deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WWPack32v1x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 55 8B E8 33 DB EB 60 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPack32v1x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 55 8B E8 33 DB EB 60 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ChSfxsmallv11
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BA [2] E8 [2] 8B EC 83 EC ?? 8C C8 BB [2] B1 ?? D3 EB 03 C3 8E D8 05 [2] 89 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ChSfxsmallv11
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA [2] E8 [2] 8B EC 83 EC ?? 8C C8 BB [2] B1 ?? D3 EB 03 C3 8E D8 05 [2] 89 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXModifiedStubcFarbrauschConsumerConsulting
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXModifiedStubcFarbrauschConsumerConsulting
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF FC B2 80 E8 00 00 00 00 5B 83 C3 66 A4 FF D3 73 FB 31 C9 FF D3 73 14 31 C0 FF D3 73 1D 41 B0 10 FF D3 10 C0 73 FA 75 3C AA EB E2 E8 4A 00 00 00 49 E2 10 E8 40 00 00 00 EB 28 AC D1 E8 74 45 11 C9 EB 1C 91 48 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02NorthStarPEShrinker13Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02NorthStarPEShrinker13Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv098tE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 25 E4 FF FF 00 00 00 [8] 00 00 00 00 00 00 00 00 [12] 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [4] 00 00 00 00 [4] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv098tE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 25 E4 FF FF 00 00 00 [8] 00 00 00 00 00 00 00 00 [12] 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [4] 00 00 00 00 [4] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMicrosoftVisualBasicMASM32
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 09 94 0F B7 FF 68 80 [2] 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMicrosoftVisualBasicMASM32
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 09 94 0F B7 FF 68 80 [2] 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv022v023BetaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv022v023BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxVirusConstructorbased
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB [2] B9 [2] 2E [4] 43 43 [2] 8B EC CC 8B [2] 81 [3] 06 1E B8 [2] CD 21 3D [4] 8C D8 48 8E D8 }
	$a1 = { E8 [2] 5D 81 [3] 06 1E E8 [2] E8 [4] 2E [6] B4 4A BB FF FF CD 21 83 [2] B4 4A CD 21 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule VxVirusConstructorbased
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB [2] B9 [2] 2E [4] 43 43 [2] 8B EC CC 8B [2] 81 [3] 06 1E B8 [2] CD 21 3D [4] 8C D8 48 8E D8 }
	$a1 = { E8 [2] 5D 81 [3] 06 1E E8 [2] E8 [4] 2E [6] B4 4A BB FF FF CD 21 83 [2] B4 4A CD 21 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PESHiELD02
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESHiELD02
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02Gleam100Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02Gleam100Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DBPEv233DingBoy
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 20 [2] 40 [29] 9C 55 57 56 52 51 53 9C E8 [4] 5D 81 ED [4] 9C 6A 10 73 0B EB 02 C1 51 E8 06 [3] C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DBPEv233DingBoy
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 20 [2] 40 [29] 9C 55 57 56 52 51 53 9C E8 [4] 5D 81 ED [4] 9C 6A 10 73 0B EB 02 C1 51 E8 06 [3] C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01PEtite2xlevel0Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PEtite2xlevel0Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 B8 00 90 90 00 6A 00 68 90 90 90 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 8B D8 03 00 68 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EPack14litefinalby6aHguT
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 C0 8B C0 68 [4] 68 [4] E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EPack14litefinalby6aHguT
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 8B C0 68 [4] 68 [4] E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElock098tE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 25 E4 FF FF 00 00 00 [4] 1E [2] 00 00 00 00 00 00 00 00 00 3E [2] 00 2E [2] 00 26 [2] 00 00 00 00 00 00 00 00 00 4B [2] 00 36 [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 [2] 00 00 00 00 00 69 [2] 00 00 00 00 00 56 [2] 00 00 00 00 00 69 [2] 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElock098tE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 25 E4 FF FF 00 00 00 [4] 1E [2] 00 00 00 00 00 00 00 00 00 3E [2] 00 2E [2] 00 26 [2] 00 00 00 00 00 00 00 00 00 4B [2] 00 36 [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 [2] 00 00 00 00 00 69 [2] 00 00 00 00 00 56 [2] 00 00 00 00 00 69 [2] 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnnamedScrambler10p0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 [4] 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B [4] FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32 }

