deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: hmimysProtectv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 BA 00 00 00 ?? 00 00 00 00 [2] 00 00 10 40 00 [3] 00 [3] 00 00 [2] 00 [3] 00 [3] 00 [3] 00 [3] 00 [3] 00 ?? 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 [3] 00 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 [3] 00 [3] 00 [3] 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 }
	$a1 = { E8 BA 00 00 00 ?? 00 00 00 00 [2] 00 00 10 40 00 [3] 00 [3] 00 00 [2] 00 [3] 00 [3] 00 [3] 00 [3] 00 [3] 00 ?? 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 [3] 00 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 [3] 00 [3] 00 [3] 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 6

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule hmimysProtectv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 BA 00 00 00 ?? 00 00 00 00 [2] 00 00 10 40 00 [3] 00 [3] 00 00 [2] 00 [3] 00 [3] 00 [3] 00 [3] 00 [3] 00 ?? 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 [3] 00 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 [3] 00 [3] 00 [3] 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 }
	$a1 = { E8 BA 00 00 00 ?? 00 00 00 00 [2] 00 00 10 40 00 [3] 00 [3] 00 00 [2] 00 [3] 00 [3] 00 [3] 00 [3] 00 [3] 00 ?? 00 00 00 00 00 00 00 [3] 00 00 00 00 00 00 00 00 00 [3] 00 [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 [3] 00 [3] 00 [3] 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 AD 8B DE 8B F0 83 C3 44 AD 85 C0 74 32 8B F8 56 FF 13 8B E8 AC 84 C0 75 FB AC 84 C0 74 EA 4E AD A9 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1
}
YARA Detection Rule: VProtectorV10Evcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VProtectorV10Evcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0A 5B 56 50 72 6F 74 65 63 74 5D E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01LCCWin32DLLAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 [4] E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01LCCWin32DLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 [4] E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CodeCryptv014b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CodeCryptv014b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 C5 02 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PellesC450DLLX86CRTLIB
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D [4] 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PellesC450DLLX86CRTLIB
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 85 DB 75 0D 83 3D [4] 00 75 04 31 C0 EB 57 83 FB 01 74 05 83 FB 02 75 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EEXEVersion112
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EEXEVersion112
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 3C 03 73 ?? BA 1F 00 0E 1F B4 09 CD 21 B8 FF 4C CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv120EngdulekxtMASM32TASM32
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv120EngdulekxtMASM32TASM32
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C2 2C FB 8D 3D 7E 45 B4 80 E8 02 00 00 00 8A 45 58 68 02 ?? 8C 7F EB 02 CD 20 5E 80 C9 16 03 F7 EB 02 40 B0 68 F4 00 00 00 80 F1 2C 5B C1 E9 05 0F B6 C9 8A 16 0F B6 C9 0F BF C7 2A D3 E8 02 00 00 00 99 4C 58 80 EA 53 C1 C9 16 2A D3 E8 02 00 00 00 9D CE }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEDiminisherv01Teraphy
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEDiminisherv01Teraphy
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 50 E8 02 01 00 00 8B FD 8D 9D 9A 33 40 00 8B 1B 8D 87 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02VBOX43MTEAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02VBOX43MTEAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SEAAXE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC BC [2] 0E 1F E8 [2] 26 A1 [2] 8B 1E [2] 2B C3 8E C0 B1 ?? D3 E3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SEAAXE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC BC [2] 0E 1F E8 [2] 26 A1 [2] 8B 1E [2] 2B C3 8E C0 B1 ?? D3 E3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UpackV010V011Dwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [4] AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D [6] B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UpackV010V011Dwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [4] AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D [6] B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakePCGuard403415FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakePCGuard403415FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SimplePack111Method1bagieTMX
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 [2] 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC }
	$a1 = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 [2] 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE [4] 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule SimplePack111Method1bagieTMX
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 [2] 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC }
	$a1 = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 [2] 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE [4] 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: MASM32
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MASM32: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A ?? 68 00 30 40 00 68 ?? 30 40 00 6A 00 E8 07 00 00 00 6A 00 E8 06 00 00 00 FF 25 08 20 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftDefenderv10v11
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 [4] 58 05 BA 01 [2] 03 C8 74 BE 75 BC E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftDefenderv10v11
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 CD ?? 59 9C 50 74 0A 75 08 E8 59 C2 04 ?? 55 8B EC E8 F4 FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 [4] 58 05 BA 01 [2] 03 C8 74 BE 75 BC E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: XtremeProtectorv106
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [3] 00 B9 75 [2] 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule XtremeProtectorv106
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [3] 00 B9 75 [2] 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VcasmProtector1112vcasm
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VcasmProtector1112vcasm
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidiumv1111
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 E7 1C 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidiumv1111
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 E7 1C 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxEddie1530
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 81 EE [2] FC 2E [4] 4D 5A [2] FA 8B E6 81 C4 [2] FB 3B [5] 2E [4] 50 06 56 1E 33 C0 50 1F C4 [3] 2E [4] 2E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxEddie1530
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 81 EE [2] FC 2E [4] 4D 5A [2] FA 8B E6 81 C4 [2] FB 3B [5] 2E [4] 50 06 56 1E 33 C0 50 1F C4 [3] 2E [4] 2E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: KBySV028DLLshoooo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] BA [4] 03 C2 FF E0 [4] 60 E8 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule KBySV028DLLshoooo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] BA [4] 03 C2 FF E0 [4] 60 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEncrypt10JunkCode
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C BE 00 10 40 00 8B FE B9 [4] BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 [3] FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEncrypt10JunkCode
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C BE 00 10 40 00 8B FE B9 [4] BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 [3] FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEPasswordv02SMTSMF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 04 [3] 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF [4] 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEPasswordv02SMTSMF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 [3] 8B EC 5D C3 33 C0 5D 8B FD 81 ED 33 26 40 ?? 81 EF [4] 83 EF 05 89 AD 88 27 40 ?? 8D 9D 07 29 40 ?? 8D B5 62 28 40 ?? 46 80 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EncryptPE[PII_REDACTED]0061025WFS
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EncryptPE[PII_REDACTED]0061025WFS
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [36] 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptorv16Vaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 D0 68 [4] FF D2 }
	$a1 = { 33 D0 68 [4] FF D2 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule RCryptorv16Vaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 D0 68 [4] FF D2 }
	$a1 = { 33 D0 68 [4] FF D2 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PEPaCKv10CCopyright1998byANAKiN
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }

