deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: NeoLitev200
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 44 24 04 23 05 [4] 50 E8 [4] 83 C4 04 FE 05 [4] 0B C0 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NeoLitev200
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 44 24 04 23 05 [4] 50 E8 [4] 83 C4 04 FE 05 [4] 0B C0 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv200bextra
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 B8 [2] BA [2] 05 [2] 3B 06 02 00 72 ?? B4 09 BA [2] CD 21 B8 01 4C CD 21 [30] EA [4] F3 A5 C3 59 2D [2] 8E D0 51 2D [2] 50 80 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv200bextra
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 [2] BA [2] 05 [2] 3B 06 02 00 72 ?? B4 09 BA [2] CD 21 B8 01 4C CD 21 [30] EA [4] F3 A5 C3 59 2D [2] 8E D0 51 2D [2] 50 80 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Crunch5Fusion4
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 15 03 [3] 06 [11] 68 [4] 55 E8 }

Detection condition:
$a0

Full rule:
rule Crunch5Fusion4
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 15 03 [3] 06 [11] 68 [4] 55 E8 }

condition:
		$a0
}
YARA Detection Rule: MSLRHv032afakePEBundle023xemadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakePEBundle023xemadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEMangle
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C BE [4] 8B FE B9 [4] BB 44 52 4F 4C AD 33 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEMangle
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C BE [4] 8B FE B9 [4] BB 44 52 4F 4C AD 33 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv302v302av304Relocationspack
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [2] BF [2] B9 [2] 8C CD 81 ED [2] 8B DD 81 EB [2] 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv302v302av304Relocationspack
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [2] BF [2] B9 [2] 8C CD 81 ED [2] 8B DD 81 EB [2] 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXProtectorv10x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB EC [4] 8A 06 46 88 07 47 01 DB 75 07 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXProtectorv10x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB EC [4] 8A 06 46 88 07 47 01 DB 75 07 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NorthStarPEShrinkerv13byLiuxingping
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 }

Detection condition:
$a0

Full rule:
rule NorthStarPEShrinkerv13byLiuxingping
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 73 ?? FF FF 8B 06 83 F8 00 74 11 8D B5 7F ?? FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 C7 06 01 00 00 00 8B D5 8B 85 4F ?? FF FF 2B D0 89 95 4F ?? FF FF 01 95 67 ?? FF FF 8D B5 83 ?? FF FF 01 }

condition:
		$a0
}
YARA Detection Rule: CodeCryptv015b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CodeCryptv015b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 31 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackFullEdition117Ap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 [4] 8D 9D [4] 33 FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackFullEdition117Ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 [15] 8D B5 [4] 8D 9D [4] 33 FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv100
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv100
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 ?? 87 DD 8B 85 49 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakeASProtect10FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeASProtect10FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 60 E8 01 00 00 00 90 5D 81 ED 00 00 00 00 BB 00 00 00 00 03 DD 2B 9D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: KGCryptvxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] 5D 81 ED [4] 64 A1 30 [3] 84 C0 74 ?? 64 A1 20 [3] 0B C0 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule KGCryptvxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 5D 81 ED [4] 64 A1 30 [3] 84 C0 74 ?? 64 A1 20 [3] 0B C0 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxKBDflags1024
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxKBDflags1024
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: yodasProtectorV102AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtectorV102AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium1311ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 27 00 00 00 EB 02 [2] EB 03 [3] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 [4] 33 C0 EB 01 ?? C3 EB 02 [2] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 03 [3] 33 C0 EB 01 ?? 8B 00 EB 03 [3] C3 EB 01 ?? E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 01 ?? EB 03 [3] 58 EB 03 [3] EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1311ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 27 00 00 00 EB 02 [2] EB 03 [3] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 [4] 33 C0 EB 01 ?? C3 EB 02 [2] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 03 [3] 33 C0 EB 01 ?? 8B 00 EB 03 [3] C3 EB 01 ?? E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 01 ?? EB 03 [3] 58 EB 03 [3] EB 01 ?? 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01MicrosoftVisualC620Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01MicrosoftVisualC620Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MEGALITEv120a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] BA [2] 05 [2] 3B 2D 73 ?? 72 ?? B4 09 BA [2] CD 21 CD 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MEGALITEv120a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 05 [2] 3B 2D 73 ?? 72 ?? B4 09 BA [2] CD 21 CD 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: GoatsMutilatorV16Goat_e0f
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 EA 0B 00 00 [3] 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule GoatsMutilatorV16Goat_e0f
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 EA 0B 00 00 [3] 8B 1C 79 F6 63 D8 8D 22 B0 BF F6 49 08 C3 02 BD 3B 6C 29 46 13 28 5D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillo430aSiliconRealmsToolworks
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }

