deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: VideoLanClient
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 [15] FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VideoLanClient
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 [15] FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CrunchPEv10xx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 E8 [4] 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 [4] 89 85 [4] 80 BD [5] 75 09 C6 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CrunchPEv10xx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 [4] 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 [4] 89 85 [4] 80 BD [5] 75 09 C6 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxTravJack883
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB ?? 9C 9E 26 [2] 51 04 ?? 7D ?? 00 ?? 2E [4] 8C C8 8E C0 8E D8 80 [4] 74 ?? 8A [3] BB [2] 8A ?? 32 C2 88 ?? FE C2 43 81 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxTravJack883
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? 9C 9E 26 [2] 51 04 ?? 7D ?? 00 ?? 2E [4] 8C C8 8E C0 8E D8 80 [4] 74 ?? 8A [3] BB [2] 8A ?? 32 C2 88 ?? FE C2 43 81 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RSCsProcessPatcherv151
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }

Detection condition:
$a0

Full rule:
rule RSCsProcessPatcherv151
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }

condition:
		$a0
}
YARA Detection Rule: kryptor9
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5E B9 [4] 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule kryptor9
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5E B9 [4] 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SecuPackv15
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 [3] 6A 03 6A ?? 6A 01 [3] 80 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SecuPackv15
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 [3] 6A 03 6A ?? 6A 01 [3] 80 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: kryptor5
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 [3] E9 EB 6C 58 40 FF E0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule kryptor5
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 [3] E9 EB 6C 58 40 FF E0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: kryptor6
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 [3] E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule kryptor6
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 [3] E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ACProtectV13Xrisco
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 50 E8 01 00 00 00 75 83 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ACProtectV13Xrisco
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 50 E8 01 00 00 00 75 83 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PELockNTv202c
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PELockNTv202c
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02MinGWGCC2xAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02MinGWGCC2xAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeBASIC016b
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 [3] 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 [3] 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 [3] 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 [3] 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FreeBASIC016b
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 [3] 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 [3] 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 [3] 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 [3] 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptorv16bv16cVaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 }
	$a1 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 [4] B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule RCryptorv16bv16cVaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 }
	$a1 = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 [4] B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: FileShield
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 1E EB ?? 90 00 00 8B D8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FileShield: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 1E EB ?? 90 00 00 8B D8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SDC12SelfDecryptingBinaryGeneratorbyClaesMNyberg
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SDC12SelfDecryptingBinaryGeneratorbyClaesMNyberg
