NoobyProtect SE Public V1150 Nooby 20090201

Hunt Hypothesis

This YARA rule targets the NoobyProtect SE public build, a known malware variant associated with the Nooby family, indicating the presence of potentially compromised endpoints or malicious payloads within the environment. Proactively hunting for this signature allows the SOC team to identify low-severity threats that may serve as initial access vectors or persistence mechanisms before they escalate into more significant incidents.

YARA Rule

rule NoobyProtect_SE_Public_V1150_Nooby_20090201: PEiD
{
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 35 2E 30 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Maintenance: An IT administrator runs a full integrity check or backup verification on a legacy line-of-business application (e.g., old ERP or inventory management software) that was compiled in the early 2000s and has not been updated since. The executable or its associated DLLs may still contain the specific byte patterns identified by the “NoobyProtect” packer signature.

  • Filter/Exclusion: Exclude the specific directory path of the legacy application (e.g., C:\LegacyApps\Inventory2003\) or the specific SHA-256 hash of the known good executable from the YARA scan scope.

• Third-Party Installer Execution: A standard user or service account executes a setup wizard for a third-party utility (e.g., a PDF converter or media player) that utilizes an older version of the NoobyProtect packer to compress its installer components. The temporary files created in %TEMP% or the installer executable itself trigger the detection during the installation process.

  • Filter/Exclusion: Exclude processes with parent processes like msiexec.exe or setup.exe when the file location is within standard temporary directories (%TEMP%, C:\Windows\Temp) and the file extension is .exe or .msi.

• Scheduled Backup Job: A scheduled task (e.g., DailyBackup) runs a backup agent (like Veeam, Commvault, or a custom script) that copies or verifies large binary files from a shared network drive. If the backup agent processes or caches a known legacy binary that matches the YARA signature, it may be flagged as a new detection.

  • Filter/Exclusion: Exclude files located in specific backup staging directories (e.g., C:\BackupStaging\) or exclude detections where the process name is the known backup agent (e.g., `v