deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: tElock098SpecialBuildforgotheXer
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 99 D7 FF FF 00 00 00 [4] AA [2] 00 00 00 00 00 00 00 00 00 CA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElock098SpecialBuildforgotheXer
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 99 D7 FF FF 00 00 00 [4] AA [2] 00 00 00 00 00 00 00 00 00 CA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01DEF10Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01DEF10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02REALBasicAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02REALBasicAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov260c
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 40 [3] 68 F4 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 6C [3] 33 D2 8A D4 89 15 F4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov260c
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 [3] 68 F4 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 6C [3] 33 D2 8A D4 89 15 F4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov260a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [4] 68 94 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 6C [3] 33 D2 8A D4 89 15 B4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov260a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] 68 94 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 6C [3] 33 D2 8A D4 89 15 B4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThemidaWinLicenseV10XV17XDLLOreansTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 60 0B C0 74 58 E8 00 00 00 00 58 05 [4] 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB [2] 66 83 [2] 66 39 18 75 12 0F B7 50 3C 03 D0 BB [4] 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 [4] 03 C7 B9 [4] 03 CF EB 0A B8 [4] B9 [4] 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D [4] B9 [4] C6 00 E9 83 E9 ?? 89 48 01 61 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThemidaWinLicenseV10XV17XDLLOreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 60 0B C0 74 58 E8 00 00 00 00 58 05 [4] 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB [2] 66 83 [2] 66 39 18 75 12 0F B7 50 3C 03 D0 BB [4] 83 C3 ?? 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 [4] 03 C7 B9 [4] 03 CF EB 0A B8 [4] B9 [4] 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D [4] B9 [4] C6 00 E9 83 E9 ?? 89 48 01 61 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressor12CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule eXPressor12CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NeoLitev10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 44 24 04 8D 54 24 FC 23 05 [4] E8 [4] FF 35 [4] 50 FF 25 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NeoLitev10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 44 24 04 8D 54 24 FC 23 05 [4] E8 [4] FF 35 [4] 50 FF 25 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeBundlev30standardloader
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeBundlev30standardloader
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ProtectionPlusvxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 60 29 C0 64 FF 30 E8 [4] 5D 83 ED 3C 89 E8 89 A5 14 [3] 2B 85 1C [3] 89 85 1C [3] 8D 85 27 03 [2] 50 8B ?? 85 C0 0F 85 C0 [3] 8D BD 5B 03 [2] 8D B5 43 03 [2] E8 DD [3] 89 85 1F 03 [2] 6A 40 68 ?? 10 [2] 8B 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ProtectionPlusvxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 60 29 C0 64 FF 30 E8 [4] 5D 83 ED 3C 89 E8 89 A5 14 [3] 2B 85 1C [3] 89 85 1C [3] 8D 85 27 03 [2] 50 8B ?? 85 C0 0F 85 C0 [3] 8D BD 5B 03 [2] 8D B5 43 03 [2] E8 DD [3] 89 85 1F 03 [2] 6A 40 68 ?? 10 [2] 8B 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptorV22Xsoftcompletecom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }

Detection condition:
$a0

Full rule:
rule EXECryptorV22Xsoftcompletecom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }

condition:
		$a0
}
YARA Detection Rule: ThinstallVirtualizationSuite30353043ThinstallCompany
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallVirtualizationSuite30353043ThinstallCompany
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01CrunchPEHeuristicAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 00 00 00 00 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01CrunchPEHeuristicAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv120EngdulekxtBorlandC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C1 F0 07 EB 02 CD 20 BE 80 [2] 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv120EngdulekxtBorlandC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 F0 07 EB 02 CD 20 BE 80 [2] 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEPACKv405v406
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8C C0 05 [2] 0E 1F A3 [2] 03 06 [2] 8E C0 8B 0E [2] 8B F9 4F 8B F7 FD F3 A4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEPACKv405v406
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C C0 05 [2] 0E 1F A3 [2] 03 06 [2] 8E C0 8B 0E [2] 8B F9 4F 8B F7 FD F3 A4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PeStubOEPv1x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 33 C9 33 D2 B8 [3] 00 B9 FF }
	$a1 = { E8 05 00 00 00 33 C0 40 48 C3 E8 05 }

Detection condition:
$a0 or $a1

Full rule:
rule PeStubOEPv1x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 33 C9 33 D2 B8 [3] 00 B9 FF }
	$a1 = { E8 05 00 00 00 33 C0 40 48 C3 E8 05 }

condition:
		$a0 or $a1
}
YARA Detection Rule: EXEShieldv01bv03bv03SMoKE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEShieldv01bv03bv03SMoKE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEArmor049Hying
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 56 52 51 53 55 E8 15 01 00 00 32 [2] 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEArmor049Hying
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 52 51 53 55 E8 15 01 00 00 32 [2] 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv14x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv14x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PocketPCSHA
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 [3] 00 [3] 00 [3] 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PocketPCSHA
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 [3] 00 [3] 00 [3] 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressorV1451CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 [2] 00 05 00 [2] 00 A3 08 [2] 00 A1 08 [2] 00 B9 81 [2] 00 2B 48 18 89 0D 0C [2] 00 83 3D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule eXPressorV1451CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 [2] 00 05 00 [2] 00 A3 08 [2] 00 A1 08 [2] 00 B9 81 [2] 00 2B 48 18 89 0D 0C [2] 00 83 3D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Thinstall25
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 [4] 81 75 04 [4] 81 75 08 [4] 81 75 0C [4] 81 75 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Thinstall25
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 [4] 81 75 04 [4] 81 75 08 [4] 81 75 0C [4] 81 75 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SuckStopv111
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB [3] BE [2] B4 30 CD 21 EB ?? 9B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SuckStopv111
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB [3] BE [2] B4 30 CD 21 EB ?? 9B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DEFv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 }
	$a1 = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3 }

