deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RLPackv118BasicLZMAAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackv118BasicLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: StonesPEEncryptorv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 51 52 56 57 55 E8 [4] 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule StonesPEEncryptorv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 [4] 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv029betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [4] 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 [20] 29 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv029betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [4] 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 [20] 29 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02BJFNT11bAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02BJFNT11bAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 EA 9C EB 01 EA 53 EB 01 EA 51 EB 01 EA 52 EB 01 EA 56 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXScramblerRCv1x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 61 BE [4] 8D BE [4] 57 83 CD FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXScramblerRCv1x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 61 BE [4] 8D BE [4] 57 83 CD FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECrypt15BitShapeSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC [48] AA E2 CC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECrypt15BitShapeSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 55 20 40 00 B9 7B 09 00 00 8D BD 9D 20 40 00 8B F7 AC [48] AA E2 CC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv021BetaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 88 01 [2] AD 8B F8 [4] 33 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upackv021BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 [2] AD 8B F8 [4] 33 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXFreakV01HMX0101
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [4] 83 C6 01 FF E6 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXFreakV01HMX0101
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [4] 83 C6 01 FF E6 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnnamedScrambler20p0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00 }

Detection condition:
$a0

Full rule:
rule UnnamedScrambler20p0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00 }

condition:
		$a0
}
YARA Detection Rule: HACKSTOPv100
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FA BD [2] FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HACKSTOPv100
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FA BD [2] FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeShield36wwwexeshieldcom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeShield36wwwexeshieldcom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Pe123v200644
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Pe123v200644
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C0 EB 01 34 60 EB 01 2A 9C EB 02 EA C8 E8 0F 00 00 00 EB 03 3D 23 23 EB 01 4A EB 01 5B C3 8D 40 00 53 EB 01 6C EB 01 7E EB 01 8F E8 15 01 00 00 50 E8 67 04 00 00 EB 01 9A 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SDProtectorV11xRandyLi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [4] 68 88 88 88 08 64 A1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SDProtectorV11xRandyLi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] 68 88 88 88 08 64 A1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: BobPackv100BoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED [4] E8 3D 00 00 00 89 85 [4] 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule BobPackv100BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED [4] E8 3D 00 00 00 89 85 [4] 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DBPEv210
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 6A 10 73 0B EB 02 C1 51 E8 06 [3] C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DBPEv210
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 6A 10 73 0B EB 02 C1 51 E8 06 [3] C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPackv31NorthStar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D [2] FF FF 8A 03 3C 00 74 10 8D 9D [2] FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
	$a1 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D [2] FF FF 8A 03 3C 00 74 10 8D 9D [2] FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 [2] FF FF FF B5 [2] FF FF 8B D6 8B CF 8B 85 [2] FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00 }

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule NsPackv31NorthStar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D [2] FF FF 8A 03 3C 00 74 10 8D 9D [2] FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
	$a1 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D [2] FF FF 8A 03 3C 00 74 10 8D 9D [2] FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 [2] FF FF 89 95 [2] FF FF 01 95 [2] FF FF 8D B5 [2] FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 FF 95 [2] FF FF 85 C0 0F 84 6A 03 00 00 89 85 [2] FF FF E8 00 00 00 00 5B B9 68 03 00 00 03 D9 50 53 E8 B1 02 00 00 61 8B 36 8B FD 03 BD [2] FF FF 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 36 01 13 8B 33 03 7B 04 57 51 52 53 FF B5 [2] FF FF FF B5 [2] FF FF 8B D6 8B CF 8B 85 [2] FF FF 05 AA 05 00 00 FF D0 5B 5A 59 5F 83 F9 00 74 05 83 C3 08 EB C5 68 00 80 00 00 6A 00 }

condition:
		$a0 at pe.entry_point or $a1
}
YARA Detection Rule: SVKProtectorV13XPavolCerven
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 [2] 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SVKProtectorV13XPavolCerven
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 [2] 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 00 00 44 65 62 75 67 67 65 72 20 6F 72 20 74 6F 6F 6C 20 66 6F 72 20 6D 6F 6E 69 74 6F 72 69 6E 67 20 64 65 74 65 63 74 65 64 21 21 21 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakePECrypt102FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakePECrypt102FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02WATCOMCCEXEAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 00 00 00 00 90 90 90 90 57 41 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02WATCOMCCEXEAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 90 90 90 90 57 41 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PENinja
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PENinja: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UpackV036Dwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0B 01 [14] 18 10 00 00 10 00 00 00 [8] 00 10 00 00 00 02 00 00 [12] 00 00 00 00 [32] 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 [4] 14 00 00 00 [64] 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01 }
	$a1 = { BE [4] FF 36 E9 C3 00 00 00 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule UpackV036Dwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B 01 [14] 18 10 00 00 10 00 00 00 [8] 00 10 00 00 00 02 00 00 [12] 00 00 00 00 [32] 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 [4] 14 00 00 00 [64] 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 FF 76 08 FF 76 0C BE 1C 01 }
	$a1 = { BE [4] FF 36 E9 C3 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: yodasProtectorv101AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtectorv101AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPX050070
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 58 83 E8 3D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPX050070
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 83 E8 3D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxVCLencrypted
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 01 B9 [2] 81 34 [2] 46 46 E2 F8 C3 }
	$a1 = { 01 B9 [2] 81 35 [2] 47 47 E2 F8 C3 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule VxVCLencrypted
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 01 B9 [2] 81 34 [2] 46 46 E2 F8 C3 }
	$a1 = { 01 B9 [2] 81 35 [2] 47 47 E2 F8 C3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: VxXRCV1015
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 83 [2] 53 51 1E 06 B4 99 CD 21 80 FC 21 [5] 33 C0 50 8C D8 48 8E C0 1F A1 [2] 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxXRCV1015
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 83 [2] 53 51 1E 06 B4 99 CD 21 80 FC 21 [5] 33 C0 50 8C D8 48 8E C0 1F A1 [2] 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackv118BasicDLLaPLibAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackv118BasicDLLaPLibAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PellesC290300400DLLX86CRTLIB
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D [4] 00 75 07 31 C0 E9 [4] 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PellesC290300400DLLX86CRTLIB
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D [4] 00 75 07 31 C0 E9 [4] 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnnamedScrambler13Bp0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 [4] 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UnnamedScrambler13Bp0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 [4] 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HyingsPEArmor075exeHyingCCG
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 [2] 00 00 00 00 00 00 [2] 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 [19] 00 00 00 00 00 00 00 00 00 74 [3] 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule HyingsPEArmor075exeHyingCCG
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 [2] 00 00 00 00 00 00 [2] 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 [19] 00 00 00 00 00 00 00 00 00 74 [3] 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: SimbiOZPolyCryptorvxxExtranger
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 60 E8 00 00 00 00 5D 81 ED [4] 8D 85 [4] 68 [4] 50 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SimbiOZPolyCryptorvxxExtranger
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 60 E8 00 00 00 00 5D 81 ED [4] 8D 85 [4] 68 [4] 50 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AVPACKv120
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 [2] FC F3 A5 06 BB [2] 53 CB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AVPACKv120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 [2] FC F3 A5 06 BB [2] 53 CB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov220
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov220
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 10 12 41 00 68 F4 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: XPack167
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule XPack167
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NullsoftInstallSystemv1xx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
	$a1 = { 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule NullsoftInstallSystemv1xx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
	$a1 = { 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}