BobPackv100BoBBobSoft

Hunt Hypothesis

This rule identifies the presence of the BobSoft BobPack v100 malware family, a known threat often used for initial access or persistence in Windows environments. Proactively hunting for this signature allows the SOC team to detect dormant or low-noise infections that may evade standard behavioral detections, ensuring rapid containment before lateral movement occurs.

YARA Rule

rule BobPackv100BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED [4] E8 3D 00 00 00 89 85 [4] 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses BobSoft’s proprietary build tool (bobpack.exe) to compile internal microservices on a build server or CI/CD agent. The YARA rule matches the binary signature of the legitimate BobPackv100 installer or runtime component, triggering an alert despite the process being whitelisted in the software inventory.

  • Filter/Exclusion: Exclude alerts where the process path matches C:\Tools\BobSoft\BobPack\bin\* or where the parent process is a known CI/CD runner (e.g., jenkins.exe, agent.exe, build-agent.exe). Additionally, verify that the file hash matches the known good SHA256 for BobPackv100BoBBobSoft before flagging as malicious.

• Scenario: An IT administrator performs a scheduled maintenance task using BobSoft’s configuration management agent to push updates to endpoints. The agent temporarily spawns a helper process named bobpack_helper.exe during the update cycle, which contains the same YARA signature as the main binary, causing a false positive during peak maintenance windows.

  • Filter/Exclusion: Exclude alerts occurring during defined maintenance windows (e.g., Sundays 02:00–04:00 UTC) where the parent process is bobsoft_agent.exe or taskeng.exe (Windows Task Scheduler). Alternatively, add an exclusion for processes with the command line argument /update or /install originating from the BobSoft service account.

• Scenario: A user installs BobSoft’s desktop application suite via a standard MSI installer. The installer extracts the BobPackv100BoBBobSoft component to the user’s local application data folder (%LOCALAPPDATA%) and executes it briefly for registration or license validation. The YARA rule detects the