NsPacK V33 LiuXingPing additional

Hunt Hypothesis

This hypothesis targets the execution of the NsPacK V33 LiuXingPing packer, a tool frequently used by adversaries to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this specific packer signature in Azure Sentinel allows the SOC to identify potentially hidden or modified executables that may be staging for further post-exploitation activities.

YARA Rule

rule NsPacK_V33_LiuXingPing_additional: PEiD
{
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When IT administrators deploy legacy line-of-business applications (e.g., old versions of SAP GUI, TIBCO, or specialized industrial control software) that were compiled with older versions of NSPack, the binary may retain the specific byte patterns or section headers targeted by the “LiuXingPing” variant.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyApp\) or exclude binaries where the Product Name in the PE header matches known legacy vendor names, or whitelist by SHA256 hash for approved legacy artifacts.

• Third-Party Installer Self-Extraction: Many enterprise installers (e.g., Java JRE, Adobe Acrobat, or specific database drivers like Oracle or SQL Server) use NSPack or similar packers to compress their payload. If the installer is executed from a temp folder or a network share during a scheduled maintenance window, the YARA rule may match the packed executable in memory or on disk.

  • Filter/Exclusion: Exclude processes where the parent process is a known installer service (e.g., msiexec.exe, setup.exe, or install.exe) and the file path contains standard temp directories (%TEMP%, %TMP%, or C:\Windows\Installer\), or exclude files with extensions like .msi, .cab, or .exe within installer-specific directories.

• Antivirus/EDR Quarantine Scanning: Security tools often scan quarantined or backed-up files. If a previously packed executable is moved to a quarantine folder (e.g., C:\ProgramData\AVQuarantine\) or a backup repository, the YARA scan may flag the file as it sits on disk, even though it is not actively executing.

  • Filter/Exclusion: Exclude file