ACProtect 13x 14x DLL Risco Software Inc additional

Hunt Hypothesis

This rule identifies the presence of ACProtect-packed DLLs, a common obfuscation technique used by adversaries to hide malicious code and evade static analysis. Proactively hunting for these artifacts helps the SOC team uncover hidden payloads or trojanized components that may have been deployed to persist within the environment or execute stealthy actions.

YARA Rule

rule ACProtect_13x_14x_DLL_Risco_Software_Inc_additional: PEiD
{
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 ?? BA ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Third-Party Application Updates: A widely deployed, older version of a commercial line-of-business application (e.g., a specific build of SAP GUI, Oracle Client, or Adobe Creative Suite legacy plugins) that was compiled using ACProtect 13.x/14.x to protect its proprietary DLLs from reverse engineering. These DLLs are often loaded during automated patch cycles or application startup.

  • Filter/Exclusion: Exclude files located in specific vendor directories (e.g., C:\Program Files (x86)\SAP\FrontEnd\ or C:\Program Files\Adobe\) and match the file name against a known list of legacy vendor DLLs (e.g., sapgui.dll, adobe_*.dll).

• Protected Driver or Service Binaries: A critical system service or driver (e.g., VMware Tools, Veeam Backup Agent, or Symantec Endpoint Protection components) that uses ACProtect to obfuscate its core logic DLLs. These are typically executed by the svchost.exe or a vendor-specific service executable during routine health checks or backup operations.

  • Filter/Exclusion: Exclude processes where the parent executable is a known vendor service (e.g., vmtoolsd.exe, veeamsvc.exe, ccSvcHst.exe) and the DLL path resides within the vendor’s installation directory (e.g., C:\Program Files\VMware\VMware Tools\, C:\Program Files (x86)\Veeam\).

• Scheduled Maintenance Job for Legacy Tools: A scheduled task (e.g., Daily_Log_Rotation or Legacy_Report_Generator) that runs a custom in-house utility or an older version of a reporting tool (e.g., Crystal Reports runtime DLLs or BIRT engine components