deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: IProtect10FxlibdllmodebyFuXdas
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8

Detection condition:
$a0 at pe.entry_point

Full rule:
rule IProtect10FxlibdllmodebyFuXdas
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 33 2E 46 55 58 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 46 78 4C 69 62 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [3] 00 60 E8 00 00 00 00 5D 81 ED 71 10 40 00 FF 74 24 20 E8 40 00 00 00 0B C0 74 2F 89 85 63 10 40 00 8D 85 3C 10 40 00 50 FF B5 63 10 40 00 E8 92 00 00 00 0B C0 74 13 89 85 5F 10 40 00 8D 85 49 10 40 00 50 FF 95 5F 10 40 00 8B 85 67 10 40 00 89 44 24 1C 61 FF E0 8B 7C 24 04 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 81 E7 00 00 FF FF 66 81 3F 4D 5A 75 0F 8B F7 03 76 3C 81 3E 50 45 00 00 75 02 EB 17 81 EF 00 00 01 00 81 FF 00 00 00 70 73 07 BF 00 00 F7 BF EB 02 EB D3 97 64 8F 05 00 00 00 00 83 C4 04 C2 04 00 8D 85 00 10 40 00 50 64 FF 35 00 00 00 00 8D 85 53 10 40 00 89 20 89 68 04 8D 9D 0A 11 40 00 89 58 08 64 89 25 00 00 00 00 8B 74 24 0C 66 81 3E 4D 5A 74 05 E9 8A 00 00 00 03 76 3C 81 3E 50 45 00 00 74 02 EB 7D 8B 7C 24 10 B9 96 00 00 00 32 C0 F2 AE 8B CF 2B 4C 24 10 8B 56 78 03 54 24 0C 8B 5A 20 03 5C 24 0C 33 C0 8B 3B 03 7C 24 0C 8B 74 24 10 51 F3 A6 75 05 83 C4 04 EB 0A 59 83 C3 04 40 3B 42 18 75 E2 3B 42 18 75 02 EB 35 8B 72 24 03 74 24 0C 52 BB 02 00 00 00 33 D2 F7 E3 5A 03 C6 33 C9 66 8B 08 8B 7A 1C 33 D2 BB 04 00 00 00 8B C1 F7 E3 03 44 24 0C 03 C7 8B 00 03 44 24 0C EB 02 33 C0 64 8F 05 00 00 00 00 83 C4 04 C2 08 00 E8 FA FD FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02DxPack10Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02DxPack10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SecureEXE30ZipWorx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 B8 00 00 00 [3] 00 [3] 00 [3] 00 00 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SecureEXE30ZipWorx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 B8 00 00 00 [3] 00 [3] 00 [3] 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressorv12CGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
	$a1 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 [4] 2B 05 84 [3] A3 [4] 83 3D [4] 00 74 16 A1 [4] 03 05 80 [3] 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 [4] 01 00 00 00 68 04 }
	$a2 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 [4] 2B 05 84 [3] A3 [4] 83 3D [4] 00 74 16 A1 [4] 03 05 80 [3] 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 [4] 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }

Detection condition:
$a0 or $a1 at pe.entry_point or $a2 at pe.entry_point

Full rule:
rule eXPressorv12CGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
	$a1 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 [4] 2B 05 84 [3] A3 [4] 83 3D [4] 00 74 16 A1 [4] 03 05 80 [3] 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 [4] 01 00 00 00 68 04 }
	$a2 = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 [4] 2B 05 84 [3] A3 [4] 83 3D [4] 00 74 16 A1 [4] 03 05 80 [3] 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 [4] 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }

condition:
		$a0 or $a1 at pe.entry_point or $a2 at pe.entry_point
}
YARA Detection Rule: NullsoftPIMPInstallSystemv13x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC [2] 00 00 56 57 6A ?? BE [4] 59 8D BD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NullsoftPIMPInstallSystemv13x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC [2] 00 00 56 57 6A ?? BE [4] 59 8D BD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Enigmaprotector110111VladimirSukhov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED [35] E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
	$a1 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED [35] E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB [41] E8 01 00 00 00 9A 83 C4 04 01 E8 [31] E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 [31] E8 01 00 00 00 9A 83 C4 04 B9 3D 1A }

