RLPackFullEditionV11Xap0x

Hunt Hypothesis

This YARA rule targets the RLPack Full Edition v11 Xap0x variant, a known executable packer frequently used by adversaries to compress binaries and obscure their code from static analysis tools. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify potentially obfuscated payloads that may have been dropped on endpoints or stored in cloud assets, reducing the risk of undetected malware execution.

YARA Rule

rule RLPackFullEditionV11Xap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 [8] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 [24] 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via SCCM/MECM: When deploying older, unmanaged line-of-business applications (e.g., legacy accounting software or specialized engineering CAD tools) that bundle the RLPack runtime or use its specific packing algorithm for obfuscation, the YARA signature may match the executable or installer.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyApp\) or match against known parent processes like ccmsetup.exe or ccmexec.exe during deployment windows.
• Scheduled Backup or Archive Jobs: Enterprise backup solutions or custom PowerShell scripts that compress data using RLPack-compatible compression libraries (often seen in older .NET or Java-based backup agents) may create temporary archives or log files that trigger the RLPackFullEdition signature.
  • Filter/Exclusion: Exclude files with extensions like .rlpack, .rlp, or .rl when the parent process is a known backup agent (e.g., VeeamAgent.exe, BackupExec.exe, or nbsvc.exe) or when the file path contains \Backup\ or \Archive\.
• Third-Party Antivirus/EDR Quarantine Scans: During full system scans, some security products may temporarily unpack or analyze RLPack-compressed payloads in their quarantine or analysis folders, causing the YARA rule to match the extracted or scanned file object.
  • Filter/Exclusion: Exclude file paths containing \Quarantine\, \Analysis\, or \Scan\ for specific AV vendors (e.g., \Sophos\, \CrowdStrike\, \CarbonBlack\) or match against known AV scanner processes like SophosAgent.exe or csagent.exe.
• Development and Testing Environments: Developers or QA engineers testing legacy application compatibility