deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RAZOR1911encruptor
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] BF [2] 3B FC 72 ?? B4 4C CD 21 BE [2] B9 [2] FD F3 A5 FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RAZOR1911encruptor
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] BF [2] 3B FC 72 ?? B4 4C CD 21 BE [2] B9 [2] FD F3 A5 FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElock051tE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElock051tE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SDProtectorBasicProEdition112RandyLi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SDProtectorBasicProEdition112RandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxFaxFreeTopo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FA 06 33 C0 8E C0 B8 [2] 26 [4] 50 8C C8 26 [4] 50 CC 58 9D 58 26 [4] 58 26 [4] 07 FB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxFaxFreeTopo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 06 33 C0 8E C0 B8 [2] 26 [4] 50 8C C8 26 [4] 50 CC 58 9D 58 26 [4] 58 26 [4] 07 FB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02MEW11SE10Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02MEW11SE10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Joinersignfrompinch[PII_REDACTED]10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Joinersignfrompinch[PII_REDACTED]10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 EC 04 01 00 00 8B F4 68 04 01 00 00 56 6A 00 E8 7C 01 00 00 33 C0 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 56 E8 50 01 00 00 8B D8 6A 00 6A 00 6A 00 6A 02 6A 00 53 E8 44 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxSK
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxSK
{
      meta:
		author="malware-lu"
strings:
		$a0 = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEStubOEPv1x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 40 48 BE 00 [2] 00 40 48 60 33 C0 B8 [3] 00 FF E0 C3 C3 }

Detection condition:
$a0

Full rule:
rule PEStubOEPv1x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 40 48 BE 00 [2] 00 40 48 60 33 C0 B8 [3] 00 FF E0 C3 C3 }

condition:
		$a0
}
YARA Detection Rule: MoleBoxV23XMoleStudiocom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 60 E8 4F 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MoleBoxV23XMoleStudiocom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 60 E8 4F 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxHymn1865
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 83 EE 4C FC 2E [4] 4D 5A [2] FA 8B E6 81 [3] FB 3B [5] 2E [5] 50 06 56 1E 0E 1F B8 00 C5 CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxHymn1865
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 83 EE 4C FC 2E [4] 4D 5A [2] FA 8B E6 81 [3] FB 3B [5] 2E [5] 50 06 56 1E 0E 1F B8 00 C5 CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: kkrunchyRyd
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BD 08 [2] 00 C7 45 00 [3] 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF [3] 00 57 BE [3] 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule kkrunchyRyd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BD 08 [2] 00 C7 45 00 [3] 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF [3] 00 57 BE [3] 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECryptv100v101
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECryptv100v101
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CERBERUSv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 2B ED 8C [2] 8C [2] FA E4 ?? 88 [2] 16 07 BF [2] 8E DD 9B F5 B9 [2] FC F3 A5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CERBERUSv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 2B ED 8C [2] 8C [2] FA E4 ?? 88 [2] 16 07 BF [2] 8E DD 9B F5 B9 [2] FC F3 A5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor2117StrongbitSoftCompleteDevelopment
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [4] B8 00 00 [2] 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 [3] 09 C0 0F 85 0F 00 00 00 53 FF 15 98 [3] 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }

Detection condition:
$a0

Full rule:
rule EXECryptor2117StrongbitSoftCompleteDevelopment
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [4] B8 00 00 [2] 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 [3] 09 C0 0F 85 0F 00 00 00 53 FF 15 98 [3] 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }

condition:
		$a0
}
YARA Detection Rule: WWPACKv303
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 BB [2] 53 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv303
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 BB [2] 53 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: GHFProtectorpackonlyGPcH
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 68 [4] B8 [4] FF 10 68 [4] 50 B8 [4] FF 10 68 00 00 00 00 6A 40 FF D0 89 05 [4] 89 C7 BE [4] 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 [4] E2 F5 90 90 BA [4] BE [4] 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 [4] FF 10 85 C0 75 08 53 B8 [4] FF 10 89 05 [4] C7 05 [4] 00 00 00 00 BA [4] 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 [4] 8B 18 8B 7E 10 01 D7 03 3D [4] 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 [4] B8 [4] FF 10 89 07 83 05 [4] 04 EB AE 83 C6 14 BA [4] E9 6E FF FF FF 68 [4] B8 [4] FF 10 68 [

