MPRESS V097 V099 MATCODE Softwarenbsp nbsp SignByfly 20080416

Hunt Hypothesis

This rule identifies the presence of MPRESS-packed executables, a technique commonly used by malware authors to compress and obfuscate binaries to evade static analysis and signature-based detection. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to uncover hidden or low-severity threats that may be persisting in the environment, ensuring that obfuscated payloads are detected before they can execute malicious logic or establish persistence.

YARA Rule

rule MPRESS_V097_V099_MATCODE_Softwarenbsp_nbsp_SignByfly_20080416: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 05 49 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 60 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 69 FF FF FF B0 E9 AA B8 45 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy:

  • Scenario: IT administrators deploy older, unmaintained line-of-business applications (e.g., legacy accounting or inventory software from the 2008–2012 era) to domain-joined workstations via Group Policy Object (GPO) software installation. These executables are often packed with MPRESS to reduce file size or protect intellectual property, and the specific “SignByfly” signature suggests a particular vendor or packer version used in that timeframe.
  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\) that were modified by the gpupdate process or created by the Group Policy Client service. Additionally, whitelist specific known legacy application names (e.g., LegacyApp.exe) if they are consistently flagged.

• Third-Party Antivirus/Security Tool Updates:

  • Scenario: Certain older or specialized security tools, endpoint detection agents, or anti-malware utilities (e.g., older versions of Symantec, Trend Micro, or niche EDR agents) may use MPRESS packing for their updater components or helper executables. When these tools perform scheduled self-updates or install new definitions, the new binary on disk may match the YARA rule.
  • Filter/Exclusion: Exclude files whose parent process is a known security tool updater (e.g., ccSvcHst.exe, TmUpd.exe, edr_updater.exe) or files located in the vendor’s specific installation directory (e.g., C:\Program Files\Symantec\, C:\Program Files\Trend Micro\).

• Scheduled Backup or Archive Utility Execution:

  • Scenario: Enterprise backup solutions or archive utilities (e.g., older versions