deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: BobSoftMiniDelphiBoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 56 B8 [4] E8 [4] 33 C0 55 68 [4] 64 FF 30 64 89 20 B8 }
	$a1 = { 55 8B EC 83 C4 F0 53 B8 [4] E8 [4] 33 C0 55 68 [4] 64 FF 30 64 89 20 B8 [4] E8 }
	$a2 = { 55 8B EC 83 C4 F0 B8 [4] E8 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point

Full rule:
rule BobSoftMiniDelphiBoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 [4] E8 [4] 33 C0 55 68 [4] 64 FF 30 64 89 20 B8 }
	$a1 = { 55 8B EC 83 C4 F0 53 B8 [4] E8 [4] 33 C0 55 68 [4] 64 FF 30 64 89 20 B8 [4] E8 }
	$a2 = { 55 8B EC 83 C4 F0 B8 [4] E8 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}
YARA Detection Rule: UltraProV10SafeNet
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { A1 [4] 85 C0 0F 85 3B 06 00 00 55 56 C7 05 [4] 01 00 00 00 FF 15 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UltraProV10SafeNet
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 [4] 85 C0 0F 85 3B 06 00 00 55 56 C7 05 [4] 01 00 00 00 FF 15 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv1242v1243
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv1242v1243
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimplePack121build0909Method2bagie
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 [3] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule SimplePack121build0909Method2bagie
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 5A 90 EB 01 00 52 E9 8A 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 [3] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: Obsidium13037ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 26 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 [2] C3 EB 01 ?? EB 04 [4] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 03 [3] 33 C0 EB 03 [3] 8B 00 EB 04 [4] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 04 [4] EB 01 ?? 58 EB 02 [2] EB 03 [3] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 [3] E8 23 27 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium13037ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 26 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 26 EB 01 ?? 33 C0 EB 02 [2] C3 EB 01 ?? EB 04 [4] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 01 ?? EB 03 [3] 50 EB 03 [3] 33 C0 EB 03 [3] 8B 00 EB 04 [4] C3 EB 03 [3] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 04 [4] EB 01 ?? 58 EB 02 [2] EB 03 [3] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 03 [3] E8 23 27 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxPhoenix927
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 5E 81 C6 [2] BF 00 01 B9 04 00 F3 A4 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxPhoenix927
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 5E 81 C6 [2] BF 00 01 B9 04 00 F3 A4 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Petite14c199899IanLuck
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 [2] 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Petite14c199899IanLuck
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 [2] 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressorV10CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule eXPressorV10CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 00 00 E9 E9 02 00 00 E9 EF 0B 00 00 E9 1B 0D 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RECryptv07xCruddRETh2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 [2] 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RECryptv07xCruddRETh2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 [2] 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PassEXEv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 06 1E 0E 0E 07 1F BE [2] B9 [2] 87 14 81 [3] EB ?? C7 [3] 84 00 87 [3] FB 1F 58 4A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PassEXEv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 1E 0E 0E 07 1F BE [2] B9 [2] 87 14 81 [3] EB ?? C7 [3] 84 00 87 [3] FB 1F 58 4A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RECryptv07xCruddRETh1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 [2] 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RECryptv07xCruddRETh1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 61 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 [2] 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WIBUKeyV410Ahttpwibucomus
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F7 05 [4] FF 00 00 00 75 12 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WIBUKeyV410Ahttpwibucomus
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 05 [4] FF 00 00 00 75 12 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Mew501NorthFoxHCC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 [2] 00 [3] 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Mew501NorthFoxHCC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 [2] 00 [3] 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01ExeSmasherAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01ExeSmasherAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnnamedScrambler12C12Dp0ke
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A [2] E8 ?? EC FF FF 33 C0 55 68 [4] 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 [2] FF FF B8 20 [3] 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 [3] 6A 00 FF 15 10 [3] BA [4] B8 14 [3] E8 [2] FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 [3] 8B 0D 14 [3] E8 [2] FF FF 8B 05 88 [3] 8B D0 B8 54 [3] E8 ?? E3 FF FF B8 54 [3] E8 ?? E2 FF FF 8B D0 B8 18 [3] 8B 0D 88 [3] E8 ?? D6 FF FF FF 35 34 [3] FF 35 30 [3] FF 35 3C [3] FF 35 38 [3] 8D 55 E8 A1 88 [3] E8 ?? F0 FF FF 8B 55 E8 B9 54 }

Detection condition:
$a0

Full rule:
rule UnnamedScrambler12C12Dp0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 05 00 00 00 6A 00 6A 00 49 75 F9 51 53 56 57 B8 ?? 3A [2] E8 ?? EC FF FF 33 C0 55 68 [4] 64 FF 30 64 89 20 E8 ?? D7 FF FF E8 [2] FF FF B8 20 [3] 33 C9 BA 04 01 00 00 E8 ?? DB FF FF 68 04 01 00 00 68 20 [3] 6A 00 FF 15 10 [3] BA [4] B8 14 [3] E8 [2] FF FF 85 C0 0F 84 ?? 04 00 00 BA 18 [3] 8B 0D 14 [3] E8 [2] FF FF 8B 05 88 [3] 8B D0 B8 54 [3] E8 ?? E3 FF FF B8 54 [3] E8 ?? E2 FF FF 8B D0 B8 18 [3] 8B 0D 88 [3] E8 ?? D6 FF FF FF 35 34 [3] FF 35 30 [3] FF 35 3C [3] FF 35 38 [3] 8D 55 E8 A1 88 [3] E8 ?? F0 FF FF 8B 55 E8 B9 54 }

condition:
		$a0
}
YARA Detection Rule: AlexProtectorv04beta1byAlex
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 }

