deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF 89 E5 8D 9C 24 [4] 31 C0 50 39 DC 75 FB 46 46 53 68 [4] 57 83 C3 04 53 68 [4] 56 83 C3 04 53 50 C7 03 [4] 90 90 }
	$a1 = { 60 BE [4] 8D BE [4] 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF 89 E5 8D 9C 24 [4] 31 C0 50 39 DC 75 FB 46 46 53 68 [4] 57 83 C3 04 53 68 [4] 56 83 C3 04 53 50 C7 03 [4] 90 90 }
	$a1 = { 60 BE [4] 8D BE [4] 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: MEW510Northfox
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MEW510Northfox
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv090
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv090
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium1258ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 [2] EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 24 EB 04 [4] 33 C0 EB 02 [2] C3 EB 02 [2] EB 03 [3] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 [3] EB 01 ?? 50 EB 03 [3] 33 C0 EB 04 [4] 8B 00 EB 03 [3] C3 EB 01 ?? E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 04 [4] EB 03 [3] EB 01 ?? 58 EB 01 ?? EB 02 [2] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 01 ?? E8 7B 21 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1258ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 [2] EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 24 EB 04 [4] 33 C0 EB 02 [2] C3 EB 02 [2] EB 03 [3] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 [3] EB 01 ?? 50 EB 03 [3] 33 C0 EB 04 [4] 8B 00 EB 03 [3] C3 EB 01 ?? E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 04 [4] EB 03 [3] EB 01 ?? 58 EB 01 ?? EB 02 [2] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 01 ?? E8 7B 21 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SVKProtectorv132EngPavolCerven
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SVKProtectorv132EngPavolCerven
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeSplitter12BillPrisonerTPOC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08 }

Detection condition:
$a0

Full rule:
rule ExeSplitter12BillPrisonerTPOC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE 03 76 3C 8D 76 18 8D 76 60 8B 36 03 F3 56 8B 76 20 03 F3 33 D2 8B C6 8B 36 03 F3 8B 7D 08 B9 0E 00 00 00 FC F3 A6 0B C9 75 02 EB 08 }

condition:
		$a0
}
YARA Detection Rule: COPv10c1988
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF [2] BE [2] B9 [2] AC 32 [3] AA E2 ?? 8B [3] EB ?? 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule COPv10c1988
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF [2] BE [2] B9 [2] AC 32 [3] AA E2 ?? 8B [3] EB ?? 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv25RetailSlimLoaderBitsumTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [3] 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv25RetailSlimLoaderBitsumTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [3] 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Morphinev27Holy_FatherRatter29A
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a1 = { 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 [8] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }

Detection condition:
$a0 or $a1

Full rule:
rule Morphinev27Holy_FatherRatter29A
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a1 = { 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 [8] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }

condition:
		$a0 or $a1
}
YARA Detection Rule: diPackerV1XdiProtectorSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule diPackerV1XdiProtectorSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F 00 2D E9 01 00 A0 E3 68 01 00 EB 8C 00 00 EB 2B 00 00 EB 00 00 20 E0 1C 10 8F E2 8E 20 8F E2 00 30 A0 E3 67 01 00 EB 0F 00 BD E8 00 C0 8F E2 00 F0 9C E5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01REALBasicAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01REALBasicAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PPCPROTECT11XAlexeyGorchakov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PPCPROTECT11XAlexeyGorchakov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 5F 2D E9 20 00 9F E5 00 00 90 E5 18 00 8F E5 18 00 9F E5 00 00 90 E5 10 00 8F E5 01 00 A0 E3 00 00 00 EB 02 00 00 EA 04 F0 1F E5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: nPackV111502006BetaNEOxuinC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 3D 40 [3] 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 [3] 2B 05 08 [3] A3 3C [3] E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C [3] C7 05 40 [3] 01 00 00 00 01 05 00 [3] FF 35 00 [3] C3 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule nPackV111502006BetaNEOxuinC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D 40 [3] 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 [3] 2B 05 08 [3] A3 3C [3] E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C [3] C7 05 40 [3] 01 00 00 00 01 05 00 [3] FF 35 00 [3] C3 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EnigmaProtector11X13XSukhovVladimirSergeNMarkin
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }

