deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ASProtectSKE21xexeAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [3] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule ASProtectSKE21xexeAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [3] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: DBPEv210DingBoy
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 20 [32] 9C 55 57 56 52 51 53 9C E8 [4] 5D 81 ED [4] EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DBPEv210DingBoy
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 20 [32] 9C 55 57 56 52 51 53 9C E8 [4] 5D 81 ED [4] EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPacKV37LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D [4] ?? 80 39 01 0F [3] 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPacKV37LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D [4] ?? 80 39 01 0F [3] 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElock099tE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 5E DF FF FF 00 00 00 [4] E5 [2] 00 00 00 00 00 00 00 00 00 05 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElock099tE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5E DF FF FF 00 00 00 [4] E5 [2] 00 00 00 00 00 00 00 00 00 05 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WinZipSelfExtractor22personaleditionWinZipComputing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WinZipSelfExtractor22personaleditionWinZipComputing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 FF 15 58 70 40 00 B3 22 38 18 74 03 80 C3 FE 40 33 D2 8A 08 3A CA 74 10 3A CB 74 07 40 8A 08 3A CA 75 F5 38 10 74 01 40 52 50 52 52 FF 15 5C 70 40 00 50 E8 15 FB FF FF 50 FF 15 8C 70 40 00 5B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ZipWorxSecureEXEv25ZipWORXTechnologiesLLC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 B8 00 00 00 [12] 00 00 00 00 00 [10] 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ZipWorxSecureEXEv25ZipWORXTechnologiesLLC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 B8 00 00 00 [12] 00 00 00 00 00 [10] 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackFullEdition117iBoxaPLibAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF [15] EB 0F FF 74 37 04 FF 34 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackFullEdition117iBoxaPLibAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF [15] EB 0F FF 74 37 04 FF 34 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Alloyv1x2000
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 [2] 68 ?? 02 [2] 6A ?? FF 95 46 23 40 ?? 0B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Alloyv1x2000
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 [2] 68 ?? 02 [2] 6A ?? FF 95 46 23 40 ?? 0B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeJoiner153Stubengine171GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FreeJoiner153Stubengine171GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 02 FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A8 10 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02MicrosoftVisualC70DLLAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02MicrosoftVisualC70DLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EYouDiDaiYueHeiFengGao
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B8 [4] E8 [4] 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 [4] 0F 6E C0 B8 [4] 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 [5] FF E0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EYouDiDaiYueHeiFengGao
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 [4] E8 [4] 53 56 57 0F 31 8B D8 0F 31 8B D0 2B D3 C1 EA 10 B8 [4] 0F 6E C0 B8 [4] 0F 6E C8 0F F5 C1 0F 7E C0 0F 77 03 C2 [5] FF E0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptorV21Xsoftcompletecom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
	$a1 = { E9 [4] 66 9C 60 50 8D 88 [4] 8D 90 04 16 [2] 8B DC 8B E1 }

Detection condition:
$a0 or $a1 at pe.entry_point

Full rule:
rule EXECryptorV21Xsoftcompletecom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
	$a1 = { E9 [4] 66 9C 60 50 8D 88 [4] 8D 90 04 16 [2] 8B DC 8B E1 }

condition:
		$a0 or $a1 at pe.entry_point
}
YARA Detection Rule: PCShrinkerv045
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BD [4] 01 AD E3 38 40 ?? FF B5 DF 38 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCShrinkerv045
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BD [4] 01 AD E3 38 40 ?? FF B5 DF 38 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: yodasProtectorV1033AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtectorV1033AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2D E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED 07 E2 40 00 8B D5 81 C2 56 E2 40 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftSentryv211
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC ?? 53 56 57 E9 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftSentryv211
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC ?? 53 56 57 E9 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv120EngdulekxtBorlandDelphiBorlandC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 [2] 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv120EngdulekxtBorlandDelphiBorlandC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 [2] 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakeStonesPEEncryptor20FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeStonesPEEncryptor20FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 00 FF 95 32 35 40 00 B8 37 30 40 00 03 C5 2B 85 1B 34 40 00 89 85 27 34 40 00 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov300
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov300
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptorv11Vaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 04 24 83 E8 4F 68 [4] FF D0 }
	$a1 = { 8B 04 24 83 E8 4F 68 [4] FF D0 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a0 or $a1