Detection condition:
$a0

Full rule:
rule Armadillo430aSiliconRealmsToolworks
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }

condition:
		$a0
}
YARA Detection Rule: Upackv038betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 }
	$a1 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 [2] 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE [3] 14 00 00 00 00 [6] 00 FF 76 38 AD 50 8B 3E BE F0 [3] 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 [5] 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 [4] E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Upackv038betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 }
	$a1 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 38 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 [2] 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE [3] 14 00 00 00 00 [6] 00 FF 76 38 AD 50 8B 3E BE F0 [3] 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 [5] 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 [4] E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 97 FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: DCryptPrivate09bdrmist
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B9 [3] 00 E8 00 00 00 00 58 68 [3] 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DCryptPrivate09bdrmist
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 [3] 00 E8 00 00 00 00 58 68 [3] 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: kkrunchyV02XRyd
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BD [4] C7 45 [5] FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF [4] 57 BE [4] 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule kkrunchyV02XRyd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BD [4] C7 45 [5] FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF [4] 57 BE [4] 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SkDUndetectabler3NoFSG2MethodSkD
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SkDUndetectabler3NoFSG2MethodSkD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 10 02 00 00 68 00 02 00 00 8D 85 F8 FD FF FF 50 6A 00 FF 15 38 10 00 01 50 FF 15 3C 10 00 01 8D 8D F8 FD FF FF 51 E8 4F FB FF FF 83 C4 04 8B 15 ?? 16 00 01 52 A1 ?? 16 00 01 50 E8 50 FF FF FF 83 C4 08 A3 ?? 16 00 01 C7 85 F4 FD FF FF 00 00 00 00 EB 0F 8B 8D F4 FD FF FF 83 C1 01 89 8D F4 FD FF FF 8B 95 F4 FD FF FF 3B 15 ?? 16 00 01 73 1C 8B 85 F4 FD FF FF 8B 0D ?? 16 00 01 8D 54 01 07 81 FA 74 10 00 01 75 02 EB 02 EB C7 8B 85 F4 FD FF FF 50 E8 ?? 00 00 00 83 C4 04 89 85 F0 FD FF FF 8B 8D F0 FD FF FF 89 4D FC C7 45 F8 00 00 00 00 EB 09 8B 55 F8 83 C2 01 89 55 F8 8B 45 F8 3B 85 F4 FD FF FF 73 15 8B 4D FC 03 4D F8 8B 15 ?? 16 00 01 03 55 F8 8A 02 88 01 EB D7 83 3D ?? 16 00 01 00 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NTPacker10ErazerZ
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 [2] 40 00 E8 [2] FF FF 33 C0 55 68 [2] 40 00 64 FF 30 64 89 20 8D 4D EC BA [2] 40 00 A1 [2] 40 00 E8 ?? FC FF FF 8B 55 EC B8 [2] 40 00 E8 [2] FF FF 8D 4D E8 BA [2] 40 00 A1 [2] 40 00 E8 ?? FE FF FF 8B 55 E8 B8 [2] 40 00 E8 [2] FF FF B8 [2] 40 00 E8 ?? FB FF FF 8B D8 A1 [2] 40 00 BA [2] 40 00 E8 [2] FF FF 75 26 8B D3 A1 [2] 40 00 E8 [2] FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 [2] FF FF 8B 45 E4 8B D3 E8 [2] FF FF EB 14 8D 55 E0 33 C0 E8 [2] FF FF 8B 45 E0 8B D3 E8 [2] FF FF 6A 00 E8 [2] FF FF 33 C0 5A 59 59 64 89 10 68 [2] 40 00 8D 45 E0 BA 04 00 00 00 E8 [2] FF FF C3 E9 [2] FF FF EB EB 5B E8 [2] FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NTPacker10ErazerZ
