← Back to SOC feed Coverage →

Upackv032BetaDwing

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-08-01T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies the execution of a specific unpacking utility (Upackv032BetaDwing) that adversaries often leverage to extract and analyze malicious payloads during the initial stages of an attack. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to uncover stealthy file extraction activities that may precede more significant compromise events, ensuring early visibility into potential supply chain or malware delivery mechanisms.

YARA Rule

rule Upackv032BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 [2] AD 50 [2] AD 91 F3 A5 }
	$a1 = { BE 88 01 [2] AD 50 ?? AD 91 ?? F3 A5 }

condition:
		$a0 or $a1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 2 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the Upackv032BetaDwing detection rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar