deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MSLRHv032afakeUPX[PII_REDACTED]124emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeUPX[PII_REDACTED]124emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtBorlandDelphiMicrosoftVisualC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 [2] 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
	$a1 = { C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 [2] 77 EB 02 CD 20 5E EB 02 CD 20 2B F7 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 [2] 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
	$a1 = { C1 C8 10 EB 01 0F BF 03 74 66 77 C1 E9 1D 68 83 [2] 77 EB 02 CD 20 5E EB 02 CD 20 2B F7 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: VxHafen809
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 1C ?? 81 EE [2] 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 [3] 07 3D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxHafen809
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 1C ?? 81 EE [2] 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 [3] 07 3D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackFullEdition117LZMAAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF [10] 6A 40 68 [4] 68 [4] 6A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackFullEdition117LZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF [10] 6A 40 68 [4] 68 [4] 6A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01LTC13Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01LTC13Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ACProtectv141
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ACProtectv141
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 76 03 77 01 7B 74 03 75 01 78 47 87 EE E8 01 00 00 00 76 83 C4 04 85 EE EB 01 7F 85 F2 EB 01 79 0F 86 01 00 00 00 FC EB 01 78 79 02 87 F2 61 51 8F 05 19 38 01 01 60 EB 01 E9 E9 01 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: yodasProtectorV1031AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtectorV1031AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElock096tE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 59 E4 FF FF 00 00 00 00 00 00 00 [4] EE [2] 00 00 00 00 00 00 00 00 00 0E [2] 00 FE [2] 00 F6 [2] 00 00 00 00 00 00 00 00 00 1B [2] 00 06 [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 [2] 00 00 00 00 00 39 [2] 00 00 00 00 00 26 [2] 00 00 00 00 00 39 [2] 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElock096tE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 59 E4 FF FF 00 00 00 00 00 00 00 [4] EE [2] 00 00 00 00 00 00 00 00 00 0E [2] 00 FE [2] 00 F6 [2] 00 00 00 00 00 00 00 00 00 1B [2] 00 06 [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 [2] 00 00 00 00 00 39 [2] 00 00 00 00 00 26 [2] 00 00 00 00 00 39 [2] 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WerusCrypter10byKas
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WerusCrypter10byKas
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HEALTHv51byMuslimMPolyak
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E E8 [2] 2E 8C 06 [2] 2E 89 3E [2] 8B D7 B8 [2] CD 21 8B D8 0E 1F E8 [2] 06 57 A1 [2] 26 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HEALTHv51byMuslimMPolyak
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E E8 [2] 2E 8C 06 [2] 2E 89 3E [2] 8B D7 B8 [2] CD 21 8B D8 0E 1F E8 [2] 06 57 A1 [2] 26 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCGuardv303dv305d
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 50 E8 [4] 5D EB 01 E3 60 E8 03 [3] D2 EB 0B 58 EB 01 48 40 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCGuardv303dv305d
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 50 E8 [4] 5D EB 01 E3 60 E8 03 [3] D2 EB 0B 58 EB 01 48 40 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxNovember17768
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 81 EE [2] 50 33 C0 8E D8 80 3E [3] 0E 1F [2] FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxNovember17768
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 81 EE [2] 50 33 C0 8E D8 80 3E [3] 0E 1F [2] FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: BeRoTinyPascalBeRo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [4] 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BeRoTinyPascalBeRo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [4] 20 43 6F 6D 70 69 6C 65 64 20 62 79 3A 20 42 65 52 6F 54 69 6E 79 50 61 73 63 61 6C 20 2D 20 28 43 29 20 43 6F 70 79 72 69 67 68 74 20 32 30 30 36 2C 20 42 65 6E 6A 61 6D 69 6E 20 27 42 65 52 6F 27 20 52 6F 73 73 65 61 75 78 20 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PrivateexeProtector21522XSetiSoftTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule PrivateexeProtector21522XSetiSoftTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: Protectorv1111DDeMPEEnginev09DDeMCIv092
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Protectorv1111DDeMPEEnginev09DDeMCIv092
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01XCR011Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01XCR011Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B F0 33 DB 83 C3 01 83 C0 01 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Trivial173bySMTSMF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB [2] 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Trivial173bySMTSMF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB [2] 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectv11MTE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E9 [4] 91 78 79 79 79 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectv11MTE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 [4] 91 78 79 79 79 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WARNINGTROJANRobinPE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WARNINGTROJANRobinPE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 6A 00 6A 20 6A 02 6A 00 6A 03 68 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PiCryptor10byScofield
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 }
	$a1 = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 