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 E0 53 33 C0 89 45 E0 89 45 E4 89 45 E8 89 45 EC B8 [2] 40 00 E8 [2] FF FF 33 C0 55 68 [2] 40 00 64 FF 30 64 89 20 8D 4D EC BA [2] 40 00 A1 [2] 40 00 E8 ?? FC FF FF 8B 55 EC B8 [2] 40 00 E8 [2] FF FF 8D 4D E8 BA [2] 40 00 A1 [2] 40 00 E8 ?? FE FF FF 8B 55 E8 B8 [2] 40 00 E8 [2] FF FF B8 [2] 40 00 E8 ?? FB FF FF 8B D8 A1 [2] 40 00 BA [2] 40 00 E8 [2] FF FF 75 26 8B D3 A1 [2] 40 00 E8 [2] FF FF 84 C0 75 2A 8D 55 E4 33 C0 E8 [2] FF FF 8B 45 E4 8B D3 E8 [2] FF FF EB 14 8D 55 E0 33 C0 E8 [2] FF FF 8B 45 E0 8B D3 E8 [2] FF FF 6A 00 E8 [2] FF FF 33 C0 5A 59 59 64 89 10 68 [2] 40 00 8D 45 E0 BA 04 00 00 00 E8 [2] FF FF C3 E9 [2] FF FF EB EB 5B E8 [2] FF FF 00 00 00 FF FF FF FF 01 00 00 00 25 00 00 00 FF FF FF FF 01 00 00 00 5C 00 00 00 FF FF FF FF 06 00 00 00 53 45 52 56 45 52 00 00 FF FF FF FF 01 00 00 00 31 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SexeCrypter11bysantasdad
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 [4] E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SexeCrypter11bysantasdad
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 D8 39 00 10 E8 30 FA FF FF 33 C0 55 68 D4 3A 00 10 64 FF 30 64 89 [4] E4 3A 00 10 A1 00 57 00 10 50 E8 CC FA FF FF 8B D8 53 A1 00 57 00 10 50 E8 FE FA FF FF 8B F8 53 A1 00 57 00 10 50 E8 C8 FA FF FF 8B D8 53 E8 C8 FA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 14 57 00 10 E8 AD F6 FF FF B8 14 57 00 10 E8 9B F6 FF FF 8B CF 8B D6 E8 DA FA FF FF 53 E8 84 FA FF FF 8D 4D EC BA F8 3A 00 10 A1 14 57 00 10 E8 0A FB FF FF 8B 55 EC B8 14 57 00 10 E8 65 F5 FF FF B8 14 57 00 10 E8 63 F6 FF FF E8 52 FC FF FF 33 C0 5A 59 59 64 89 10 68 DB 3A 00 10 8D 45 EC E8 ED F4 FF FF C3 E9 83 EF FF FF EB F0 5F 5E 5B E8 ED F3 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 12 00 00 00 6B 75 74 68 37 36 67 62 62 67 36 37 34 76 38 38 67 79 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxGotcha879
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5B 81 EB [2] 9C FC 2E [7] 8C D8 05 [2] 2E [4] 50 2E [6] 8B C3 05 [2] 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxGotcha879
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5B 81 EB [2] 9C FC 2E [7] 8C D8 05 [2] 2E [4] 50 2E [6] 8B C3 05 [2] 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MZ0oPE106bTaskFall
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 [4] C3 }
	$a1 = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 [4] C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule MZ0oPE106bTaskFall
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 [4] C3 }
	$a1 = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 [4] C3 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4C 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: SoftDefenderv11xRandyLi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 74 07 75 05 [6] 74 1F 75 1D ?? 68 [3] 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 [3] E8 F4 FF FF FF [3] 78 0F 79 0D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftDefenderv11xRandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 [6] 74 1F 75 1D ?? 68 [3] 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 [3] E8 F4 FF FF FF [3] 78 0F 79 0D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv010v012BetaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 48 01 [5] 95 A5 33 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv010v012BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 48 01 [5] 95 A5 33 C0 }

condition:
		$a0 at pe.entry_point
}