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 A0 91 40 00 E8 DB FE FF FF 55 89 E5 53 83 EC 14 8B 45 08 8B 00 8B 00 3D 91 00 00 C0 77 3B 3D 8D 00 00 C0 72 4B BB 01 00 00 00 C7 44 24 04 00 00 00 00 C7 04 24 08 00 00 00 E8 CE 24 00 00 83 F8 01 0F 84 C4 00 00 00 85 C0 0F 85 A9 00 00 00 31 C0 83 C4 14 5B 5D C2 04 00 3D 94 00 00 C0 74 56 3D 96 00 00 C0 74 1E 3D 93 00 00 C0 75 E1 EB B5 3D 05 00 00 C0 8D B4 26 00 00 00 00 74 43 3D 1D 00 00 C0 75 CA C7 44 24 04 00 00 00 00 C7 04 24 04 00 00 00 E8 73 24 00 00 83 F8 01 0F 84 99 00 00 00 85 C0 74 A9 C7 04 24 04 00 00 00 FF D0 B8 FF FF FF FF EB 9B 31 DB 8D 74 26 00 E9 69 FF FF FF C7 44 24 04 00 00 00 00 C7 04 24 0B 00 00 00 E8 37 24 00 00 83 F8 01 74 7F 85 C0 0F 84 6D FF FF FF C7 04 24 0B 00 00 00 8D 76 00 FF D0 B8 FF FF FF FF E9 59 FF FF FF C7 04 24 08 00 00 00 FF D0 B8 FF FF FF FF E9 46 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 08 00 00 00 E8 ED 23 00 00 B8 FF FF FF FF 85 DB 0F 84 25 FF FF FF E8 DB 15 00 00 B8 FF FF FF FF E9 16 FF FF FF C7 44 24 04 01 00 00 00 C7 04 24 04 00 00 00 E8 BD 23 00 00 B8 FF FF FF FF E9 F8 FE FF FF C7 44 24 04 01 00 00 00 C7 04 24 0B 00 00 00 E8 9F 23 00 00 B8 FF FF FF FF E9 DA FE FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv1501
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 B8 [2] BA [2] 05 [2] 3B 06 [2] 72 ?? B4 ?? BA [2] CD 21 B8 [2] CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv1501
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 B8 [2] BA [2] 05 [2] 3B 06 [2] 72 ?? B4 ?? BA [2] CD 21 B8 [2] CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Inbuildv10hard
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B9 [2] BB [2] 2E [2] 2E [2] 43 E2 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Inbuildv10hard
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B9 [2] BB [2] 2E [2] 2E [2] 43 E2 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeShieldvxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeShieldvxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptorv20Vaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 [3] 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RCryptorv20Vaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? 02 00 00 F7 D1 83 F1 FF 59 BA 32 21 ?? 00 F7 D1 83 F1 FF F7 D1 83 F1 FF 80 02 E3 F7 D1 83 F1 FF C0 0A 05 F7 D1 83 F1 FF 80 02 6F F7 D1 83 F1 FF 80 32 A4 F7 D1 83 F1 FF 80 02 2D F7 D1 83 F1 FF 42 49 85 C9 75 CD 1C 4F 8D 5B FD 62 1E 1C 4F 8D 5B FD 4D 9D B9 [3] 1E 1C 4F 8D 5B FD 22 1C 4F 8D 5B FD 8E A2 B9 B9 E2 83 DB E2 E5 4D CD 1E BF 60 AB 1F 4D DB 1E 1E 3D 1E 92 1B 8E DC 7D EC A4 E2 4D E5 20 C6 CC B2 8E EC 2D 7D DC 1C 4F 8D 5B FD 83 56 8E E0 3A 7D D0 8E 9D 6E 7D D6 4D 25 06 C2 AB 20 CC 3A 4D 2D 9D 6B 0B 81 45 CC 18 4D 2D 1F A1 A1 6B C2 CC F7 E2 4D 2D 9E 8B 8B CC DE 2E 2D F7 1E AB 7D 45 92 30 8E E6 B9 7D D6 8E 9D 27 DA FD FD 1E 1E 8E DF B8 7D CF 8E A3 4D 7D DC 1C 4F 8D 5B FD 33 D7 1E 1E 1E A6 0B 41 A1 A6 42 61 6B 41 6B 4C 45 1E 21 F6 26 BC E2 62 1E 62 1E 62 1E 23 63 59 ?? 1E 62 1E 62 1E 33 D7 1E 1E 1E 85 6B C2 41 AB C2 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 20 33 9E 1E 1E 1E 85 A2 0B 8B C2 27 41 EB A1 A2 C2 1E C0 FD F0 FD 30 62 1E 33 7E 1E 1E 1E C6 2D 42 AB 9F 23 6B C2 41 A1 1E C0 FD F0 FD 30 C0 FD F0 8E 1D 1C 4F 8D 5B FD E0 00 33 5E 1E 1E 1E BF 0B EC C2 E6 42 A2 C2 45 1E C0 FD F0 FD 30 CE 36 CC F2 1C 4F 8D 5B FD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv125
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv125
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptorv1Vaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 }
	$a1 = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 [4] B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule RCryptorv1Vaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 }
	$a1 = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 [4] B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PECompactv122
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv122
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Packmanv10BrandonLaCombe
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Packmanv10BrandonLaCombe
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA 8B E8 C6 06 E9 8B 43 0C 89 46 01 6A 04 68 00 10 00 00 FF 73 08 51 FF 55 08 8B }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SpecialEXEPaswordProtectorV101EngPavolCerven
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SpecialEXEPaswordProtectorV101EngPavolCerven
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ExeSmashervxx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C FE 03 ?? 60 BE [2] 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ExeSmashervxx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C FE 03 ?? 60 BE [2] 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEArmor046ChinaCrackingGroup
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 AA 00 00 00 2D [2] 00 00 00 00 00 00 00 00 00 3D [2] 00 2D [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B [2] 00 5C [2] 00 6F [2] 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEArmor046ChinaCrackingGroup
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 AA 00 00 00 2D [2] 00 00 00 00 00 00 00 00 00 3D [2] 00 2D [2] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B [2] 00 5C [2] 00 6F [2] 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VMProtect106107PolyTech
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 68 00 00 00 00 8B 74 24 28 BF [4] FC 89 F3 03 34 24 AC 00 D8 }

