This hypothesis targets the presence of the HMIYSPacker10hmimys YARA signature, which indicates the use of a specific packer often employed by adversaries to compress or obfuscate malicious payloads and evade static analysis. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potentially compromised workloads or containers that may be hosting packed executables, thereby reducing the time to detect stealthy malware variants before they execute or propagate.
rule hmimysPacker10hmimys
{
meta:
author="malware-lu"
strings:
$a0 = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 }
condition:
$a0
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legacy Application Maintenance: The hmimysPacker is a known UPX variant or custom packer often used in older, legacy C/C++ applications or specific vendor tools (e.g., old versions of WinRAR, 7-Zip, or proprietary SCM agents) that have not been updated in years. These binaries may be stored in shared network drives or local application directories (C:\Program Files\LegacyApp\bin\) and scanned by agents during routine integrity checks.
C:\Program Files\LegacyApp\, C:\Program Files (x86)\VendorTool\) or whitelist specific known-good hashes (SHA256) of these legacy binaries.Development and Build Artifacts: Developers using Visual Studio or JetBrains Rider may compile debug or release builds of C/C++ projects using a custom linker script or a specific version of UPX (Unified Pack eXecutable) configured to use the hmimys compression algorithm for size optimization. These unstripped or packed binaries reside in local bin\Debug or bin\Release folders on developer workstations.
*\bin\Debug\*, *\bin\Release\*, or *\obj\* on user workstations (excluding servers). Alternatively, exclude files created by the MSBuild.exe or dotnet build processes within the last 24 hours.Scheduled Backup and Cleanup Jobs: Enterprise backup solutions like Veeam, Commvault, or Windows Server Backup may create temporary compressed archives or use custom packing utilities to optimize backup chunks. If the backup agent uses a custom compression library that maps to the hmimys signature, the