MSLRHv032afakeUPX0896102105124emadicius

Hunt Hypothesis

This hypothesis targets the presence of malware binaries packed with the UPX compressor, a common technique used by adversaries to reduce file size and evade static analysis. Proactively hunting for these signatures in Azure Sentinel allows the SOC to identify potentially compromised endpoints or staging areas before the packed payload is executed or unpacked in memory.

YARA Rule

rule MSLRHv032afakeUPX0896102105124emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses the open-source upx tool to compress a custom-built C++ CLI application or a specific microservice binary to reduce deployment package size before pushing it to an artifact repository (e.g., JFrog Artifactory or Nexus).

  • Filter/Exclusion: Exclude files located in known build directories (e.g., C:\src\build\, /opt/builds/) or exclude files where the parent process is a known build tool (e.g., msbuild.exe, dotnet.exe, cmake.exe) and the file extension is .exe or .dll.

• Scenario: An IT administrator installs or updates a legacy third-party application (e.g., older versions of Adobe Creative Suite, certain Java JRE components, or specialized industrial control software) that bundles UPX-compressed binaries as part of its installer payload or runtime libraries.

  • Filter/Exclusion: Exclude files under standard vendor installation paths (e.g., C:\Program Files\[VendorName]\, C:\Program Files (x86)\[VendorName]\) and exclude files where the Product or FileDescription metadata matches known vendor names (e.g., “Adobe”, “Oracle”, “Siemens”).

• Scenario: A system administrator runs a scheduled maintenance job that uses a UPX-compressed utility script or binary (e.g., a custom diskcleanup.exe or logrotate.exe variant) to perform disk defragmentation, log rotation, or temporary file cleanup on file servers or domain controllers.

  • Filter/Exclusion: Exclude files executed by scheduled tasks with known task names (e.g., “Daily Maintenance”, “Log Cleanup”) or exclude files located in administrative tool directories (e.g., C:\AdminTools\, C:\Scripts\Maintenance\).