UnoPiX 103 110 BaGiE

Hunt Hypothesis

This hypothesis targets the presence of the UnoPiX 103.110 BaGiE malware family, which is often deployed to establish initial footholds or execute post-compromise actions within Azure environments. Proactively hunting for this specific YARA signature allows the SOC to identify low-severity, potentially stealthy infections that may evade standard behavioral detections, ensuring early containment of known malicious payloads.

YARA Rule

rule UnoPiX_103_110_BaGiE: PEiD
{
    strings:
        $a = { 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 10 }
        $b = { 83 EC 04 C7 04 24 00 ?? ?? ?? C3 00 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment via MSIX/MSI:

  • Scenario: Enterprise IT deploys custom line-of-business applications built with older .NET Framework versions or specific C++/CLI interop layers that embed specific byte patterns (e.g., 0x41 0x62 0x67 0x69 0x45 or similar magic numbers) in their PE headers or resource sections. These patterns can be misidentified by the UnoPiX_103_110_BaGiE rule if it targets generic string/byte sequences associated with known malware families.
  • Filter/Exclusion: Exclude files located in standard application install directories (e.g., C:\Program Files\, C:\Program Files (x86)\) that are signed by trusted internal or vendor certificates (e.g., Microsoft, Adobe, Oracle). Additionally, exclude files with the .msi, .msix, or .cab extensions if the rule is scanning installer packages rather than extracted binaries.

• Scheduled Backup Jobs Using Third-Party Agents:

  • Scenario: Scheduled tasks (e.g., BackupAgent.exe from Veeam, Commvault, or Veritas) execute during off-hours to perform full or incremental backups. These agents often load proprietary DLLs or temporary executable stubs that contain specific byte sequences or string constants (e.g., “BaGiE” as part of a proprietary protocol identifier or buffer marker) that match the YARA pattern.
  • Filter/Exclusion: Exclude processes whose parent process is a known backup service (e.g., svchost.exe hosting VeeamBackupSvc, commvaultagent.exe) or files located in vendor-specific backup directories (e.g., C:\Program Files\Commvault\, `C:\Program Files