deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PseudoSigner01PackMaster10PEXCloneAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PackMaster10PEXCloneAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 01 00 00 E8 83 C4 04 E8 01 90 90 90 E9 5D 81 ED D3 22 40 90 E8 04 02 90 90 E8 EB 08 EB 02 CD 20 FF 24 24 9A 66 BE 47 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Upackv037v038BetaStripbaserelocationtableOptionDwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }

Detection condition:
$a0

Full rule:
rule Upackv037v038BetaStripbaserelocationtableOptionDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }

condition:
		$a0
}
YARA Detection Rule: AHTeamEPProtector03fakeSVKP13xFEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeSVKP13xFEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 00 00 00 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: InstallShieldCustom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 EC 44 56 FF 15 [2] 41 00 8B F0 85 F6 75 08 6A FF FF 15 [2] 41 00 8A 06 57 8B 3D [2] 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule InstallShieldCustom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 EC 44 56 FF 15 [2] 41 00 8B F0 85 F6 75 08 6A FF FF 15 [2] 41 00 8A 06 57 8B 3D [2] 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Petitevafterv14
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 66 9C 60 50 8D [5] 68 [4] 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Petitevafterv14
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 66 9C 60 50 8D [5] 68 [4] 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeToolsv21EncruptorbyDISMEMBER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5D 83 [2] 1E 8C DA 83 [2] 8E DA 8E C2 BB [2] BA [2] 85 D2 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeToolsv21EncruptorbyDISMEMBER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5D 83 [2] 1E 8C DA 83 [2] 8E DA 8E C2 BB [2] BA [2] 85 D2 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NTkrnlSecureSuiteNTkrnlteam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 }

Detection condition:
$a0

Full rule:
rule NTkrnlSecureSuiteNTkrnlteam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 }

condition:
		$a0
}
YARA Detection Rule: PESpinv0b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESpinv0b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VXTibsZhelatinStormWormvariant
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FF 74 24 1C 58 8D 80 [2] 77 04 50 68 62 34 35 04 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VXTibsZhelatinStormWormvariant
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 74 24 1C 58 8D 80 [2] 77 04 50 68 62 34 35 04 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakePEX099emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakePEX099emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NSPack3xLiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [2] FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NSPack3xLiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [2] FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv25RetailBitsumTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [3] 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv25RetailBitsumTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [3] 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WARNINGTROJANXiaoHui
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WARNINGTROJANXiaoHui
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 9C E8 00 00 00 00 5D B8 ?? 85 40 00 2D ?? 85 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NFOv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NFOv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PMODEWv[PII_REDACTED]3DOSextender
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC 16 07 BF [2] 8B F7 57 B9 [2] F3 A5 06 1E 07 1F 5F BE [2] 06 0E A4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PMODEWv[PII_REDACTED]3DOSextender
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 16 07 BF [2] 8B F7 57 B9 [2] F3 A5 06 1E 07 1F 5F BE [2] 06 0E A4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AaseCrypterbysantasdad
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 [4] DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF }

Detection condition:
$a0

Full rule:
rule AaseCrypterbysantasdad
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 B8 A0 3E 00 10 E8 93 DE FF FF 68 F8 42 00 10 E8 79 DF FF FF 68 00 43 00 10 68 0C 43 00 10 E8 42 DF FF FF 50 E8 44 DF FF FF A3 98 66 00 10 83 3D 98 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 1C 43 00 10 6A 00 E8 4B DF FF FF 68 2C 43 00 10 68 0C 43 [4] DF FF FF 50 E8 0E DF FF FF A3 94 66 00 10 83 3D 94 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 38 43 00 10 6A 00 E8 15 DF FF FF 68 48 43 00 10 68 0C 43 00 10 E8 D6 DE FF FF 50 E8 D8 DE FF FF A3 A0 66 00 10 83 3D A0 66 00 10 00 75 13 6A 00 68 18 43 00 10 68 58 43 00 10 6A 00 E8 DF DE FF FF 68 6C 43 00 10 68 0C 43 00 10 E8 A0 DE FF FF 50 E8 A2 DE FF FF }

condition:
		$a0
}
YARA Detection Rule: aPackv098bJibz
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 93 07 1F 05 [2] 8E D0 BC [2] EA }

