This rule detects the presence of the Upackv037betaDwing YARA signature, which typically identifies specific packed or obfuscated malware binaries that adversaries deploy to evade static analysis. Proactively hunting for this signature allows the SOC team to identify potentially compromised hosts in the Azure Sentinel environment before the packed payload executes or establishes persistence, reducing the dwell time of low-severity threats that might otherwise be missed by standard behavioral detections.
rule Upackv037betaDwing
{
meta:
author="malware-lu"
strings:
$a0 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 }
$a1 = { BE B0 11 [2] AD 50 FF 76 34 EB 7C 48 01 [2] 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 [3] 00 00 [2] 00 10 00 00 00 02 00 00 04 00 00 00 00 00 37 00 04 00 00 00 00 00 00 00 00 [3] 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 [2] 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE [3] 14 00 00 00 00 [6] 00 FF 76 38 AD 50 8B 3E BE F0 [3] 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 [5] 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 [4] E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 D2 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 8E FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 51 59 46 AD 85 C0 74 1F }
condition:
$a0 at pe.entry_point or $a1 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Scenario: A developer or sysadmin uses 7-Zip or WinRAR to extract a large archive of legacy application binaries or source code into a temporary directory. The YARA rule likely matches generic unpacking stubs or specific byte patterns found in the extracted executable headers or resource sections, which are common in older or compressed builds.
%TEMP%, C:\Users\<user>\AppData\Local\Temp) or specific known extraction paths (e.g., C:\ExtractedApps\). Additionally, exclude processes named 7zFM.exe, WinRAR.exe, or unrar.exe if the rule triggers on the parent process context.Scenario: An enterprise software installer (e.g., Adobe Creative Cloud, Microsoft Office, or VMware Workstation) runs a self-extracting archive (SFX) or uses a custom unpacking engine during installation. The YARA rule detects the unpacking routine within the installer’s temporary working directory or the intermediate executable stage.
setup.exe, install.exe, or specific vendor installers (e.g., AdobeInstaller.exe, msiexec.exe). Filter by command-line arguments containing /install, /setup, or paths under C:\Program Files\ or C:\Program Files (x86)\.Scenario: A security tool or endpoint agent (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) performs a memory scan or file hash verification that involves temporarily unpacking or decompressing file sections in memory or on disk. The YARA rule may match the decompression algorithm signatures (e.g., LZMA, Zlib) or the specific unpacking stubs used by these agents. *