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule DEFv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE ?? 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 }
	$a1 = { BE ?? 01 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? 10 40 00 C3 }

condition:
		$a0 at pe.entry_point or $a1
}
YARA Detection Rule: UnnamedScrambler251Beta2252p0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 [2] 40 00 E8 ?? EA FF FF 33 C0 55 68 [2] 40 00 64 FF 30 64 89 20 BA [2] 40 00 B8 [2] 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 [2] FF FF BA [2] 40 00 8B C3 8B 0D [2] 40 00 E8 [2] FF FF C7 05 [2] 40 00 0A 00 00 00 BB [2] 40 00 BE [2] 40 00 BF [2] 40 00 B8 [2] 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 [2] 40 00 8B 16 E8 ?? E1 FF FF B8 [2] 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 [2] FF FF 8B C7 A3 [2] 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 [2] 40 00 BA [2] 40 00 E8 8B ED FF FF 3C 01 75 2B A1 }

Detection condition:
$a0

Full rule:
rule UnnamedScrambler251Beta2252p0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 [2] 40 00 E8 ?? EA FF FF 33 C0 55 68 [2] 40 00 64 FF 30 64 89 20 BA [2] 40 00 B8 [2] 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 [2] FF FF BA [2] 40 00 8B C3 8B 0D [2] 40 00 E8 [2] FF FF C7 05 [2] 40 00 0A 00 00 00 BB [2] 40 00 BE [2] 40 00 BF [2] 40 00 B8 [2] 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 [2] 40 00 8B 16 E8 ?? E1 FF FF B8 [2] 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 [2] FF FF 8B C7 A3 [2] 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 [2] 40 00 BA [2] 40 00 E8 8B ED FF FF 3C 01 75 2B A1 }

condition:
		$a0
}
YARA Detection Rule: Crunchv40
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Crunchv40
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PrivateEXEProtector18SetiSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }

Detection condition:
$a0

Full rule:
rule PrivateEXEProtector18SetiSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner02Armadillo300Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02Armadillo300Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: hmimyssPEPack01hmimys
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule hmimyssPEPack01hmimys
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 83 ED 05 6A 00 FF 95 E1 0E 00 00 89 85 85 0E 00 00 8B 58 3C 03 D8 81 C3 F8 00 00 00 80 AD 89 0E 00 00 01 89 9D 63 0F 00 00 8B 4B 0C 03 8D 85 0E 00 00 8B 53 08 80 BD 89 0E 00 00 00 75 0C 03 8D 91 0E 00 00 2B 95 91 0E 00 00 89 8D 57 0F 00 00 89 95 5B 0F 00 00 8B 5B 10 89 9D 5F 0F 00 00 8B 9D 5F 0F 00 00 8B 85 57 0F 00 00 53 50 E8 B7 0B 00 00 89 85 73 0F 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 95 E9 0E 00 00 89 85 6B 0F 00 00 6A 04 68 00 10 00 00 68 D8 7C 00 00 6A 00 FF 95 E9 0E 00 00 89 85 6F 0F 00 00 8D 85 67 0F 00 00 8B 9D 73 0F 00 00 8B 8D 6B 0F 00 00 8B 95 5B 0F 00 00 83 EA 0E 8B B5 57 0F 00 00 83 C6 0E 8B BD 6F 0F 00 00 50 53 51 52 56 68 D8 7C 00 00 57 E8 01 01 00 00 8B 9D 57 0F 00 00 8B 03 3C 01 75 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv146
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv146
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 60 12 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02XCR011Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02XCR011Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEPACKLINKv360v364v365or50121
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8C C0 05 [2] 0E 1F A3 [2] 03 [3] 8E C0 8B [3] 8B ?? 4F 8B F7 FD F3 A4 50 B8 [2] 50 CB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEPACKLINKv360v364v365or50121
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C C0 05 [2] 0E 1F A3 [2] 03 [3] 8E C0 8B [3] 8B ?? 4F 8B F7 FD F3 A4 50 B8 [2] 50 CB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SpecialEXEPasswordProtectorv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SpecialEXEPasswordProtectorv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptor15Vaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 2C 24 4F 68 [4] FF 54 24 04 83 44 24 04 4F B8 [4] 3D [4] 74 06 80 30 [2] EB F3 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RCryptor15Vaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 2C 24 4F 68 [4] FF 54 24 04 83 44 24 04 4F B8 [4] 3D [4] 74 06 80 30 [2] EB F3 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeJoiner10Yoda
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeJoiner10Yoda
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }

condition:
		$a0 at pe.entry_point
}