Detection condition:
$a0

Full rule:
rule UnnamedScrambler10p0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 [4] 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B [4] FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32 }

condition:
		$a0
}
YARA Detection Rule: WARNINGTROJANADinjector
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WARNINGTROJANADinjector
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: TopSpeedv3011989
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E BA [2] 8E DA 8B [3] 8B [3] FF [3] 50 53 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule TopSpeedv3011989
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E BA [2] 8E DA 8B [3] 8B [3] FF [3] 50 53 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CodeCryptv0164
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CodeCryptv0164
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXHiT001DJSiba
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule UPXHiT001DJSiba
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner01ASProtectAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01ASProtectAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PocketPCARM
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 [3] EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 [2] 9F E5 [5] 00 [8] 9F E5 00 [4] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PocketPCARM
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 [3] EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 [2] 9F E5 [5] 00 [8] 9F E5 00 [4] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AnskyaBinderv11Anskya
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [3] 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AnskyaBinderv11Anskya
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [3] 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VProtectorV10Bvcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VProtectorV10Bvcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SecurePE1Xwwwdeepzoneorg
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SecurePE1Xwwwdeepzoneorg
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: yPv10bbyAshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC [7] EB 01 E8 }

Detection condition:
$a0

Full rule:
rule yPv10bbyAshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC [7] EB 01 E8 }

condition:
		$a0
}
YARA Detection Rule: MSLRHv031a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F }
	$a1 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 

Detection condition:
$a0 or $a1 at pe.entry_point

Full rule:
rule MSLRHv031a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F }
	$a1 = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }

condition:
		$a0 or $a1 at pe.entry_point
}
YARA Detection Rule: Upackv039finalDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
	$a1 = { FF 76 38 AD 50 8B 3E BE F0 [3] 6A 27 59 F3 A5 FF 76 04 83 C8 FF }

Detection condition:
$a0 or $a1

Full rule:
rule Upackv039finalDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
	$a1 = { FF 76 38 AD 50 8B 3E BE F0 [3] 6A 27 59 F3 A5 FF 76 04 83 C8 FF }

condition:
		$a0 or $a1
}
YARA Detection Rule: vprotector12vcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 }
	$a1 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule vprotector12vcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 }
	$a1 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: FakeNinjav28Spirit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BA [4] FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 }

Detection condition:
$a0

Full rule:
rule FakeNinjav28Spirit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA [4] FF E2 64 11 40 00 FF 35 84 11 40 00 E8 40 }

condition:
		$a0
}
YARA Detection Rule: PECompactv133
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv133
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DragonArmorOrient
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF 4C [2] 00 83 C9 FF 33 C0 68 34 [2] 00 F2 AE F7 D1 49 51 68 4C [2] 00 E8 11 0A 00 00 83 C4 0C 68 4C [2] 00 FF 15 00 [2] 00 8B F0 BF 4C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C [2] 00 8B D1 68 34 [2] 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C [2] 00 E8 C0 09 00 00 8B 1D 04 [2] 00 83 C4 0C 68 5C [2] 00 56 FF D3 A3 D4 [2] 00 BF 5C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C [2] 00 8B D1 68 34 [2] 00 C1 E9 02 F3 AB 8B CA 83 E1 }

Detection condition:
$a0

Full rule:
rule DragonArmorOrient
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF 4C [2] 00 83 C9 FF 33 C0 68 34 [2] 00 F2 AE F7 D1 49 51 68 4C [2] 00 E8 11 0A 00 00 83 C4 0C 68 4C [2] 00 FF 15 00 [2] 00 8B F0 BF 4C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 4C [2] 00 8B D1 68 34 [2] 00 C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF 5C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 5C [2] 00 E8 C0 09 00 00 8B 1D 04 [2] 00 83 C4 0C 68 5C [2] 00 56 FF D3 A3 D4 [2] 00 BF 5C [2] 00 83 C9 FF 33 C0 F2 AE F7 D1 49 BF 5C [2] 00 8B D1 68 34 [2] 00 C1 E9 02 F3 AB 8B CA 83 E1 }

condition:
		$a0
}
YARA Detection Rule: ThemidaWinLicenseV1802OreansTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D [4] FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThemidaWinLicenseV1802OreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D [4] FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftDefender1xRandyLi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftDefender1xRandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD 00 59 9C 50 74 0A 75 08 E8 59 C2 04 00 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 E6 01 00 00 03 C8 74 BD 75 BB E8 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PellesC2x4xDLLPelleOrinius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PellesC2x4xDLLPelleOrinius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 }

condition:
		$a0 at pe.entry_point
}