deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: StonesPEEncruptorv113
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 57 56 52 51 53 E8 [4] 5D 8B D5 81 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule StonesPEEncruptorv113
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 57 56 52 51 53 E8 [4] 5D 8B D5 81 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectv11MTEc
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 60 E8 1B [3] E9 FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectv11MTEc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 1B [3] E9 FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CreateInstallStubvxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CreateInstallStubvxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 20 02 00 00 53 56 57 6A 00 FF 15 18 61 40 00 68 00 70 40 00 89 45 08 FF 15 14 61 40 00 85 C0 74 27 6A 00 A1 00 20 40 00 50 FF 15 3C 61 40 00 8B F0 6A 06 56 FF 15 38 61 40 00 6A 03 56 FF 15 38 61 40 00 E9 36 03 00 00 68 02 7F 00 00 33 F6 56 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WinZip32bitSFXv8xmodule
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 FF 15 [3] 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 [4] FF 15 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WinZip32bitSFXv8xmodule
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 FF 15 [3] 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 [4] FF 15 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upxv12MarcusLazlo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Upxv12MarcusLazlo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF EB 05 A4 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 F2 31 C0 40 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 E6 31 C9 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEPACKv10byANAKiN1998
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 74 ?? E9 [4] 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEPACKv10byANAKiN1998
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 ?? E9 [4] 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NeoLitev20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [28] 4E 65 6F 4C 69 74 65 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NeoLitev20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [28] 4E 65 6F 4C 69 74 65 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakeSpalsher1x3xFEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeSpalsher1x3xFEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv10803AlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD }
	$a1 = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E }
	$a2 = { 60 E8 00 00 00 00 5D [6] BB [4] 03 DD }
	$a3 = { 60 E8 00 00 00 00 5D [6] BB [4] 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point

Full rule:
rule ASPackv10803AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD }
	$a1 = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E }
	$a2 = { 60 E8 00 00 00 00 5D [6] BB [4] 03 DD }
	$a3 = { 60 E8 00 00 00 00 5D [6] BB [4] 03 DD 2B 9D B1 50 44 00 83 BD AC 50 44 00 00 89 9D BB 4E }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point
}
YARA Detection Rule: VMProtect07x08PolyTech
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D }

Detection condition:
$a0

Full rule:
rule VMProtect07x08PolyTech
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D }

condition:
		$a0
}
YARA Detection Rule: ExeShieldProtectorV36wwwexeshieldcom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeShieldProtectorV36wwwexeshieldcom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [3] 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WerusCrypter10Kas
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF }

Detection condition:
$a0

Full rule:
rule WerusCrypter10Kas
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 98 11 40 00 6A 00 E8 50 00 00 00 C9 C3 ED B3 FE FF FF 6A 00 E8 0C 00 00 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 A8 10 40 00 FF 25 B0 10 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 BB E8 12 40 00 80 33 05 E9 7D FF FF FF }

condition:
		$a0
}
YARA Detection Rule: Themida10xx1800compressedengineOreansTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
	$a1 = { B8 [4] 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 [4] 03 C7 B9 5A [3] 03 CF EB 0A B8 [4] B9 5A [3] 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Themida10xx1800compressedengineOreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
	$a1 = { B8 [4] 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 [4] 03 C7 B9 5A [3] 03 CF EB 0A B8 [4] B9 5A [3] 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 AF 01 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: CHECKPRGc1992
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 C0 BE [2] 8B D8 B9 [2] BF [2] BA [2] 47 4A 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CHECKPRGc1992
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 C0 BE [2] 8B D8 B9 [2] BF [2] BA [2] 47 4A 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressor11CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [2] 00 00 E9 [2] 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 [2] 00 00 E9 [2] 00 00 E9 [2] 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule eXPressor11CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [2] 00 00 E9 [2] 00 00 E9 ?? 12 00 00 E9 ?? 0C 00 00 E9 [2] 00 00 E9 [2] 00 00 E9 [2] 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxEddie1028
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E FC 83 [2] 81 [3] 4D 5A [2] FA 8B E6 81 C4 [2] FB 3B [5] 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 [2] 07 [3] 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxEddie1028
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E FC 83 [2] 81 [3] 4D 5A [2] FA 8B E6 81 C4 [2] FB 3B [5] 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 [2] 07 [3] 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEQuakev006byfORGAT
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }

Detection condition:
$a0

Full rule:
rule PEQuakev006byfORGAT
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }

condition:
		$a0
}
YARA Detection Rule: LTCv13
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule LTCv13
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv071b7
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 48 11 00 00 C3 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv071b7
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 48 11 00 00 C3 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv071b2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 44 11 00 00 C3 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv071b2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 44 11 00 00 C3 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnknownJoinersignfrompinch[PII_REDACTED]12
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UnknownJoinersignfrompinch[PII_REDACTED]12
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 44 90 4C 90 B9 DE 00 00 00 BA 00 10 40 00 83 C2 03 44 90 4C B9 07 00 00 00 44 90 4C 33 C9 C7 05 08 30 40 00 00 00 00 00 90 68 00 01 00 00 68 21 30 40 00 6A 00 E8 C5 02 00 00 90 6A 00 68 80 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DIETv100v100d
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF [2] 3B FC 72 ?? B4 4C CD 21 BE [2] B9 [2] FD F3 A5 FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DIETv100v100d
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF [2] 3B FC 72 ?? B4 4C CD 21 BE [2] B9 [2] FD F3 A5 FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: APEX_CBLTApex40500mhz
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule APEX_CBLTApex40500mhz
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] B9 FF FF FF 00 01 D0 F7 E2 72 01 48 E2 F7 B9 FF 00 00 00 8B 34 24 80 36 FD 46 E2 FA C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: StealthPEv11
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BA [3] 00 FF E2 BA [3] 00 B8 [4] 89 02 83 C2 03 B8 [4] 89 02 83 C2 FD FF E2 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule StealthPEv11
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA [3] 00 FF E2 BA [3] 00 B8 [4] 89 02 83 C2 03 B8 [4] 89 02 83 C2 FD FF E2 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackFullEdition117DLLAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackFullEdition117DLLAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Anti007V26LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }

Detection condition:
$a0

Full rule:
rule Anti007V26LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }

condition:
		$a0
}
YARA Detection Rule: AppEncryptorSilentTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AppEncryptorSilentTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VirogenCryptv075
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VirogenCryptv075
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 55 E8 EC 00 00 00 87 D5 5D 60 87 D5 80 BD 15 27 40 00 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov300a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov300a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv300v301Extractable
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 6A ?? 06 06 8C D3 83 [2] 53 6A ?? FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv300v301Extractable
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 6A ?? 06 06 8C D3 83 [2] 53 6A ?? FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxUddy2617
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2E [5] 2E [5] 2E [3] 8C C8 8E D8 8C [3] 2B [3] 03 [3] A3 [2] A1 [2] A3 [2] A1 [2] A3 [2] 8C C8 2B [3] 03 [3] A3 [2] B8 AB 9C CD 2F 3D 76 98 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxUddy2617
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E [5] 2E [5] 2E [3] 8C C8 8E D8 8C [3] 2B [3] 03 [3] A3 [2] A1 [2] A3 [2] A1 [2] A3 [2] 8C C8 2B [3] 03 [3] A3 [2] B8 AB 9C CD 2F 3D 76 98 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PLINK[PII_REDACTED]
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FA 8C C7 8C D6 8B CC BA [2] 8E C2 26 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PLINK[PII_REDACTED]
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 8C C7 8C D6 8B CC BA [2] 8E C2 26 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv10804AlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 41 06 00 00 EB 41 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv10804AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 41 06 00 00 EB 41 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: aPackv098m
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E 06 8C C8 8E D8 05 [2] 8E C0 50 BE [2] 33 FF FC B2 ?? BD [2] 33 C9 50 A4 BB [2] 3B F3 76 }

Detection condition:
$a0

Full rule:
rule aPackv098m
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 06 8C C8 8E D8 05 [2] 8E C0 50 BE [2] 33 FF FC B2 ?? BD [2] 33 C9 50 A4 BB [2] 3B F3 76 }

condition:
		$a0
}
YARA Detection Rule: BamBamv001Bedrock
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB [2] 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB [2] 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 [2] 00 A1 2B [2] 00 66 8B 15 2F [2] 00 B9 80 [2] 00 2B CF 89 45 E8 89 0D 6B [2] 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }

Detection condition:
$a0

Full rule:
rule BamBamv001Bedrock
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB [2] 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB [2] 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 [2] 00 A1 2B [2] 00 66 8B 15 2F [2] 00 B9 80 [2] 00 2B CF 89 45 E8 89 0D 6B [2] 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }

condition:
		$a0
}
YARA Detection Rule: PESHiELDv02v02bv02b2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESHiELDv02v02bv02b2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEStealthv27
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEStealthv27
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXEStealthv25
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }

Detection condition:
$a0

Full rule:
rule EXEStealthv25
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }

condition:
		$a0
}
YARA Detection Rule: VxHaryanto
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxHaryanto
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 81 EB 2A 01 8B 0F 1E 5B 03 CB 0E 51 B9 10 01 51 CB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPRStripperv2xunpacked
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB [4] E9 [4] 60 9C FC BF [4] B9 [4] F3 AA 9D 61 C3 55 8B EC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPRStripperv2xunpacked
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB [4] E9 [4] 60 9C FC BF [4] B9 [4] F3 AA 9D 61 C3 55 8B EC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01UPX06Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01UPX06Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Shrinker33
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }

Detection condition:
$a0

Full rule:
rule Shrinker33
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 55 8B EC 56 57 75 65 68 00 01 00 00 E8 }

condition:
		$a0
}
YARA Detection Rule: Shrinker32
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04 }

Detection condition:
$a0

Full rule:
rule Shrinker32
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04 }

condition:
		$a0
}
YARA Detection Rule: Shrinker34
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04 }

Detection condition:
$a0

Full rule:
rule Shrinker34
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 11 0B 00 00 83 C4 04 }

condition:
		$a0
}