ARMProtector01bySMoKE

Hunt Hypothesis

This YARA rule targets the ARMProtector01bySMoKE signature, which is indicative of a specific malware family or protector often used to obfuscate malicious payloads on ARM-based architectures. Proactively hunting for this signature in Azure Sentinel helps identify potentially compromised ARM devices or workloads that may be leveraging this protector to evade standard detection mechanisms.

YARA Rule

rule ARMProtector01bySMoKE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 5E 1F 40 00 EB 02 83 09 8D B5 EF 1F 40 00 EB 02 83 09 BA A3 11 00 00 EB 01 00 8D 8D 92 31 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• ARM64 Cross-Compilation Toolchains: Developers or CI/CD pipelines using docker buildx with the arm64 platform or native ARM64 compilers (e.g., aarch64-linux-gnu-gcc) may generate or cache binary artifacts that match the YARA signature.
  • Filter/Exclusion: Exclude processes originating from known build directories (e.g., C:\ProgramData\Docker\buildx\, /var/lib/docker/) or exclude parent processes like dockerd, buildx, or make when the file path ends in common compiler output extensions (.o, .so, .a).
• ARM64 Native Application Updates: Enterprise applications that have native ARM64 builds (e.g., Microsoft Edge, Visual Studio Code, or Java JDK 17+ ARM64 builds) may update their core binaries during scheduled maintenance windows, triggering the detection on the new executable.
  • Filter/Exclusion: Exclude updates performed by known service executables (e.g., msedge.exe, code.exe, java.exe) or exclude file paths under standard installation directories (e.g., C:\Program Files\Microsoft\Edge\, C:\Users\<user>\AppData\Local\Programs\Microsoft VS Code\) where the binary is signed by the vendor.
• ARM64 Emulation Layers (Wine/Box64/Box86): Linux environments running x86_64 applications via box64/box84 or Windows environments using ARM64 emulation layers may load or write temporary ARM64-compatible stubs or libraries that match the rule.
  • Filter/Exclusion: Exclude processes where the parent is box64, box86, or wine64.exe, or exclude file paths containing `