Detection condition:
$a0

Full rule:
rule VMProtect106107PolyTech
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 68 00 00 00 00 8B 74 24 28 BF [4] FC 89 F3 03 34 24 AC 00 D8 }

condition:
		$a0
}
YARA Detection Rule: USSR031bySpirit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 [3] B0 ?? 30 06 8A 06 46 81 FE 00 [3] 7C F3 }

Detection condition:
$a0

Full rule:
rule USSR031bySpirit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5D 83 C5 12 55 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 8C C9 30 C9 E3 01 C3 BE 32 [3] B0 ?? 30 06 8A 06 46 81 FE 00 [3] 7C F3 }

condition:
		$a0
}
YARA Detection Rule: PeCompact253DLLSlimLoaderBitSumTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PeCompact253DLLSlimLoaderBitSumTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 00 08 0C 00 48 E1 01 56 57 53 55 8B 5C 24 1C 85 DB 0F 84 AB 21 E8 BD 0E E6 60 0D 0B 6B 65 72 6E 6C 33 32 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: LameCryptv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 66 9C BB [4] 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule LameCryptv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 66 9C BB [4] 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Cygwin32
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 04 83 3D }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Cygwin32: Packer PEiD
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 04 83 3D }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASProtectv123RC4build0807exeAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB [4] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule ASProtectv123RC4build0807exeAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB [4] 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: Armadillov210b2
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov210b2
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 18 12 41 00 68 24 A0 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov190
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov190
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 10 F2 40 00 68 64 9A 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: eXPressorProtection150XCGSoftLabs
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 EB 01 [4] 83 EC 0C 53 56 57 EB 01 ?? 83 3D [4] 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 [4] 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 [4] 68 [4] B8 [4] FF D0 59 59 EB 01 C8 EB 02 66 F0 68 [4] E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F [6] 33 45 F4 8B 4D F4 88 [5] EB 01 EB EB }

Detection condition:
$a0

Full rule:
rule eXPressorProtection150XCGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 EB 01 [4] 83 EC 0C 53 56 57 EB 01 ?? 83 3D [4] 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 [4] 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 [4] 68 [4] B8 [4] FF D0 59 59 EB 01 C8 EB 02 66 F0 68 [4] E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F [6] 33 45 F4 8B 4D F4 88 [5] EB 01 EB EB }

condition:
		$a0
}
YARA Detection Rule: VxNecropolis1963
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 30 CD 21 3C 03 [2] B8 00 12 CD 2F 3C FF B8 [4] B4 4A BB 40 01 CD 21 [2] FA 0E 17 BC [2] E8 [2] FB A1 [2] 0B C0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxNecropolis1963
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 30 CD 21 3C 03 [2] B8 00 12 CD 2F 3C FF B8 [4] B4 4A BB 40 01 CD 21 [2] FA 0E 17 BC [2] E8 [2] FB A1 [2] 0B C0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Shrinkv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 [2] 50 9C FC BE [2] 8B FE 8C C8 05 [2] 8E C0 06 57 B9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Shrinkv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 [2] 50 9C FC BE [2] 8B FE 8C C8 05 [2] 8E C0 06 57 B9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02UPX06Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02UPX06Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }

condition:
		$a0 at pe.entry_point
}