1 C8 18 89 05 [4] C3 C1 C0 18 51 E9 [3] FF 84 C0 0F 84 6A F9 FF FF E9 [3] FF C3 E9 [3] FF E8 CF E9 FF FF B8 01 00 00 00 E9 [3] FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 [3] FF 84 C0 0F 84 8E EC FF FF E9 [3] FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 [3] FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A [4] E9 [3] FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 [3] FF E8 [3] FF 83 3D [4] 00 0F 85 [4] 8D 55 EC B8 [4] E9 [3] FF E8 A7 1A 00 00 E8 2A CB FF FF E9 [3] FF C3 E9 [3] FF 59 89 45 E0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptor239minimumprotection
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] E9 [3] FF 50 C1 C8 18 89 05 [4] C3 C1 C0 18 51 E9 [3] FF 84 C0 0F 84 6A F9 FF FF E9 [3] FF C3 E9 [3] FF E8 CF E9 FF FF B8 01 00 00 00 E9 [3] FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 [3] FF 84 C0 0F 84 8E EC FF FF E9 [3] FF C3 87 3C 24 5F 8B 00 03 45 FC 83 C0 18 E9 [3] FF 87 0C 24 59 B8 01 00 00 00 D3 E0 23 D0 E9 02 18 00 00 0F 8D DB 00 00 00 C1 E8 14 E9 CA 00 00 00 9D 87 0C 24 59 87 1C 24 68 AE 73 B9 96 E9 C5 10 00 00 0F 8A [4] E9 [3] FF 81 FD F5 FF 8F 07 E9 4F 10 00 00 C3 E9 5E 12 00 00 87 3C 24 E9 [3] FF E8 [3] FF 83 3D [4] 00 0F 85 [4] 8D 55 EC B8 [4] E9 [3] FF E8 A7 1A 00 00 E8 2A CB FF FF E9 [3] FF C3 E9 [3] FF 59 89 45 E0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMicrosoftVisualC60ASM
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B [2] FB C1 C1 03 33 F7 EB 02 CD 20 68 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMicrosoftVisualC60ASM
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B [2] FB C1 C1 03 33 F7 EB 02 CD 20 68 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HaspdongleAlladin
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 53 51 52 57 56 8B 75 1C 8B 3E [5] 8B 5D 08 8A FB [2] 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HaspdongleAlladin
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 53 51 52 57 56 8B 75 1C 8B 3E [5] 8B 5D 08 8A FB [2] 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF 32 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SafeDiscv4
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F }

Detection condition:
$a0

Full rule:
rule SafeDiscv4
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 42 6F 47 5F }

condition:
		$a0
}
YARA Detection Rule: PKLITEv112v115v1201
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] BA [2] 05 [2] 3B 06 [2] 73 ?? 2D [2] FA 8E D0 FB 2D [2] 8E C0 50 B9 [2] 33 FF 57 BE [2] FC F3 A5 CB B4 09 BA [2] CD 21 CD 20 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv112v115v1201
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 05 [2] 3B 06 [2] 73 ?? 2D [2] FA 8E D0 FB 2D [2] 8E C0 50 B9 [2] 33 FF 57 BE [2] FC F3 A5 CB B4 09 BA [2] CD 21 CD 20 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv112v115v1202
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] BA [2] 3B C4 73 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv112v115v1202
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 3B C4 73 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptorv153
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 [2] 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }

Detection condition:
$a0

Full rule:
rule EXECryptorv153
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 [2] 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }

condition:
		$a0
}
YARA Detection Rule: MSLRHv032afakeEXE32Pack13xemadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeEXE32Pack13xemadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC 56 3B D2 74 02 81 85 57 E8 00 00 00 00 3B DB 74 01 90 83 C4 14 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXpressorv11CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule eXpressorv11CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 15 13 00 00 E9 F0 12 00 00 E9 58 12 00 00 E9 AF 0C 00 00 E9 AE 02 00 00 E9 B4 0B 00 00 E9 E0 0C 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPackV11LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPackV11LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 57 84 40 00 2D 50 84 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PrivatePersonalPackerPPPv102ConquestOfTroycom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PrivatePersonalPackerPPPv102ConquestOfTroycom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxHorse1776
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5D 83 [2] 06 1E 26 [4] BF [2] 1E 0E 1F 8B F7 01 EE B9 [2] FC F3 A6 1F 1E 07 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxHorse1776
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5D 83 [2] 06 1E 26 [4] BF [2] 1E 0E 1F 8B F7 01 EE B9 [2] FC F3 A6 1F 1E 07 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEShit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] B9 [4] 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 [3] FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEShit: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] B9 [4] 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 [3] FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DrWebVirusFindingEngineInSoftEDVSysteme
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DrWebVirusFindingEngineInSoftEDVSysteme
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PluginToExev100BoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 [3] 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 [3] 00 FF D3 83 C4 10 FF 95 B0 40 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PluginToExev100BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 29 C0 5D 81 ED D1 40 40 00 50 FF 95 B8 40 40 00 89 85 09 40 40 00 FF 95 B4 40 40 00 89 85 11 40 40 00 50 FF 95 C0 40 40 00 8A 08 80 F9 22 75 07 50 FF 95 C4 40 40 00 89 85 0D 40 40 00 8B 9D 09 40 40 00 60 6A 00 6A 01 53 81 C3 [3] 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 0D 40 40 00 6A 00 81 C3 [3] 00 FF D3 83 C4 10 FF 95 B0 40 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptorv15PrivateVaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 2C 24 4F 68 [4] FF 54 24 04 83 44 24 04 4F B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RCryptorv15PrivateVaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 2C 24 4F 68 [4] FF 54 24 04 83 44 24 04 4F B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point
}