Detection condition:
$a0

Full rule:
rule PEPaCKv10CCopyright1998byANAKiN
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }

condition:
		$a0
}
YARA Detection Rule: YodasProtectorv1032Beta2AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule YodasProtectorv1032Beta2AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxMTEnonencrypted
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F7 D9 80 E1 FE 75 02 49 49 97 A3 [2] 03 C1 24 FE 75 02 48 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxMTEnonencrypted
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D9 80 E1 FE 75 02 49 49 97 A3 [2] 03 C1 24 FE 75 02 48 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01FSG131Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01FSG131Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv212AlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
	$a1 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule ASPackv212AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
	$a1 = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: Upack022023betaDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
	$a1 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
	$a2 = { AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }

Detection condition:
$a0 or $a1 at pe.entry_point or $a2 at pe.entry_point

Full rule:
rule Upack022023betaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
	$a1 = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
	$a2 = { AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 ?? 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }

condition:
		$a0 or $a1 at pe.entry_point or $a2 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01CodeLockAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01CodeLockAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv100c1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2E 8C 1E [2] 8B 1E [2] 8C DA 81 C2 [2] 3B DA 72 ?? 81 EB [2] 83 EB ?? FA 8E D3 BC [2] FB FD BE [2] 8B FE }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv100c1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E 8C 1E [2] 8B 1E [2] 8C DA 81 C2 [2] 3B DA 72 ?? 81 EB [2] 83 EB ?? FA 8E D3 BC [2] FB FD BE [2] 8B FE }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakenSPack13emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakenSPack13emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}