This YARA rule targets the RLPack V119 DLL, a lightweight packer commonly used by adversaries to compress and obfuscate malicious payloads, thereby evading static analysis and signature-based detection. Proactively hunting for this specific packer in Azure Sentinel allows the SOC to identify potentially compromised endpoints or staging areas where attackers are preparing to deploy obfuscated executables before they execute their full intrusion chain.
rule RLPack_V119_Dll_LZMA_430_ap0x: PEiD
{
strings:
$a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 20 20 20 00 EB 06 FF B5 65 0B 00 00 FF B5 61 0B 00 00 FF 95 D6 0A 00 00 85 C0 0F 84 87 00 00 00 89 07 83 C7 04 8B 85 65 0B 00 00 EB 01 40 80 38 00 75 FA 40 89 85 65 0B 00 00 66 81 78 02 00 80 74 A1 80 38 00 75 9C EB 01 46 80 3E 00 75 FA 46 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 80 3E 01 0F 85 5F FF FF FF 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 69 0B 00 00 FF 95 DE 0A 00 00 68 00 40 00 00 68 00 20 0C 00 FF B5 41 0B 00 00 FF 95 DE 0A 00 00 E8 3D 00 00 00 E8 24 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
condition:
$a at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A developer or DevOps engineer uses 7-Zip or WinRAR to extract a compressed .dll file (packed with LZMA) from a vendor-provided SDK or library into a local project directory. The YARA rule matches the specific LZMA header and packing signature within the extracted binary.
C:\dev\, C:\projects\, C:\src\) or exclude processes initiated by extraction tools like 7z.exe, WinRAR.exe, or tar.exe when the parent process is a known IDE (e.g., devenv.exe, code.exe).Scenario: An IT administrator runs a scheduled maintenance job using PowerShell or a batch script to update a legacy application component. The update package contains a DLL packed with RLPack/LZMA, which is temporarily extracted to a temp folder (e.g., %TEMP% or C:\Windows\Temp) during the installation process.
%TEMP%, C:\Windows\Temp, C:\Users\*\AppData\Local\Temp) if the parent process is a known installer or script host (e.g., msiexec.exe, powershell.exe, cmd.exe) and the file age is less than 15 minutes.Scenario: A CI/CD pipeline agent (e.g., Jenkins, Azure DevOps, or GitLab Runner) checks out a repository containing pre-compiled native libraries or test fixtures that are packed to reduce repository size. The agent extracts these DLLs into the workspace directory for build or test execution.