VPacker ttui

Hunt Hypothesis

This rule detects the presence of the VPacker packer, a tool frequently used by adversaries to compress and obfuscate malicious executables to evade static analysis. Proactively hunting for this indicator in Azure Sentinel helps identify potentially hidden payloads that may be staged on endpoints or in storage, allowing the SOC to uncover stealthy threats before they are executed.

YARA Rule

rule VPacker_ttui: PEiD
{
    strings:
        $a = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }
        $b = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer uses the ttui (TUI) interface of the vp (VPacker) tool to manually inspect or verify the integrity of a custom-packed application binary during a local development or pre-release testing phase.
  • Filter/Exclusion: Exclude processes where the parent process is a known IDE (e.g., code.exe, idea64.exe, devenv.exe) or a build system (e.g., msbuild.exe, cmake.exe) and the command line contains vp or ttui with arguments like --verify or --inspect.
• Scenario: An automated CI/CD pipeline job runs a custom script that invokes vp with the ttui flag to generate a human-readable summary report for a release artifact, which is then parsed by a downstream logging agent.
  • Filter/Exclusion: Exclude executions originating from specific CI/CD service accounts (e.g., svc-cicd, github-actions) or from paths within the CI workspace (e.g., C:\agents\work\_temp\) where the parent process is a shell interpreter (cmd.exe, bash.exe, pwsh.exe) and the working directory matches the CI workspace.
• Scenario: A system administrator performs a manual disk cleanup or archive verification task on a server, using vp in TUI mode to visually confirm that a large .vp archive is not corrupted before moving it to long-term storage.
  • Filter/Exclusion: Exclude processes running on servers (identified by OS version or specific server roles) where the user is a member of the Administrators or ServerAdmins group, and the process start time aligns with a scheduled maintenance window or is initiated by an interactive console session (not a service).
• Scenario: