deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PESPinv13Cyberbob
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESPinv13Cyberbob
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv160v165
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv160v165
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressorv120b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 [3] 00 2B 05 84 [2] 00 A3 [3] 00 83 3D [3] 00 00 74 16 A1 [3] 00 03 05 80 [2] 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 [3] 00 01 00 00 00 68 04 }

Detection condition:
$a0

Full rule:
rule eXPressorv120b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 [3] 00 2B 05 84 [2] 00 A3 [3] 00 83 3D [3] 00 00 74 16 A1 [3] 00 03 05 80 [2] 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 [3] 00 01 00 00 00 68 04 }

condition:
		$a0
}
YARA Detection Rule: EPWv12
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 06 57 1E 56 55 52 51 53 50 2E [4] 8C C0 05 [2] 2E [3] 8E D8 A1 [2] 2E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EPWv12
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 57 1E 56 55 52 51 53 50 2E [4] 8C C0 05 [2] 2E [3] 8E D8 A1 [2] 2E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectv12x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 68 01 [3] C3 AA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtectv12x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 68 01 [3] C3 AA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Packanoidv1Arkanoid
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF [4] BE [4] E8 9D 00 00 00 B8 [4] 8B 30 8B 78 04 BB [4] 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Packanoidv1Arkanoid
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF [4] BE [4] E8 9D 00 00 00 B8 [4] 8B 30 8B 78 04 BB [4] 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EscargotV01Meat
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 04 40 30 2E 31 60 68 61 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EscargotV01Meat
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 40 30 2E 31 60 68 61 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SCObfuscatorSuperCRacker
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 33 C9 8B 1D 00 [3] 03 1D 08 [3] 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 [3] 75 E7 A1 08 [3] 01 05 0C [3] 61 FF 25 0C }

Detection condition:
$a0

Full rule:
rule SCObfuscatorSuperCRacker
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 33 C9 8B 1D 00 [3] 03 1D 08 [3] 8A 04 19 84 C0 74 09 3C ?? 74 05 34 ?? 88 04 19 41 3B 0D 04 [3] 75 E7 A1 08 [3] 01 05 0C [3] 61 FF 25 0C }

condition:
		$a0
}
YARA Detection Rule: EXEStealth275WebtoolMaster
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEStealth275WebtoolMaster
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 90 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PasswordProtectorcMiniSoft1992
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PasswordProtectorcMiniSoft1992
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxEddie2000
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 81 EE [2] FC 2E [4] 2E [4] 4D 5A [2] FA 8B E6 81 C4 [2] FB 3B [5] 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 [3] B4 30 CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxEddie2000
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 81 EE [2] FC 2E [4] 2E [4] 4D 5A [2] FA 8B E6 81 C4 [2] FB 3B [5] 50 06 56 1E 8B FE 33 C0 50 8E D8 C5 [3] B4 30 CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VideoLanClientUnknownCompiler
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 [15] FF FF [19] 00 [7] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VideoLanClientUnknownCompiler
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 [15] FF FF [19] 00 [7] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressorv14CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8 }
	$a1 = { 65 58 50 72 2D 76 2E 31 2E 34 2E }

Detection condition:
$a0 at pe.entry_point or $a1

Full rule:
rule eXPressorv14CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 34 2E 2E B8 }
	$a1 = { 65 58 50 72 2D 76 2E 31 2E 34 2E }

condition:
		$a0 at pe.entry_point or $a1
}
YARA Detection Rule: SkDUndetectablerPro20NoUPXMethodSkD
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SkDUndetectablerPro20NoUPXMethodSkD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 B8 FC 26 00 10 E8 EC F3 FF FF 6A 0F E8 15 F5 FF FF E8 64 FD FF FF E8 BB ED FF FF 8D 40 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RJcrushv100
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 06 FC 8C C8 BA [2] 03 D0 52 BA [2] 52 BA [2] 03 C2 8B D8 05 [2] 8E DB 8E C0 33 F6 33 FF B9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RJcrushv100
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 FC 8C C8 BA [2] 03 D0 52 BA [2] 52 BA [2] 03 C2 8B D8 05 [2] 8E DB 8E C0 33 F6 33 FF B9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeShieldv27
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeShieldv27
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeShieldv29
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC [3] F8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeShieldv29
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC [3] F8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEiDBundlev102v103BoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 [3] 2E [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEiDBundlev102v103BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 [3] 2E [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMicrosoftVisualC5060
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 [3] EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMicrosoftVisualC5060
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 [3] EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PUNiSHERV15FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }

Detection condition:
$a0

Full rule:
rule PUNiSHERV15FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }

condition:
		$a0
}
YARA Detection Rule: ExcaliburV103forgot
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExcaliburV103forgot
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPack10betaap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 [4] 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 }
	$a1 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 [4] 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 8