Detection condition:
$a0 or $a1 at pe.entry_point or $a2

Full rule:
rule PiCryptor10byScofield
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 }
	$a1 = { 55 8B EC 83 C4 EC 53 56 57 31 C0 89 45 EC B8 40 1E 06 00 E8 48 FA FF FF 33 C0 55 68 36 1F 06 00 64 FF 30 64 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 31 C0 E8 4E F4 FF FF 8B 45 EC E8 F6 F7 FF FF 50 E8 CC FA FF FF 8B D8 83 FB FF 74 4E 6A 00 53 E8 CD FA FF FF 8B F8 81 EF AC 26 00 00 6A 00 6A 00 68 AC 26 00 00 53 E8 DE FA FF FF 89 F8 E8 E3 F1 FF FF 89 C6 6A 00 68 28 31 06 00 57 56 53 E8 AE FA FF FF 53 E8 80 FA FF FF 89 FA 81 EA 72 01 00 00 8B C6 E8 55 FE FF FF 89 C6 89 F0 09 C0 74 05 E8 A8 FB FF FF 31 C0 5A 59 59 64 89 10 68 3D 1F 06 00 8D 45 EC E8 C3 F6 FF FF C3 }
	$a2 = { 89 55 F8 BB 01 00 00 00 8A 04 1F 24 0F 8B 55 FC 8A 14 32 80 E2 0F 32 C2 8A 14 1F 80 E2 F0 02 D0 88 14 1F 46 8D 45 F4 8B 55 FC E8 [4] 8B 45 F4 E8 [4] 3B F0 7E 05 BE 01 00 00 00 43 FF 4D F8 75 C2 [4] 5A 59 59 64 89 10 68 [4] 8D 45 F4 E8 [4] C3 E9 }

condition:
		$a0 or $a1 at pe.entry_point or $a2
}
YARA Detection Rule: PseudoSigner02MacromediaFlashProjector60Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02MacromediaFlashProjector60Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakeWWPack321xemadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeWWPack321xemadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 61 66 61 6C 20 57 69 65 72 7A 62 69 63 6B 69 0D 0A 0D 0A 5D 5B 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEArmor07600765hying
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 [4] 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [12] 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule PEArmor07600765hying
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 [4] 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [12] 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 00 00 08 00 00 00 00 00 00 00 60 E8 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: PECryptv102
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] 5B 83 EB 05 EB 04 52 4E 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECryptv102
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 5B 83 EB 05 EB 04 52 4E 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ILUCRYPTv4015exe
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B EC FA C7 46 F7 [2] 42 81 FA [2] 75 F9 FF 66 F7 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ILUCRYPTv4015exe
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC FA C7 46 F7 [2] 42 81 FA [2] 75 F9 FF 66 F7 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NJoy13NEX
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NJoy13NEX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 48 36 40 00 E8 54 EE FF FF 6A 00 68 D8 2B 40 00 6A 0A 6A 00 E8 2C EF FF FF E8 23 E7 FF FF 8D 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VBOXv43v46
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 }
	$a1 = { 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 [2] 2B C5 48 [2] 0B C0 86 E0 8C E0 [2] 8C E0 86 E0 03 C4 40 }

Detection condition:
$a0 or $a1

Full rule:
rule VBOXv43v46
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 }
	$a1 = { 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 [2] 2B C5 48 [2] 0B C0 86 E0 8C E0 [2] 8C E0 86 E0 03 C4 40 }

condition:
		$a0 or $a1
}
YARA Detection Rule: CodeLockvxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CodeLockvxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CipherWallSelfExtratorDecryptorGUIv15
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CipherWallSelfExtratorDecryptorGUIv15
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 F9 89 C7 6A 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ARMProtectorv01bySMoKE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }

Detection condition:
$a0

Full rule:
rule ARMProtectorv01bySMoKE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 }

condition:
		$a0
}