deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: nPack113002006BetaNEOx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 3D [5] 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 [4] 2B 05 [4] A3 [4] E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 [4] C7 05 [8] 01 05 [4] FF 35 [4] C3 C3 56 57 68 [4] FF 15 [4] 8B 35 [4] 8B F8 68 [4] 57 FF D6 68 [4] 57 A3 [4] FF D6 5F A3 [4] 5E C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule nPack113002006BetaNEOx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D [5] 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 [4] 2B 05 [4] A3 [4] E8 9C 00 00 00 E8 2D 02 00 00 E8 DD 06 00 00 E8 2C 06 00 00 A1 [4] C7 05 [8] 01 05 [4] FF 35 [4] C3 C3 56 57 68 [4] FF 15 [4] 8B 35 [4] 8B F8 68 [4] 57 FF D6 68 [4] 57 A3 [4] FF D6 5F A3 [4] 5E C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02BorlandC1999Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 [4] A3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02BorlandC1999Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 [4] A3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv100bAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv100bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SEAAXEv22
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC BC [2] 0E 1F A3 [2] E8 [2] A1 [2] 8B [3] 2B C3 8E C0 B1 03 D3 E3 8B CB BF [2] 8B F7 F3 A5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SEAAXEv22
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC BC [2] 0E 1F A3 [2] E8 [2] A1 [2] 8B [3] 2B C3 8E C0 B1 03 D3 E3 8B CB BF [2] 8B F7 F3 A5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PureBasic4xDLLNeilHodgson
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 [3] 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PureBasic4xDLLNeilHodgson
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 [3] 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEPackerv70byTurboPowerSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E 06 8C C3 83 [2] 2E [4] B9 [2] 8C C8 8E D8 8B F1 4E 8B FE }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEPackerv70byTurboPowerSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C3 83 [2] 2E [4] B9 [2] 8C C8 8E D8 8B F1 4E 8B FE }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxSYP
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxSYP
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DSHIELD
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 06 E8 [2] 5E 83 EE ?? 16 17 9C 58 B9 [2] 25 [2] 2E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DSHIELD: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 E8 [2] 5E 83 EE ?? 16 17 9C 58 B9 [2] 25 [2] 2E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: kkrunchy023alphaRyd
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BD 08 [2] 00 C7 45 00 [3] 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF [3] 00 57 BE [3] 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE [3] 00 BB [3] 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule kkrunchy023alphaRyd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BD 08 [2] 00 C7 45 00 [3] 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF [3] 00 57 BE [3] 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 8D 9D A0 08 00 00 E8 ?? 00 00 00 8B 45 10 EB 42 8D 9D A0 04 00 00 E8 ?? 00 00 00 49 49 78 40 8D 5D 20 74 03 83 C3 40 31 D2 42 E8 ?? 00 00 00 8D 0C 48 F6 C2 10 74 F3 41 91 8D 9D A0 08 00 00 E8 ?? 00 00 00 3D 00 08 00 00 83 D9 FF 83 F8 60 83 D9 FF 89 45 10 56 89 FE 29 C6 F3 A4 5E EB 90 BE [3] 00 BB [3] 00 55 46 AD 85 C0 74 ?? 97 56 FF 13 85 C0 74 16 95 AC 84 C0 75 FB 38 06 74 E8 78 ?? 56 55 FF 53 04 AB 85 C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NJoy12NEX
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NJoy12NEX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 A4 32 40 00 E8 E8 F1 FF FF 6A 00 68 54 2A 40 00 6A 0A 6A 00 E8 A8 F2 FF FF E8 C7 EA FF FF 8D 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AntiDote12DemoSISTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B }

Detection condition:
$a0

Full rule:
rule AntiDote12DemoSISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 61 0F 1D 1D 2A 01 87 35 4C 07 39 0B }