Detection condition:
$a0

Full rule:
rule EnigmaProtector11X13XSukhovVladimirSergeNMarkin
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }

condition:
		$a0
}
YARA Detection Rule: HardlockdongleAlladin
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HardlockdongleAlladin
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov190c
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov190c
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upack_PatchDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 81 3A 00 00 00 02 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upack_PatchDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 3A 00 00 00 02 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeJoinerV10Yodaf2f
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeJoinerV10Yodaf2f
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCShrink071beta
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCShrink071beta
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 AD 54 3A 40 00 FF B5 50 3A 40 00 6A 40 FF 95 88 3A 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMASM32TASM32
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B }
	$a1 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMASM32TASM32
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B }
	$a1 = { 03 F7 23 FE 33 FB EB 02 CD 20 BB 80 ?? 40 00 EB 01 86 EB 01 90 B8 F4 00 00 00 83 EE 05 2B F2 81 F6 EE 00 00 00 EB 02 CD 20 8A 0B E8 02 00 00 00 A9 54 5E C1 EE 07 F7 D7 EB 01 DE 81 E9 B7 96 A0 C4 EB 01 6B EB 02 CD 20 80 E9 4B C1 CF 08 EB 01 71 80 E9 1C EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PEiDBundlev101BoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEiDBundlev101BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPX072
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPX072
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AdFlt2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE [2] AD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AdFlt2: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 01 9C 0F A0 0F A8 60 FD 6A 00 0F A1 BE [2] AD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPack120BasicEditionaPLibAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPack120BasicEditionaPLibAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 DF 83 BD 9E 05 00 00 00 74 0E 83 BD A2 05 00 00 00 74 05 E8 D6 01 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AsCryptv01SToRM1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 81 [6] 83 [7] 83 [2] E2 ?? EB }

Detection condition:
$a0

Full rule:
rule AsCryptv01SToRM1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 [6] 83 [7] 83 [2] E2 ?? EB }

condition:
		$a0
}
YARA Detection Rule: SmartEMicrosoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SmartEMicrosoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PE_Admin10EncryptPE12003518SoldFlyingCat
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
	$a1 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule PE_Admin10EncryptPE12003518SoldFlyingCat
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
	$a1 = { 60 9C 64 FF 35 00 00 00 00 E8 79 01 00 00 90 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: MacromediaWindowsFlashProjectorPlayerv40
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MacromediaWindowsFlashProjectorPlayerv40
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPack32v100v111v112v120
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPack32v100v111v112v120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VProtectorV11vcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VProtectorV11vcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MaskPE16yzkzero
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 36 81 2C 24 [3] 00 C3 60 }

Detection condition:
$a0

Full rule:
rule MaskPE16yzkzero
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 36 81 2C 24 [3] 00 C3 60 }

condition:
		$a0
}
YARA Detection Rule: bambam001bedrock
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A 14 E8 9A 05 00 00 8B D8 53 68 [4] E8 6C FD FF FF B9 05 00 00 00 8B F3 BF [4] 53 F3 A5 E8 8D 05 00 00 8B 3D [4] A1 [4] 66 8B 15 [4] B9 [4] 2B CF 89 45 E8 89 0D [4] 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule bambam001bedrock
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 14 E8 9A 05 00 00 8B D8 53 68 [4] E8 6C FD FF FF B9 05 00 00 00 8B F3 BF [4] 53 F3 A5 E8 8D 05 00 00 8B 3D [4] A1 [4] 66 8B 15 [4] B9 [4] 2B CF 89 45 E8 89 0D [4] 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01MEW11SE10Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01MEW11SE10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }

Detection condition:
$a0

Full rule:
rule ASProtectv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner01BorlandDelphi6070Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01BorlandDelphi6070Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 53 8B D8 33 C0 A3 09 09 09 00 6A 00 E8 09 09 00 FF A3 09 09 09 00 A1 09 09 09 00 A3 09 09 09 00 33 C0 A3 09 09 09 00 33 C0 A3 09 09 09 00 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ObsidiumV12ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 77 1E 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV12ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 77 1E 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01PEProtect09Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PEProtect09Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 E9 }

condition:
		$a0 at pe.entry_point
}