Detection condition:
$a0

Full rule:
rule aPackv098bJibz
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 93 07 1F 05 [2] 8E D0 BC [2] EA }

condition:
		$a0
}
YARA Detection Rule: UPackv011Dwing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 }

Detection condition:
$a0

Full rule:
rule UPackv011Dwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 1C F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9E 0C 10 00 00 B0 01 67 E3 29 8B D7 }

condition:
		$a0
}
YARA Detection Rule: NsPacKNetLiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 [3] 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C }

Detection condition:
$a0

Full rule:
rule NsPacKNetLiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 BB 01 47 65 74 53 79 73 74 65 6D 49 6E 66 6F 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 5E 00 5F 43 6F 72 [3] 4D 61 69 6E 00 6D 73 63 6F 72 65 65 2E 64 6C 6C }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner02PENightMare2BetaAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02PENightMare2BetaAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01MicrosoftVisualC60DebugVersionAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 [4] 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01MicrosoftVisualC60DebugVersionAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 [4] 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DJoinv07publicRC4encryptiondrmist
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C6 05 [2] 40 00 00 C6 05 [2] 40 00 00 [8] 00 [4] 00 [5] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DJoinv07publicRC4encryptiondrmist
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C6 05 [2] 40 00 00 C6 05 [2] 40 00 00 [8] 00 [4] 00 [5] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXv103v104
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXv103v104
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEDiminisherV01Teraphy
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEDiminisherV01Teraphy
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 51 52 56 57 55 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv305c4ExtrPasswcheckVirshield
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 05 C0 1A B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv305c4ExtrPasswcheckVirshield
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 C0 1A B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeGuarderv18Exeiconcom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeGuarderv18Exeiconcom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: codeCrypter031Tibbar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 58 53 5B 90 BB [3] 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule codeCrypter031Tibbar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 58 53 5B 90 BB [3] 00 FF E3 90 CC CC CC 55 8B EC 5D C3 CC CC CC CC CC CC CC CC CC CC CC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPv073betaap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 [2] 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }

Detection condition:
$a0

Full rule:
rule RLPv073betaap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 [2] 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }

condition:
		$a0
}
YARA Detection Rule: PEnguinCryptv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 93 [2] 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEnguinCryptv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 93 [2] 00 55 50 67 64 FF 36 00 00 67 64 89 26 00 00 BD 4B 48 43 42 B8 04 00 00 00 CC 3C 04 75 04 90 90 C3 90 67 64 8F 06 00 00 58 5D BB 00 00 40 00 33 C9 33 C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MetrowerksCodeWarriorDLLv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 [4] 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }

Detection condition:
$a0

Full rule:
rule MetrowerksCodeWarriorDLLv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 [4] 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }

condition:
		$a0
}
YARA Detection Rule: PECrc32088ZhouJinYu
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECrc32088ZhouJinYu
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv123b3v1241
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv123b3v1241
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 08 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Noodlecrypt2rsc
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 9A E8 76 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Noodlecrypt2rsc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 9A E8 76 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPack120BasicEditionLZMAAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPack120BasicEditionLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01PENightMare2BetaAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01PENightMare2BetaAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AHTeamEPProtector03fakeXtremeProtector105FEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 [46] 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AHTeamEPProtector03fakeXtremeProtector105FEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 [46] 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackv118BasicDLLLZMAAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackv118BasicDLLLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrypKeyv5v6
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] 58 83 E8 05 50 5F 57 8B F7 81 EF [4] 83 C6 39 BA [4] 8B DF B9 0B [3] 8B 06 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrypKeyv5v6
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 58 83 E8 05 50 5F 57 8B F7 81 EF [4] 83 C6 39 BA [4] 8B DF B9 0B [3] 8B 06 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: InnoSetupModulev109a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule InnoSetupModulev109a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }

condition:
		$a0 at pe.entry_point
}