Full rule:
rule RCryptorv11Vaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 83 E8 4F 68 [4] FF D0 }
	$a1 = { 8B 04 24 83 E8 4F 68 [4] FF D0 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 or $a1
}
YARA Detection Rule: Fusion10jaNooNi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Fusion10jaNooNi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 04 30 40 00 68 04 30 40 00 E8 09 03 00 00 68 04 30 40 00 E8 C7 02 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UpxLock1012CyberDoomTeamXBoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UpxLock1012CyberDoomTeamXBoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCPEEncryptorAlphapreview
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCPEEncryptorAlphapreview
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxKeypress1212
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] E8 [2] E8 [2] E8 [4] E8 [4] E8 [4] EA [4] 1E 33 DB 8E DB BB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxKeypress1212
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] E8 [2] E8 [2] E8 [4] E8 [4] E8 [4] EA [4] 1E 33 DB 8E DB BB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftwareCompressv12BGSoftwareProtectTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftwareCompressv12BGSoftwareProtectTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPackV14LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPackV14LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B1 85 40 00 2D AA 85 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VProtectorV11Avcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VProtectorV11Avcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium1300ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 04 [4] E8 29 00 00 00 EB 02 [2] EB 01 ?? 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 22 EB 02 [2] 33 C0 EB 04 [4] C3 EB 04 [4] EB 04 [4] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 04 [4] EB 01 ?? 50 EB 03 [3] 33 C0 EB 02 [2] 8B 00 EB 01 ?? C3 EB 04 [4] E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 [2] EB 03 [3] 58 EB 04 [4] EB 01 ?? 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 02 [2] E8 47 26 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1300ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 [4] E8 29 00 00 00 EB 02 [2] EB 01 ?? 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 22 EB 02 [2] 33 C0 EB 04 [4] C3 EB 04 [4] EB 04 [4] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 04 [4] EB 01 ?? 50 EB 03 [3] 33 C0 EB 02 [2] 8B 00 EB 01 ?? C3 EB 04 [4] E9 FA 00 00 00 EB 01 ?? E8 D5 FF FF FF EB 02 [2] EB 03 [3] 58 EB 04 [4] EB 01 ?? 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 02 [2] E8 47 26 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: XXPack01bagie
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 [3] C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule XXPack01bagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 00 68 00 [3] C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeLocker10IonIce
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeLocker10IonIce
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: yodasProtectorV101AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtectorV101AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED D5 E4 41 00 8B D5 81 C2 23 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv2001AlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 72 05 00 00 EB 4C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv2001AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 72 05 00 00 EB 4C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: USERNAMEv300
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FB 2E [4] 2E [4] 2E [4] 2E [4] 8C C8 2B C1 8B C8 2E [4] 2E [4] 33 C0 8E D8 06 0E 07 FC 33 F6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule USERNAMEv300
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FB 2E [4] 2E [4] 2E [4] 2E [4] 8C C8 2B C1 8B C8 2E [4] 2E [4] 33 C0 8E D8 06 0E 07 FC 33 F6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: nSpackV2xLiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }

Detection condition:
$a0

Full rule:
rule nSpackV2xLiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }

condition:
		$a0
}
YARA Detection Rule: GameGuardv20065xxdllsignbyhot_UNP
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule GameGuardv20065xxdllsignbyhot_UNP
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 31 FF 74 06 61 E9 4A 4D 50 30 BA 4C 00 00 00 80 7C 24 08 01 0F 85 ?? 01 00 00 60 BE 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upack_PatchoranyVersionDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 09 00 00 00 [3] 00 E9 06 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upack_PatchoranyVersionDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 09 00 00 00 [3] 00 E9 06 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCPECalpha
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 51 52 56 57 55 E8 [4] 5D 8B CD 81 [4] ?? 2B [4] ?? 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCPECalpha
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 [4] 5D 8B CD 81 [4] ?? 2B [4] ?? 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv305c4Unextractable
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 05 00 1B B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv305c4Unextractable
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 00 1B B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Escargot01finalMeat
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 04 40 30 2E 31 60 68 61 [3] 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 [3] 8B 00 FF D0 50 B8 CD [3] 81 38 DE C0 37 13 75 2D 68 C9 [3] 6A 40 68 00 ?? 00 00 68 00 00 [2] B8 96 [3] 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 [2] B9 00 [2] 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE [4] E9 AC 00 00 00 8B 46 0C BB 00 00 [2] 03 C3 50 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Escargot01finalMeat
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 40 30 2E 31 60 68 61 [3] 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 [3] 8B 00 FF D0 50 B8 CD [3] 81 38 DE C0 37 13 75 2D 68 C9 [3] 6A 40 68 00 ?? 00 00 68 00 00 [2] B8 96 [3] 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 [2] B9 00 [2] 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE [4] E9 AC 00 00 00 8B 46 0C BB 00 00 [2] 03 C3 50 50 }

condition:
		$a0 at pe.entry_point
}