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule RLPack10betaap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 [4] 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 }
	$a1 = { 60 E8 00 00 00 00 8D 64 24 04 8B 6C 24 FC 8D B5 4C 02 00 00 8D 9D 13 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 [4] 6A 00 FF 95 F9 01 00 00 89 85 48 02 00 00 5B FF B5 48 02 00 00 56 FF D3 83 C4 08 8B B5 48 02 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 83 C0 04 89 85 44 02 00 00 EB 7A 56 FF 95 F1 01 00 00 89 85 40 02 00 00 8B C6 EB 4F 8B 85 44 02 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 44 02 00 00 C7 00 20 20 20 00 EB 06 FF B5 44 02 00 00 FF B5 40 02 00 00 FF 95 F5 01 00 00 89 07 83 C7 04 8B 85 44 02 00 00 EB 01 40 80 38 00 75 FA 40 89 85 44 02 00 00 80 38 00 75 AC EB 01 46 80 3E 00 75 FA 46 40 8B 38 83 C0 04 89 85 44 02 00 00 80 3E 01 75 81 68 00 40 00 00 68 [4] FF B5 48 02 00 00 FF 95 FD 01 00 00 61 68 [4] C3 60 8B 74 24 24 8B 7C }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: nMacrorecorder10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }

Detection condition:
$a0

Full rule:
rule nMacrorecorder10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }

condition:
		$a0
}
YARA Detection Rule: PrivateEXEv20a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 E8 00 00 00 00 5B 8B C3 2D }
	$a1 = { 06 60 C8 [3] 0E 68 [2] 9A [4] 3D [2] 0F [3] 50 50 0E 68 [2] 9A [4] 0E }
	$a2 = { 53 E8 [4] 5B 8B C3 2D [4] 50 81 [5] 8B }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point

Full rule:
rule PrivateEXEv20a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 E8 00 00 00 00 5B 8B C3 2D }
	$a1 = { 06 60 C8 [3] 0E 68 [2] 9A [4] 3D [2] 0F [3] 50 50 0E 68 [2] 9A [4] 0E }
	$a2 = { 53 E8 [4] 5B 8B C3 2D [4] 50 81 [5] 8B }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}
YARA Detection Rule: PackmanV10BrandonLaCombe
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PackmanV10BrandonLaCombe
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01PEX099Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PEX099Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PAKSFXArchive
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 [2] A1 [2] 2E [3] 2E [5] 8C D7 8E C7 8D [2] BE [2] FC AC 3C 0D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PAKSFXArchive
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 [2] A1 [2] 2E [3] 2E [5] 8C D7 8E C7 8D [2] BE [2] FC AC 3C 0D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv2xxAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
	$a1 = { A8 03 [2] 61 75 08 B8 01 [3] C2 0C ?? 68 [4] C3 8B 85 26 04 [2] 8D 8D 3B 04 [2] 51 50 FF 95 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule ASPackv2xxAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A8 03 00 00 61 75 08 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 C3 8B 85 26 04 00 00 8D 8D 3B 04 00 00 51 50 FF 95 }
	$a1 = { A8 03 [2] 61 75 08 B8 01 [3] C2 0C ?? 68 [4] C3 8B 85 26 04 [2] 8D 8D 3B 04 [2] 51 50 FF 95 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: SimbiOZ13Extranger
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 57 57 8D 7C 24 04 50 B8 00 [3] AB 58 5F C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SimbiOZ13Extranger
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 57 57 8D 7C 24 04 50 B8 00 [3] AB 58 5F C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: muckisprotectorImucki
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [4] B9 [4] 8A 06 F6 D0 88 06 46 E2 F7 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule muckisprotectorImucki
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [4] B9 [4] 8A 06 F6 D0 88 06 46 E2 F7 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium1339ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 28 EB 02 [2] 33 C0 EB 02 [2] C3 EB 03 [3] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 [3] 33 C0 EB 03 [3] 8B 00 EB 04 [4] C3 EB 04 [4] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 02 [2] EB 04 [4] 58 EB 03 [3] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 04 [4] E8 CF 27 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1339ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 01 ?? 8B 54 24 0C EB 04 [4] 83 82 B8 00 00 00 28 EB 02 [2] 33 C0 EB 02 [2] C3 EB 03 [3] EB 04 [4] 64 67 FF 36 00 00 EB 03 [3] 64 67 89 26 00 00 EB 01 ?? EB 01 ?? 50 EB 03 [3] 33 C0 EB 03 [3] 8B 00 EB 04 [4] C3 EB 04 [4] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 02 [2] EB 04 [4] 58 EB 03 [3] EB 04 [4] 64 67 8F 06 00 00 EB 03 [3] 83 C4 04 EB 04 [4] E8 CF 27 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: LOCK98V10028keenvim
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 E8 00 00 00 00 5D 81 [5] EB 05 E9 [4] EB 08 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule LOCK98V10028keenvim
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 00 00 00 00 5D 81 [5] EB 05 E9 [4] EB 08 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: iPBProtectv013
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 }

Detection condition:
$a0

Full rule:
rule iPBProtectv013
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 4B 43 55 46 68 54 49 48 53 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 FA 33 DB 89 5D F8 6A 02 EB 01 F8 58 5F 5E 5B 64 8B 25 00 00 00 00 64 8F 05 00 00 00 00 58 58 58 5D 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 }

condition:
		$a0
}
YARA Detection Rule: PrivateEXEProtector197SetiSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }

Detection condition:
$a0

Full rule:
rule PrivateEXEProtector197SetiSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }

condition:
		$a0
}
YARA Detection Rule: ASPackv21AlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv21AlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv103bAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv103bAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 87 25 [4] 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }

Detection condition:
$a0

Full rule:
rule FSGv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 87 25 [4] 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner01PEIntro10Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PEIntro10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A E9 }

condition:
		$a0 at pe.entry_point
}