deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PKLITEv100c2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BA [2] A1 [2] 2D [2] 8C CB 81 C3 [2] 3B C3 77 ?? 05 [2] 3B C3 77 ?? B4 09 BA [2] CD 21 CD 20 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv100c2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA [2] A1 [2] 2D [2] 8C CB 81 C3 [2] 3B C3 77 ?? 05 [2] 3B C3 77 ?? B4 09 BA [2] CD 21 CD 20 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: kkrunchyv017FGiesen
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC FF 4D 08 31 D2 8D 7D 30 BE }

Detection condition:
$a0

Full rule:
rule kkrunchyv017FGiesen
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC FF 4D 08 31 D2 8D 7D 30 BE }

condition:
		$a0
}
YARA Detection Rule: ACProtectv190gRiscosoftwareInc
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ACProtectv190gRiscosoftwareInc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 0F 87 02 00 00 00 1B F8 E8 01 00 00 00 73 83 04 24 06 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BE [4] 8D BE [4] 57 89 E5 8D 9C 24 [4] 31 C0 50 39 DC 75 FB 46 46 53 68 [4] 57 83 C3 04 53 68 [4] 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 89 E5 8D 9C 24 [4] 31 C0 50 39 DC 75 FB 46 46 53 68 [4] 57 83 C3 04 53 68 [4] 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium[PII_REDACTED]3ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 27 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 23 EB 03 [3] 33 C0 EB 02 [2] C3 EB 01 ?? EB 03 [3] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 [2] 33 C0 EB 01 ?? 8B 00 EB 04 [4] C3 EB 02 [2] E9 FA 00 00 00 EB 04 [4] E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 [4] EB 01 ?? 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 01 ?? E8 F7 26 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium[PII_REDACTED]3ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 27 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 23 EB 03 [3] 33 C0 EB 02 [2] C3 EB 01 ?? EB 03 [3] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 02 [2] 33 C0 EB 01 ?? 8B 00 EB 04 [4] C3 EB 02 [2] E9 FA 00 00 00 EB 04 [4] E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 04 [4] EB 01 ?? 64 67 8F 06 00 00 EB 02 [2] 83 C4 04 EB 01 ?? E8 F7 26 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv2000AlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 70 05 00 00 EB 4C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv2000AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 70 05 00 00 EB 4C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov4000053SiliconRealmsToolworks
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov4000053SiliconRealmsToolworks
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov160a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov160a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ACProtectUltraProtect10X20XRiSco
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 [12] 00 00 00 00 00 00 00 00 [13] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 [16] 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 [4] 00 00 00 00 [20] 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }

Detection condition:
$a0

Full rule:
rule ACProtectUltraProtect10X20XRiSco
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 [12] 00 00 00 00 00 00 00 00 [13] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 [16] 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 [4] 00 00 00 00 [20] 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }

condition:
		$a0
}
YARA Detection Rule: Thinstall3035Jtit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
	$a1 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Thinstall3035Jtit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
	$a1 = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 [4] 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 C3 B9 08 00 00 00 E8 01 00 00 00 C3 33 C0 E8 E1 FF FF FF 13 C0 E2 F7 C3 33 C9 41 E8 D4 FF FF FF 13 C9 E8 CD FF FF FF 72 F2 C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PENinjav10DzAkRAkerTNT
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PENinjav10DzAkRAkerTNT
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 5B 2A 40 00 BF 35 12 00 00 E8 40 12 00 00 3D 22 83 A3 C6 0F 85 67 0F 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThinstallEmbedded19XJitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 [4] 50 E8 87 FC FF FF 59 59 A1 [4] 8B 40 10 03 05 [4] 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded19XJitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 [4] 50 E8 87 FC FF FF 59 59 A1 [4] 8B 40 10 03 05 [4] 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptorv13045
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 [7] 31 C0 89 41 14 89 41 18 80 A1 }
	$a1 = { E8 24 [3] 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 [7] 31 C0 89 41 14 89 41 18 80 A1 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule EXECryptorv13045
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 [7] 31 C0 89 41 14 89 41 18 80 A1 }
	$a1 = { E8 24 [3] 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 [7] 31 C0 89 41 14 89 41 18 80 A1 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: Obsidium1338ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 04 [4] E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 ?? EB 04 [4] 33 C0 EB 03 [3] C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 04 [4] 33 C0 EB 02 [2] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 02 [2] EB 04 [4] 58 EB 04 [4] EB 02 [2] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 04 [4] E8 57 27 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1338ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 [4] E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 ?? EB 04 [4] 33 C0 EB 03 [3] C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 02 [2] EB 01 ?? 50 EB 04 [4] 33 C0 EB 02 [2] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 02 [2] EB 04 [4] 58 EB 04 [4] EB 02 [2] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 04 [4] E8 57 27 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPV073betaap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2E 72 6C 70 00 00 00 00 00 50 00 00 [12] 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }

Detection condition:
$a0

Full rule:
rule RLPV073betaap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E 72 6C 70 00 00 00 00 00 50 00 00 [12] 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }

condition:
		$a0
}
YARA Detection Rule: yCv13byAshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

Detection condition:
$a0

Full rule:
rule yCv13byAshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC C0 00 00 00 53 56 57 8D BD 40 FF FF FF B9 30 00 00 00 B8 CC CC CC CC F3 AB 60 E8 00 00 00 00 5D 81 ED 84 52 41 00 B9 75 5E 41 00 81 E9 DE 52 41 00 8B D5 81 C2 DE 52 41 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

condition:
		$a0
}
YARA Detection Rule: PCPECalphapreview
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCPECalphapreview
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AlexProtectorv10Alex
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AlexProtectorv10Alex
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 EB 01 E9 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Shrinkv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 9C FC BE [2] BF [2] 57 B9 [2] F3 A4 8B [3] BE [2] BF [2] F3 A4 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Shrinkv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 9C FC BE [2] BF [2] 57 B9 [2] F3 A4 8B [3] BE [2] BF [2] F3 A4 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHPack01FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 68 54 [2] 00 B8 48 [2] 00 FF 10 68 B3 [2] 00 50 B8 44 [2] 00 FF 10 68 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHPack01FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 54 [2] 00 B8 48 [2] 00 FF 10 68 B3 [2] 00 50 B8 44 [2] 00 FF 10 68 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SentinelSuperProAutomaticProtectionv640Safenet
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] 6A 01 6A 00 FF 15 [4] A3 [4] FF 15 [4] 33 C9 3D B7 00 00 00 A1 [4] 0F 94 C1 85 C0 89 0D [4] 0F 85 [4] 55 56 C7 05 [4] 01 00 00 00 FF 15 [4] 01 05 [4] FF 15 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SentinelSuperProAutomaticProtectionv640Safenet
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] 6A 01 6A 00 FF 15 [4] A3 [4] FF 15 [4] 33 C9 3D B7 00 00 00 A1 [4] 0F 94 C1 85 C0 89 0D [4] 0F 85 [4] 55 56 C7 05 [4] 01 00 00 00 FF 15 [4] 01 05 [4] FF 15 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DxPack10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 8B FD 81 ED [4] 2B B9 [4] 81 EF [4] 83 BD [4] ?? 0F 84 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DxPack10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 8B FD 81 ED [4] 2B B9 [4] 81 EF [4] 83 BD [4] ?? 0F 84 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Pohernah103byKas
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED [153] 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Pohernah103byKas
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED [153] 56 57 4F F7 D7 21 FE 89 F0 5F 5E C3 60 83 F0 05 40 90 48 83 F0 05 89 C6 89 D7 60 E8 0B 00 00 00 61 83 C7 08 83 E9 07 E2 F1 61 C3 57 8B 1F 8B 4F 04 68 B9 79 37 9E 5A 42 89 D0 48 C1 E0 05 BF 20 00 00 00 4A 89 DD C1 E5 04 29 E9 8B 6E 08 31 DD 29 E9 89 DD C1 ED 05 31 C5 29 E9 2B 4E 0C 89 CD C1 E5 04 29 EB 8B 2E 31 CD 29 EB 89 CD C1 ED 05 31 C5 29 EB 2B 5E 04 29 D0 4F 75 C8 5F 89 1F 89 4F 04 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ObsidiumV1258ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 ?? E8 ?? 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV1258ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: nPackv11150200BetaNEOx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 3D 40 [3] 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 [3] 2B 05 08 [3] A3 3C [2] 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule nPackv11150200BetaNEOx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D 40 [3] 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 [3] 2B 05 08 [3] A3 3C [2] 00 E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PerlApp602ActiveState
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55 }
	$a1 = { 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50 }