Detection condition:
$a0

Full rule:
rule AlexProtectorv04beta1byAlex
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 C7 83 C4 04 33 C9 E8 01 00 00 00 68 83 C4 04 E8 01 00 00 00 68 83 C4 04 B9 ?? 00 00 00 E8 01 00 00 00 68 83 C4 04 E8 00 00 00 00 E8 01 00 00 00 C7 83 C4 04 8B 2C 24 83 C4 04 E8 01 00 00 00 A9 83 C4 04 81 ED 3C 13 40 00 E8 01 00 00 00 68 }

condition:
		$a0
}
YARA Detection Rule: UG2002Cruncherv03b3
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED [4] E8 0D [16] 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UG2002Cruncherv03b3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED [4] E8 0D [16] 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FishPEShield101HellFish
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14 }
	$a1 = { 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 [4] C4 03 00 00 BC A0 00 00 00 40 01 00 [4] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40 }

Detection condition:
$a0 or $a1 at pe.entry_point

Full rule:
rule FishPEShield101HellFish
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D0 53 56 57 8B 45 10 83 C0 0C 8B 00 89 45 DC 83 7D DC 00 75 08 E8 AD FF FF FF 89 45 DC E8 C1 FE FF FF 8B 10 03 55 DC 89 55 E4 83 C0 04 8B 10 89 55 FC 83 C0 04 8B 10 89 55 F4 83 C0 04 8B 10 89 55 F8 83 C0 04 8B 10 89 55 F0 83 C0 04 8B 10 89 55 EC 83 C0 04 8B 00 89 45 E8 8B 45 E4 8B 58 04 03 5D E4 8B FB 8B 45 E4 8B 30 4E 85 F6 72 2B 46 C7 45 E0 00 00 00 00 83 7B 04 00 74 14 }
	$a1 = { 60 E8 12 FE FF FF C3 90 09 00 00 00 2C 00 00 00 [4] C4 03 00 00 BC A0 00 00 00 40 01 00 [4] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 28 88 00 00 40 ?? 4B 00 00 00 02 00 00 00 A0 00 00 18 01 00 00 40 ?? 4C 00 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 40 ?? 4E 00 00 00 00 00 00 00 C0 00 00 40 39 00 00 40 ?? 4E 00 00 00 08 00 00 00 00 01 00 C8 06 00 00 40 }

condition:
		$a0 or $a1 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01Neolite20Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01Neolite20Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEIntrov10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 04 24 9C 60 E8 [4] 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 [2] 0F 85 48 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEIntrov10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 9C 60 E8 [4] 5D 81 ED 0A 45 40 ?? 80 BD 67 44 40 [2] 0F 85 48 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidiumv1250ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidiumv1250ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DevC4992BloodshedSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 [3] 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 [3] 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D [3] 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DevC4992BloodshedSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 [3] 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 [3] 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D [3] 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackV119DllLZMA430ap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 [4] 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 0

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackV119DllLZMA430ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 [4] 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 [4] FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 [4] 61 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: XJXPALLiNSoN
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [2] 40 00 68 [2] 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule XJXPALLiNSoN
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [2] 40 00 68 [2] 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov220b1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov220b1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptor20Vaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 [4] F7 D1 83 F1 FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RCryptor20Vaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 [4] F7 D1 83 F1 FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SentinelSuperProAutomaticProtectionv641Safenet
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { A1 [4] 55 8B [3] 85 C0 74 ?? 85 ED 75 ?? A1 [4] 50 55 FF 15 [4] 8B 0D [4] 55 51 FF 15 [4] 85 C0 74 ?? 8B 15 [4] 52 FF 15 [4] 6A 00 6A 00 68 [4] E8 [4] B8 01 00 00 00 5D C2 0C 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SentinelSuperProAutomaticProtectionv641Safenet
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A1 [4] 55 8B [3] 85 C0 74 ?? 85 ED 75 ?? A1 [4] 50 55 FF 15 [4] 8B 0D [4] 55 51 FF 15 [4] 85 C0 74 ?? 8B 15 [4] 52 FF 15 [4] 6A 00 6A 00 68 [4] E8 [4] B8 01 00 00 00 5D C2 0C 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: TMTPascalv040
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0E 1F 06 8C 06 [2] 26 A1 [2] A3 [2] 8E C0 66 33 FF 66 33 C9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule TMTPascalv040
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0E 1F 06 8C 06 [2] 26 A1 [2] A3 [2] 8E C0 66 33 FF 66 33 C9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02CrunchPEHeuristicAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02CrunchPEHeuristicAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakeMSVCDLLMethod4emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeMSVCDLLMethod4emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VcAsmProtectorV10XVcAsm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [4] 68 [4] 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VcAsmProtectorV10XVcAsm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] 68 [4] 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VBOXv42MTE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VBOXv42MTE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C E0 0B C5 8C E0 0B C4 03 C5 74 00 74 00 8B C5 }

condition:
		$a0 at pe.entry_point
}