Detection condition:
$a0 or $a1

Full rule:
rule Enigmaprotector110111VladimirSukhov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED [35] E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
	$a1 = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED [35] E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB [41] E8 01 00 00 00 9A 83 C4 04 01 E8 [31] E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 [31] E8 01 00 00 00 9A 83 C4 04 B9 3D 1A }

condition:
		$a0 or $a1
}
YARA Detection Rule: PECompactv140b5v140b6
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv140b5v140b6
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxExplosion1000
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5E 1E 06 50 81 [3] 56 FC B8 21 35 CD 21 2E [4] 2E [4] 26 [6] 74 ?? 8C D8 48 8E D8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxExplosion1000
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5E 1E 06 50 81 [3] 56 FC B8 21 35 CD 21 2E [4] 2E [4] 26 [6] 74 ?? 8C D8 48 8E D8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKZIPSFXv11198990
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC 2E 8C 0E [2] A1 [2] 8C CB 81 C3 [2] 3B C3 72 ?? 2D [2] 2D [2] FA BC [2] 8E D0 FB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKZIPSFXv11198990
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 2E 8C 0E [2] A1 [2] 8C CB 81 C3 [2] 3B C3 72 ?? 2D [2] 2D [2] FA BC [2] 8E D0 FB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEBundlev20b5v23
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB [2] 40 ?? 87 DD 01 AD [4] 01 AD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEBundlev20b5v23
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB [2] 40 ?? 87 DD 01 AD [4] 01 AD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PUNiSHERV15DemoFEUERRADER
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PUNiSHERV15DemoFEUERRADER
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: HACKSTOPv110v111
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 30 CD 21 86 E0 3D [2] 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 [2] 58 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule HACKSTOPv110v111
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 86 E0 3D [2] 73 ?? B4 2F CD 21 B0 ?? B4 4C CD 21 50 B8 [2] 58 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium1336ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 04 [4] E8 28 00 00 00 EB 01 [7] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 [4] 33 C0 EB 01 ?? C3 EB 03 [3] EB 04 [4] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 03 [3] EB 04 [4] 50 EB 01 ?? 33 C0 EB 02 [2] 8B 00 EB 04 [4] C3 EB 04 [4] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 01 ?? EB 03 [3] 58 EB 02 [2] EB 04 [4] 64 67 8F 06 00 00 EB 04 }

Detection condition:
$a0

Full rule:
rule Obsidium1336ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 [4] E8 28 00 00 00 EB 01 [7] 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 26 EB 04 [4] 33 C0 EB 01 ?? C3 EB 03 [3] EB 04 [4] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 03 [3] EB 04 [4] 50 EB 01 ?? 33 C0 EB 02 [2] 8B 00 EB 04 [4] C3 EB 04 [4] E9 FA 00 00 00 EB 03 [3] E8 D5 FF FF FF EB 01 ?? EB 03 [3] 58 EB 02 [2] EB 04 [4] 64 67 8F 06 00 00 EB 04 }

condition:
		$a0
}
YARA Detection Rule: DualseXeEncryptor10bDual
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DualseXeEncryptor10bDual
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 00 05 00 00 E8 00 00 00 00 5D 81 ED 0E 00 00 00 8D 85 3A 04 00 00 89 28 33 FF 8D 85 80 03 00 00 8D 8D 3A 04 00 00 2B C8 8B 9D 8A 04 00 00 E8 24 02 00 00 8D 9D 58 03 00 00 8D B5 7F 03 00 00 46 80 3E 00 74 24 56 FF 95 58 05 00 00 46 80 3E 00 75 FA 46 80 3E 00 74 E7 50 56 50 FF 95 5C 05 00 00 89 03 58 83 C3 04 EB E3 8D 85 69 02 00 00 FF D0 8D 85 56 04 00 00 50 68 1F 00 02 00 6A 00 8D 85 7A 04 00 00 50 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MarjinZEXEScramblerSEbyMarjinZ
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3 }

Detection condition:
$a0

Full rule:
rule MarjinZEXEScramblerSEbyMarjinZ
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 A3 02 00 00 E9 35 FD FF FF FF 25 C8 20 00 10 6A 14 68 C0 21 00 10 E8 E4 01 00 00 FF 35 7C 33 00 10 8B 35 8C 20 00 10 FF D6 59 89 45 E4 83 F8 FF 75 0C FF 75 08 FF 15 88 20 00 10 59 EB 61 6A 08 E8 02 03 00 00 59 83 65 FC 00 FF 35 7C 33 00 10 FF D6 89 45 E4 FF 35 78 33 00 10 FF D6 89 45 E0 8D 45 E0 50 8D 45 E4 50 FF 75 08 E8 D1 02 00 00 89 45 DC FF 75 E4 8B 35 74 20 00 10 FF D6 A3 7C 33 00 10 FF 75 E0 FF D6 83 C4 1C A3 78 33 00 10 C7 45 FC FE FF FF FF E8 09 00 00 00 8B 45 DC E8 A0 01 00 00 C3 }