condition:
		$a0
}
YARA Detection Rule: EXE32Packv137
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC [4] 02 81 [7] 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXE32Packv137
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC [4] 02 81 [7] 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXE32Packv136
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC [4] 02 81 [7] 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXE32Packv136
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC [4] 02 81 [7] 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AINEXEv230
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0E 07 B9 [2] BE [2] 33 FF FC F3 A4 A1 [2] 2D [2] 8E D0 BC [2] 8C D8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AINEXEv230
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 07 B9 [2] BE [2] 33 FF FC F3 A4 A1 [2] 2D [2] 8E D0 BC [2] 8C D8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThinstallEmbedded20XJitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 EF BE AD DE 50 6A 00 FF 15 [4] E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded20XJitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 EF BE AD DE 50 6A 00 FF 15 [4] E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptorv151x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 24 [3] 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 [7] 31 C0 89 41 14 89 41 18 80 A1 C1 [3] FE C3 31 C0 64 FF 30 64 89 20 CC C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptorv151x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 [3] 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 [7] 31 C0 89 41 14 89 41 18 80 A1 C1 [3] FE C3 31 C0 64 FF 30 64 89 20 CC C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidiumv1304ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
	$a1 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 [2] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 03 [3] EB 04 [4] 58 EB 02 [2] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 01 ?? E8 3B 26 00 00 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Obsidiumv1304ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
	$a1 = { EB 02 [2] E8 25 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 [2] C3 EB 02 [2] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 [2] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 03 [3] EB 04 [4] 58 EB 02 [2] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 01 ?? E8 3B 26 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: CopyProtectorv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2E A2 [2] 53 51 52 1E 06 B4 ?? 1E 0E 1F BA [2] CD 21 1F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CopyProtectorv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E A2 [2] 53 51 52 1E 06 B4 ?? 1E 0E 1F BA [2] CD 21 1F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXE32Packv139
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC [4] 02 81 [7] 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXE32Packv139
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC [4] 02 81 [7] 3B DB 74 01 BE 5D 8B D5 81 ED EC 8D 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXE32Packv138
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC [4] 02 81 [7] 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXE32Packv138
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC [4] 02 81 [7] 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtBorlandC1999
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 CD 20 2B C8 68 80 [2] 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtBorlandC1999
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 CD 20 2B C8 68 80 [2] 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThinstallEmbedded2547V2600Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 [4] 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded2547V2600Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 [4] 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv131Engdulekxt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE [3] 00 53 BB [3] 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv131Engdulekxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE [3] 00 53 BB [3] 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SDProtectorBasicProEdition110RandyLi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SDProtectorBasicProEdition110RandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Petite12c1998IanLuck
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Petite12c1998IanLuck
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PcSharev40
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PcSharev40
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 90 34 40 00 68 B6 28 40 00 64 A1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VProtector0X12Xvcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F [10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }

Detection condition:
$a0

Full rule:
rule VProtector0X12Xvcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 76 63 61 73 6D 5F 70 72 6F 74 65 63 74 5F [10] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 EB 01 0F 31 F0 EB 0C 33 C8 EB 03 EB 09 0F 59 74 05 75 F8 51 EB F1 B9 04 00 00 00 E8 1F 00 00 00 EB FA E8 16 00 00 00 E9 EB F8 00 00 58 EB 09 0F 25 E8 F2 FF FF FF 0F B9 49 75 F1 EB 05 EB F9 EB F0 D6 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 C0 02 EB 01 E9 50 C3 }

condition:
		$a0
}
YARA Detection Rule: STNPEE113
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule STNPEE113
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftDefenderV11xRandyLi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftDefenderV11xRandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CDCopsII
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 60 BD [4] 8D 45 ?? 8D 5D ?? E8 [4] 8D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CDCopsII
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 60 BD [4] 8D 45 ?? 8D 5D ?? E8 [4] 8D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPack11BasicEditionap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPack11BasicEditionap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXE32Packv13x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 [5] 02 81 [2] E8 [4] 3B 74 01 ?? 5D 8B D5 81 ED }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXE32Packv13x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 3B ?? 74 02 81 83 55 3B ?? 74 02 81 ?? 53 3B ?? 74 01 [5] 02 81 [2] E8 [4] 3B 74 01 ?? 5D 8B D5 81 ED }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxInvoluntary1349
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BA [2] B9 [2] 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC [2] AD ?? 33 C2 AB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxInvoluntary1349
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA [2] B9 [2] 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC [2] AD ?? 33 C2 AB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WinZip32bit6x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WinZip32bit6x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 15 FC 81 40 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPacKV36LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D [5] 83 38 01 0F 84 47 02 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPacKV36LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D [5] 83 38 01 0F 84 47 02 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02LCCWin321xAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 [4] 68 9A 10 40 90 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02LCCWin321xAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 [4] 68 9A 10 40 90 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECrypt10ReBirth
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECrypt10ReBirth
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NJoy11NEX
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NJoy11NEX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 0C 3C 40 00 E8 24 FC FF FF 6A 00 68 28 3A 40 00 6A 0A 6A 00 E8 D8 FC FF FF E8 7F F5 FF FF 8D 40 00 }

condition:
		$a0 at pe.entry_point
}