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule GHFProtectorpackonlyGPcH
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 [4] B8 [4] FF 10 68 [4] 50 B8 [4] FF 10 68 00 00 00 00 6A 40 FF D0 89 05 [4] 89 C7 BE [4] 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 [4] E2 F5 90 90 BA [4] BE [4] 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 [4] FF 10 85 C0 75 08 53 B8 [4] FF 10 89 05 [4] C7 05 [4] 00 00 00 00 BA [4] 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 [4] 8B 18 8B 7E 10 01 D7 03 3D [4] 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 [4] B8 [4] FF 10 89 07 83 05 [4] 04 EB AE 83 C6 14 BA [4] E9 6E FF FF FF 68 [4] B8 [4] FF 10 68 [4] 50 B8 [4] FF 10 8B 15 [4] 52 FF D0 61 BA [4] FF E2 90 C3 }
	$a1 = { 60 68 [4] B8 [4] FF 10 68 [4] 50 B8 [4] FF 10 68 00 00 00 00 6A 40 FF D0 89 05 [4] 89 C7 BE [4] 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }

condition:
		$a0 at pe.entry_point or $a1
}
YARA Detection Rule: yzpackV11UsAr
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yzpackV11UsAr
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxDanishtiny
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxDanishtiny
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXV194MarkusOberhumerLaszloMolnarJohnReiser
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FF D5 80 A7 [5] 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

Detection condition:
$a0

Full rule:
rule UPXV194MarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF D5 80 A7 [5] 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

condition:
		$a0
}
YARA Detection Rule: yzpack112UsAr
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 [4] B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 [4] 00 00 00 00 00 00 00 00 E0 00 [2] 0B 01 [4] 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yzpack112UsAr
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 [4] B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 [4] 00 00 00 00 00 00 00 00 E0 00 [2] 0B 01 [4] 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02YodasProtector102Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02YodasProtector102Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02PESHiELD025Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02PESHiELD025Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPacKV34V35LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [4] 80 38 01 0F 84 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPacKV34V35LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [4] 80 38 01 0F 84 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DualseXe10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DualseXe10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 08 03 00 00 89 28 33 FF 8D 85 7D 02 00 00 8D 8D 08 03 00 00 2B C8 8B 9D 58 03 00 00 E8 1C 02 00 00 8D 9D 61 02 00 00 8D B5 7C 02 00 00 46 80 3E 00 74 24 56 FF 95 0A 04 00 00 46 80 3E 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NoodleCryptv200EngNoodleSpa
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NoodleCryptv200EngNoodleSpa
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftComp1xBGSoftPT
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 }

Detection condition:
$a0

Full rule:
rule SoftComp1xBGSoftPT
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 81 2C 24 3A 10 41 00 5D E8 00 00 00 00 81 2C 24 31 01 00 00 8B 85 2A 0F 41 00 29 04 24 8B 04 24 89 85 2A 0F 41 00 58 8B 85 2A 0F 41 00 }

condition:
		$a0
}
YARA Detection Rule: Petite13c1998IanLuck
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 50 8D 88 00 [3] 8D 90 [2] 00 00 8B DC 8B E1 68 00 00 [2] 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Petite13c1998IanLuck
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 50 8D 88 00 [3] 8D 90 [2] 00 00 8B DC 8B E1 68 00 00 [2] 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PENightMarev13
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D B9 [4] 80 31 15 41 81 F9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PENightMarev13
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D B9 [4] 80 31 15 41 81 F9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillo50DllSiliconRealmsToolworks
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 [4] E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D [4] 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 [4] 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 [4] FF 15 [4] 8B D8 3B DF 75 4C 39 3D [4] 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillo50DllSiliconRealmsToolworks
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 [4] E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D [4] 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 [4] 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 [4] FF 15 [4] 8B D8 3B DF 75 4C 39 3D [4] 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ObsidiumV1350ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 03 [3] E8 [4] EB 02 [2] EB 04 [4] 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 20 EB 03 [3] 33 C0 EB 01 ?? C3 EB 02 [2] EB 03 [3] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 01 ?? EB 04 [4] 50 EB 04 [4] 33 C0 EB 04 [4] 8B 00 EB 03 [3] C3 EB 02 [2] E9 FA 00 00 00 EB 01 ?? E8 [4] EB 01 ?? EB 02 [2] 58 EB 04 [4] EB 02 [2] 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 01 ?? E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV1350ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 [3] E8 [4] EB 02 [2] EB 04 [4] 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 20 EB 03 [3] 33 C0 EB 01 ?? C3 EB 02 [2] EB 03 [3] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 01 ?? EB 04 [4] 50 EB 04 [4] 33 C0 EB 04 [4] 8B 00 EB 03 [3] C3 EB 02 [2] E9 FA 00 00 00 EB 01 ?? E8 [4] EB 01 ?? EB 02 [2] 58 EB 04 [4] EB 02 [2] 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 01 ?? E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectv123RC1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 01 [2] 00 E8 01 00 00 00 C3 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectv123RC1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 [2] 00 E8 01 00 00 00 C3 C3 }

condition:
		$a0 at pe.entry_point
}