MPRESS V107 V125 MATCODE Softwarenbsp nbsp SignByfly 20080730

Hunt Hypothesis

This rule identifies the presence of the MPRESS packer, a tool frequently used by adversaries to compress executables and obscure their code from static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC to detect potentially obfuscated malware or trojans that may have been introduced via phishing or lateral movement, ensuring early identification of threats that rely on packing to evade detection.

YARA Rule

rule MPRESS_V107_V125_MATCODE_Softwarenbsp_nbsp_SignByfly_20080730: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy or SCCM

  • Scenario: An IT administrator deploys a legacy line-of-business application (e.g., an older version of a financial reporting tool or industrial control software) that was packed with MPRESS v107/v125 to reduce file size or protect intellectual property. The deployment occurs via Microsoft System Center Configuration Manager (SCCM) or Group Policy Object (GPO) software installation, triggering the YARA rule on the target endpoints.
  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) where the parent process is a known deployment agent such as ccmsetup.exe, ccmexec.exe, or gpupdate.exe. Additionally, whitelist specific known legacy application filenames (e.g., legacyapp.exe) if they are consistently packed.

• Scheduled Maintenance or Backup Tasks

  • Scenario: A scheduled task (e.g., Task Scheduler job running every Sunday at 2:00 AM) executes a custom backup or log rotation script that uses a packed utility (e.g., a custom C++ tool compiled with MPRESS) to compress or archive logs. The packed binary is executed from a system directory like C:\Windows\System32\ or a dedicated maintenance folder, triggering the detection.
  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically the Task Scheduler service) or taskschd.msi, and the file path resides in known maintenance directories (e.g., C:\Maintenance\, C:\Scripts\). Alternatively, exclude based on the specific scheduled task name if it is documented in the CMDB.

• Third-Party Plugin or Add-on Installation *