condition:
		$a0
}
YARA Detection Rule: nPack111502006BetaNEOx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 3D [5] 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 [4] 2B 05 [4] A3 [4] E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 [4] C7 05 [8] 01 05 [4] FF 35 [4] C3 C3 56 57 68 [4] FF 15 [4] 8B 35 [4] 8B F8 68 [4] 57 FF D6 68 [4] 57 A3 [4] FF D6 5F A3 [4] 5E C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule nPack111502006BetaNEOx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D [5] 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 [4] 2B 05 [4] A3 [4] E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 [4] C7 05 [8] 01 05 [4] FF 35 [4] C3 C3 56 57 68 [4] FF 15 [4] 8B 35 [4] 8B F8 68 [4] 57 FF D6 68 [4] 57 A3 [4] FF D6 5F A3 [4] 5E C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DingBoysPElockPhantasmv15b3
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DingBoysPElockPhantasmv15b3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ShellModify01pll621
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ShellModify01pll621
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01MacromediaFlashProjector60Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01MacromediaFlashProjector60Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 68 [4] 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Packman0001Bubbasoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 0F 85 ?? FF FF FF 8D B3 [4] EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 }

Detection condition:
$a0

Full rule:
rule Packman0001Bubbasoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0F 85 ?? FF FF FF 8D B3 [4] EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 }

condition:
		$a0
}
YARA Detection Rule: aPackv098bDSESnotsaved
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8C CB BA [2] 03 DA FC 33 F6 33 FF 4B 8E DB 8D [3] 8E C0 B9 [2] F3 A5 4A 75 }

Detection condition:
$a0

Full rule:
rule aPackv098bDSESnotsaved
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C CB BA [2] 03 DA FC 33 F6 33 FF 4B 8E DB 8D [3] 8E C0 B9 [2] F3 A5 4A 75 }

condition:
		$a0
}
YARA Detection Rule: ASProtectvIfyouknowthisversionpostonPEiDboardh2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [2] 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule ASProtectvIfyouknowthisversionpostonPEiDboardh2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 [2] 00 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 DD 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: Aluwainv809
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B EC 1E E8 [2] 9D 5E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Aluwainv809
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B EC 1E E8 [2] 9D 5E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AntiDote12DLLDemoSISTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 [4] 60 BE [4] 8D BE [4] 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF }

Detection condition:
$a0

Full rule:
rule AntiDote12DLLDemoSISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 [4] 60 BE [4] 8D BE [4] 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 08 8A 06 46 83 F0 FF 74 74 89 C5 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 75 20 41 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C9 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 83 C1 02 81 FD 00 F3 FF FF 83 D1 01 8D 14 2F 83 FD FC 76 0F 8A 02 42 88 07 47 49 75 F7 E9 63 FF FF FF 90 8B 02 83 C2 04 89 07 83 C7 04 83 E9 04 77 F1 01 CF E9 4C FF FF FF }

condition:
		$a0
}
YARA Detection Rule: MSLRHv032afakeMicrosoftVisualCemadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakeMicrosoftVisualCemadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 CA 37 41 00 68 06 38 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 83 C4 0C 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftwareCompressV12BGSoftwareProtectTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftwareCompressV12BGSoftwareProtectTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Themida1201OreansTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED [2] 35 09 89 95 [2] 35 09 89 B5 [2] 35 09 89 85 [2] 35 09 83 BD [2] 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 [2] 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 }

Detection condition:
$a0

Full rule:
rule Themida1201OreansTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED [2] 35 09 89 95 [2] 35 09 89 B5 [2] 35 09 89 85 [2] 35 09 83 BD [2] 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 [2] 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 }

condition:
		$a0
}
YARA Detection Rule: PECompactv126b1v126b2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv126b1v126b2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Cruncherv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2E [4] 2E [3] B4 30 CD 21 3C 03 73 ?? BB [2] 8E DB 8D [3] B4 09 CD 21 06 33 C0 50 CB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Cruncherv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E [4] 2E [3] B4 30 CD 21 3C 03 73 ?? BB [2] 8E DB 8D [3] B4 09 CD 21 06 33 C0 50 CB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AntiDote1214SEDLLSISTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 [4] 60 BE [4] 8D BE [4] 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AntiDote1214SEDLLSISTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 [4] 60 BE [4] 8D BE [4] 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC 11 DB }

condition:
		$a0 at pe.entry_point
}