Detection condition:
$a0 or $a1

Full rule:
rule PerlApp602ActiveState
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 2C EA 40 00 FF D3 83 C4 0C 85 C0 0F 85 CD 00 00 00 6A 09 57 68 20 EA 40 00 FF D3 83 C4 0C 85 C0 75 12 8D 47 09 50 FF 15 1C D1 40 00 59 A3 B8 07 41 00 EB 55 6A 08 57 68 14 EA 40 00 FF D3 83 C4 0C 85 C0 75 11 8D 47 08 50 FF 15 1C D1 40 00 59 89 44 24 10 EB 33 6A 09 57 68 08 EA 40 00 FF D3 83 C4 0C 85 C0 74 22 6A 08 57 68 FC E9 40 00 FF D3 83 C4 0C 85 C0 74 11 6A 0B 57 68 F0 E9 40 00 FF D3 83 C4 0C 85 C0 75 55 }
	$a1 = { 68 9C E1 40 00 FF 15 A4 D0 40 00 85 C0 59 74 0F 50 FF 15 1C D1 40 00 85 C0 59 89 45 FC 75 62 6A 00 8D 45 F8 FF 75 0C F6 45 14 01 50 8D 45 14 50 E8 9B 01 00 00 83 C4 10 85 C0 0F 84 E9 00 00 00 8B 45 F8 83 C0 14 50 FF D6 85 C0 59 89 45 FC 75 0E FF 75 14 FF 15 78 D0 40 00 E9 C9 00 00 00 68 8C E1 40 00 FF 75 14 50 }

condition:
		$a0 or $a1
}
YARA Detection Rule: UPXProtectorv10x2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB [5] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }

Detection condition:
$a0

Full rule:
rule UPXProtectorv10x2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB [5] 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB }

condition:
		$a0
}
YARA Detection Rule: ThinstallEmbedded2501Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 [4] 81 75 04 [4] 81 75 08 [4] 81 75 0C [4] 81 75 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded2501Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B8 [4] BB [4] 50 E8 00 00 00 00 58 2D A8 1A 00 00 B9 6D 1A 00 00 BA 21 1B 00 00 BE 00 10 00 00 BF C0 53 00 00 BD F0 1A 00 00 03 E8 81 75 00 [4] 81 75 04 [4] 81 75 08 [4] 81 75 0C [4] 81 75 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CodeVirtualizer1310OreansTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C FC E8 00 00 00 00 5F 81 EF [4] 8B C7 81 C7 [4] 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC }

Detection condition:
$a0

Full rule:
rule CodeVirtualizer1310OreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C FC E8 00 00 00 00 5F 81 EF [4] 8B C7 81 C7 [4] 3B 47 2C 75 02 EB 2E 89 47 2C B9 A7 00 00 00 EB 05 01 44 8F ?? 49 0B C9 75 F7 83 7F 40 00 74 15 8B 77 40 03 F0 EB 09 8B 1E 03 D8 01 03 83 C6 04 83 3E 00 75 F2 8B 74 24 24 8B DE 03 F0 B9 01 00 00 00 33 C0 F0 0F B1 4F 30 75 F7 AC }

condition:
		$a0
}
YARA Detection Rule: VProtector13Xvcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 [4] 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [12] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF }
	$a1 = { E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 [4] 9C 81 [10] 9D 54 FF

Detection condition:
$a0 or $a1 at pe.entry_point

Full rule:
rule VProtector13Xvcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 [4] 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [12] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF }
	$a1 = { E9 B9 16 00 00 55 8B EC 81 EC 74 04 00 00 57 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 10 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 FF FF C2 10 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 00 00 C2 14 68 FF FF 00 00 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 68 [4] 9C 81 [10] 9D 54 FF 14 24 68 00 00 00 00 }

condition:
		$a0 or $a1 at pe.entry_point
}