This hypothesis targets the presence of ZealPack, a ransomware strain known for encrypting files and deploying additional payloads, indicating a potential active compromise or staging phase within the environment. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify early-stage infections or dormant malware components before they execute their encryption routines, thereby reducing mean time to detect (MTTD) and limiting lateral movement.
rule ZealPack10Zeal
{
meta:
author="malware-lu"
strings:
$a0 = { C7 45 F4 00 00 40 00 C7 45 F0 [4] 8B 45 F4 05 [4] 89 45 F4 C7 45 FC 00 00 00 00 EB 09 8B 4D FC 83 C1 01 89 4D FC 8B 55 FC 3B 55 F0 7D 22 8B 45 F4 03 45 FC 8A 08 88 4D F8 0F BE 55 F8 83 F2 0F 88 55 F8 8B 45 F4 03 45 FC 8A 4D F8 88 08 EB CD FF 65 F4 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Scenario: A developer or DevOps engineer uses Zeal (a popular API documentation viewer) to review internal microservice documentation locally. The application bundles specific JavaScript libraries or native modules that match the YARA signature for ZealPack10Zeal, particularly if the user has recently updated the app or cleared the cache.
Zeal.exe (or zeal on Linux/macOS) and the file path contains /Zeal/ or C:\Users\<User>\AppData\Local\Zeal\. Additionally, exclude if the working directory matches the user’s local Zeal data folder.Scenario: An IT administrator runs a scheduled PowerShell script using WinGet or Chocolatey to update or install Zeal for a team of engineers. The installation package or temporary extraction folder contains the ZealPack10Zeal signature during the brief window of file extraction before the installer completes and registers the correct application identity.
msiexec.exe, powershell.exe, or choco.exe and the command line contains keywords like zeal, install, or update. Also, exclude if the file location is in a temporary directory (%TEMP%, C:\Windows\Temp) and the process age is less than 60 seconds.Scenario: A security team performs a YARA rule tuning exercise or a threat hunting simulation where they intentionally drop a known good copy of Zeal (or a test file with the same hash/signature) into a sandbox or test VM to validate detection logic. The file is scanned by the EDR agent while it is still in a transient state or during a manual scan.