ACProtect109gRiscosoftwareInc

Hunt Hypothesis

This hunt detects the execution of Riso Software Inc’s ACProtect 109g packer, which adversaries often leverage to obfuscate malicious binaries and evade static analysis by hiding code signatures within legitimate-looking containers. A SOC team should proactively hunt for this behavior in Azure Sentinel because low-severity detections of known packers can serve as a critical early warning signal for sophisticated threats that utilize custom or modified packaging techniques to bypass traditional signature-based defenses.

YARA Rule

rule ACProtect109gRiscosoftwareInc
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the ACProtect109gRiscosoftwareInc detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Deployment of RISO Printer Drivers via SCCM

  • Context: During a quarterly infrastructure update, System Center Configuration Manager (SCCM) pushes the “RICOH ACProtect” driver package to all workstations. The installation executable (ACProtectSetup.exe) is wrapped in an ACProtect shell by the vendor, triggering the YARA signature upon execution during the deployment window.
  • Suggested Filter/Exclusion: Create a whitelist entry for the specific file hash of C:\Windows\System32\Drivers\RICOH\ACProtectSetup.exe or exclude processes launched directly under the parent process ccmsetup.exe (SCCM) with the command line containing “RISO”.

• Scenario: Scheduled Backup Job Executing on RISO Document Servers

  • Context: A nightly scheduled task runs a custom PowerShell script to archive document logs from RICOH multifunction devices. The script invokes ACProtectAgent.exe (protected by the same vendor) to encrypt and compress logs before sending them to the backup server, causing the rule to fire repeatedly at 02:00 AM daily.
  • Suggested Filter/Exclusion: Exclude alerts where the parent process is svchost.exe or powershell.exe running on specific hostnames matching the pattern *RISO-DOC-*, and restrict the detection window to exclude hours between 01:00 and 04:00 for these specific hosts.

• Scenario: Admin Manual Configuration of RICOH MFP Devices

  • Context: A helpdesk technician manually connects to a RICOH C-Series multifunction printer via the “RICOH Smart Device