deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ExeToolsCOM2EXE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5D 83 ED ?? 8C DA 2E 89 96 [2] 83 C2 ?? 8E DA 8E C2 2E 01 96 [2] 60 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeToolsCOM2EXE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5D 83 ED ?? 8C DA 2E 89 96 [2] 83 C2 ?? 8E DA 8E C2 2E 01 96 [2] 60 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThinstallEmbedded2545Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 F2 FF FF FF 50 68 [4] 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded2545Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F2 FF FF FF 50 68 [4] 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxARCV4
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxARCV4
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillo3X5XSiliconRealmsToolworks
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillo3X5XSiliconRealmsToolworks
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakePESHiELD025emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakePESHiELD025emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov252beta2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [4] B0 [4] 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF [3] 15 24 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov252beta2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] B0 [4] 68 60 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF [3] 15 24 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CipherWallSelfExtratorDecryptorConsolev15
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CipherWallSelfExtratorDecryptorConsolev15
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 61 BE 00 10 42 00 8D BE 00 00 FE FF C7 87 C0 20 02 00 0B 6E 5B 9B 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCShrinkerv029
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BD [4] 01 AD 55 39 40 ?? 8D B5 35 39 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCShrinkerv029
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BD [4] 01 AD 55 39 40 ?? 8D B5 35 39 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPacKV33LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [4] 80 38 00 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPacKV33LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [4] 80 38 00 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CopyMinderMicrocosmLtd
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 25 [4] EF 6A 00 E8 [4] E8 [4] CC FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CopyMinderMicrocosmLtd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 25 [4] EF 6A 00 E8 [4] E8 [4] CC FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 [4] FF 25 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Crunchv5BitArts
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Crunchv5BitArts
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCShrinkerv020
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 E8 01 [2] 60 01 AD B3 27 40 ?? 68 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCShrinkerv020
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 E8 01 [2] 60 01 AD B3 27 40 ?? 68 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillo500SiliconRealmsToolworks
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 [4] E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D [4] 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 [4] 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 [4] FF 15 [4] 8B D8 3B DF 75 4C 39 3D [4] 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillo500SiliconRealmsToolworks
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 [4] E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D [4] 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 [4] 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 [4] FF 15 [4] 8B D8 3B DF 75 4C 39 3D [4] 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SLVc0deProtector060SLVICU
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }

Detection condition:
$a0

Full rule:
rule SLVc0deProtector060SLVICU
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }

condition:
		$a0
}
YARA Detection Rule: Kryptonv03
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Kryptonv03
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 0C 24 E9 C0 8D 01 ?? C1 3A 6E CA 5D 7E 79 6D B3 64 5A 71 EA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrackStopv101cStefanEsser1997
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrackStopv101cStefanEsser1997
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Kryptonv05
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 54 E8 [4] 5D 8B C5 81 ED 71 44 [2] 2B 85 64 60 [2] EB 43 DF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Kryptonv05
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 [4] 5D 8B C5 81 ED 71 44 [2] 2B 85 64 60 [2] EB 43 DF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Kryptonv04
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 54 E8 [4] 5D 8B C5 81 ED 61 34 [2] 2B 85 60 37 [2] 83 E8 06 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Kryptonv04
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 [4] 5D 8B C5 81 ED 61 34 [2] 2B 85 60 37 [2] 83 E8 06 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PassLock2000v10EngMoonlightSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PassLock2000v10EngMoonlightSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv029Betav031BetaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 88 01 [2] AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }

Detection condition:
$a0

Full rule:
rule Upackv029Betav031BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 [2] AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }

condition:
		$a0
}
YARA Detection Rule: AlexProtector10beta2byAlex
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 }

Detection condition:
$a0

Full rule:
rule AlexProtector10beta2byAlex
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B 44 24 0C EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 83 80 B8 00 00 00 02 33 C0 EB 01 E9 C3 58 83 C4 04 EB 03 EB 03 C7 EB FB E8 01 00 00 00 A8 83 C4 04 50 64 FF 35 00 00 00 00 64 89 25 }

condition:
		$a0
}
YARA Detection Rule: MoleBoxv254Teggo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 8B 4D F0 8B 11 89 15 [3] 00 8B 45 FC A3 [3] 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 [2] 00 00 6A 00 FF 15 [3] 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC }

Detection condition:
$a0

Full rule:
rule MoleBoxv254Teggo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 8B 4D F0 8B 11 89 15 [3] 00 8B 45 FC A3 [3] 00 5F 5E 8B E5 5D C3 CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 24 61 58 58 FF D0 E8 [2] 00 00 6A 00 FF 15 [3] 00 CC CC CC CC CC CC CC CC CC CC CC CC CC CC }

condition:
		$a0
}
YARA Detection Rule: Obsidium1337ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 2C 00 00 00 EB 04 [4] EB 04 [4] 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 27 EB 04 [4] 33 C0 EB 02 [2] C3 EB 02 [2] EB 03 [3] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 03 [3] EB 01 ?? 50 EB 02 [2] 33 C0 EB 02 [2] 8B 00 EB 04 [4] C3 EB 02 [2] E9 FA 00 00 00 EB 04 [4] E8 D5 FF FF FF EB 02 [2] EB 04 [4] 58 EB 04 [4] EB 03 [3] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 [3] E8 23 27 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1337ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 2C 00 00 00 EB 04 [4] EB 04 [4] 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 27 EB 04 [4] 33 C0 EB 02 [2] C3 EB 02 [2] EB 03 [3] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 03 [3] EB 01 ?? 50 EB 02 [2] 33 C0 EB 02 [2] 8B 00 EB 04 [4] C3 EB 02 [2] E9 FA 00 00 00 EB 04 [4] E8 D5 FF FF FF EB 02 [2] EB 04 [4] 58 EB 04 [4] EB 03 [3] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 [3] E8 23 27 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PESpinv03Engcyberbob
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 }
	$a1 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule PESpinv03Engcyberbob
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 }
	$a1 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02PEPack099Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02PEPack099Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxVCL
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxVCL
{
      meta:
		author="malware-lu"
strings:
		$a0 = { AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VterminalV10XLeiPeng
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 58 05 [4] 9C 50 C2 04 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VterminalV10XLeiPeng
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 05 [4] 9C 50 C2 04 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEEncrypt10Liwuyue
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEEncrypt10Liwuyue
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D 0F 05 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 5D EC 8B 41 18 8B C8 49 85 C9 72 5A 41 33 C0 8B D8 C1 E3 02 03 DA 8B 3B 03 3E 81 3F 47 65 74 50 75 40 8B DF 83 C3 04 81 3B 72 6F 63 41 75 33 8B DF 83 C3 08 81 3B 64 64 72 65 75 26 83 C7 0C 66 81 3F 73 73 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: InstallAnywhere61ZeroGSoftwareInc
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
	$a1 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule InstallAnywhere61ZeroGSoftwareInc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
	$a1 = { 60 BE 00 A0 42 00 8D BE 00 70 FD FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: iLUCRYPTv4018exe
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B EC FA C7 [4] 4C 4C C3 FB BF [2] B8 [2] 2E [2] D1 C8 4F 81 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule iLUCRYPTv4018exe
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC FA C7 [4] 4C 4C C3 FB BF [2] B8 [2] 2E [2] D1 C8 4F 81 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02ASProtectAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02ASProtectAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EncryptPEV22006710WFS
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 }
	$a1 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule EncryptPEV22006710WFS
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 }
	$a1 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}