eXPressorProtection150XCGSoftLabs

Hunt Hypothesis

This rule identifies memory regions protected by the eXPressor 150 packer, a technique frequently used by adversaries to obscure malicious payloads and evade static analysis. Proactively hunting for this specific packer in Azure Sentinel allows the SOC to detect low-severity, potentially stealthy malware that relies on code compression to hide its true intent during initial compromise.

YARA Rule

rule eXPressorProtection150XCGSoftLabs
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 EB 01 [4] 83 EC 0C 53 56 57 EB 01 ?? 83 3D [4] 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 [4] 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 [4] 68 [4] B8 [4] FF D0 59 59 EB 01 C8 EB 02 66 F0 68 [4] E8 0E 05 00 00 59 EB 01 DD 83 65 F4 00 EB 07 8B 45 F4 40 89 45 F4 83 7D F4 61 73 1F EB 02 DA 1A 8B 45 F4 0F [6] 33 45 F4 8B 4D F4 88 [5] EB 01 EB EB }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT admin manually executes the eXPressorProtection150XCGSoftLabs binary (or a wrapper script invoking it) to test build integrity or verify license activation in a staging environment.
  • Filter/Exclusion: Exclude executions where the parent process is a known IDE (e.g., code.exe, devenv.exe, idea64.exe) or a build tool (e.g., msbuild.exe, dotnet.exe, npm.exe) and the file path resides within a standard development directory (e.g., C:\dev\, C:\projects\, C:\Users\<user>\source\).
• Scenario: A scheduled maintenance task or service account runs the protection module as part of a nightly backup verification or integrity check job, often triggered by Task Scheduler or a cron-like mechanism.
  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically for the Task Scheduler service), schtasks.exe, or powershell.exe with a script path containing keywords like maintenance, backup, or verify, and the user context is a known service account (e.g., svc_backup, DOMAIN\svc_integrity).
• Scenario: An application installer or updater (e.g., msiexec.exe, setup.exe, or a vendor-specific installer like install.exe for XCG SoftLabs products) launches the protection component during the installation or patching process.
  • Filter/Exclusion: Exclude executions where the parent process is msiexec.exe, setup.exe, or install.exe and the command line arguments contain flags typical of installation (e.g., /i, /qn, /passive) or the file path is within the vendor’s installation directory (e.g., `C