Detects an UPX-unpacked .777 ransomware binary.

Hunt Hypothesis

This hunt targets adversaries who deploy obfuscated ransomware executables using the UPX packer and a distinctive “.777” file extension to evade initial signature-based detection. Proactively hunting for this specific binary configuration in Azure Sentinel is critical because it allows the SOC team to identify early-stage infection attempts before encryption begins, even when standard severity alerts are initially low.

YARA Rule

rule legion_777
{
    meta:
        author = "Daxda (https://github.com/Daxda)"
        date = "2016/6/6"
        description = "Detects an UPX-unpacked .777 ransomware binary."
        ref = "https://github.com/Daxda/malware-analysis/tree/master/malware_samples/legion"
        category = "Ransomware"
        sample = "SHA256: 14d22359e76cf63bf17268cad24bac03663c8b2b8028b869f5cec10fe3f75548"

    strings:
        $s1 = "http://tuginsaat.com/wp-content/themes/twentythirteen/stats.php"
        $s2 = "read_this_file.txt" wide // Ransom note filename.
        $s3 = "seven_legion@india.com" // Part of the format string used to rename files.
        $s4 = {46 4f 52 20 44 45 43 52 59 50 54 20 46 49 4c 45 53 0d 0a 53 45 4e 44 20 4f
               4e 45 20 46 49 4c 45 20 49 4e 20 45 2d 4d 41 49 4c 0d 0a 73 65 76 65 6e 5f
               6c 65 67 69 6f 6e 40 69 6e 64 69 61 2e 63 6f 6d } // Ransom note content.
        $s5 = "%s._%02i-%02i-%02i-%02i-%02i-%02i_$%s$.777" // Renaming format string.

    condition:
        4 of ($s*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the “Detects an UPX-unpacked .777 ransomware binary” rule, tailored for a legitimate enterprise environment:

• Scheduled Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team deploys a new version of a third-party utility (e.g., Adobe Acrobat Reader or Zoom) using Microsoft Endpoint Configuration Manager (SCCM). The installer package is compressed and packed with UPX to reduce network transfer size. During the scheduled maintenance window, the deployment agent extracts the binary on client endpoints, triggering the detection as it appears as an unpacked .777 executable.
  • Filter/Exclusion: Create a whitelist rule excluding binaries located in standard software installation directories (e.g., C:\Program Files\, C:\Windows\SoftwareDistribution\) that are signed by trusted publishers (e.g., “Adobe Inc.”, “Zoom Video Communications”) and executed only during defined maintenance windows.

• Automated Patch Management Agent Execution

  • Scenario: An enterprise patch management tool like Ivanti or ManageEngine runs a nightly job to update critical security agents. The updater component is often distributed as an UPX-packed executable to ensure integrity and reduce footprint. When the agent performs a self-update, it unpacks the binary in the temporary directory (%TEMP%) before installation, mimicking the behavior of ransomware unpacking itself.
  • Filter/Exclusion: Exclude processes initiated by known patch management service accounts (e.g., NT SERVICE\IvantiPatchService) and filter out events where the parent process is the specific patch agent executable (e.g., IvantiAgent.exe or ManageEngineUpdate.exe).

• Enterprise Antivirus Heuristic Scanning

  • Scenario: The organization’s endpoint protection suite (e.g., CrowdStrike Falcon, Sentinel