NakedPacker10byBigBoote

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing the NakedPacker10 by BigBoote packing tool to obfuscate malicious executables and evade signature-based detection. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to identify potentially hidden threats that may bypass standard antivirus solutions due to their low severity classification, ensuring early discovery of stealthy malware campaigns.

YARA Rule

rule NakedPacker10byBigBoote
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 FC 0F B6 05 34 [3] 85 C0 75 31 B8 50 [3] 2B 05 04 [3] A3 30 [3] A1 00 [3] 03 05 30 [3] A3 38 [3] E8 9A 00 00 00 A3 50 [3] C6 05 34 [3] 01 83 3D 50 [3] 00 75 07 61 FF 25 38 [3] 61 FF 74 24 04 6A 00 FF 15 44 [3] 50 FF 15 40 [3] C3 FF 74 24 04 6A 00 FF 15 44 [3] 50 FF 15 48 [3] C3 8B 4C 24 04 56 8B 74 24 10 57 85 F6 8B F9 74 0D 8B 54 24 10 8A 02 88 01 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the NakedPacker10byBigBoote detection rule, along with recommended filters and exclusions:

• Scheduled Antivirus Definition Updates via Vendor Tools

  • Scenario: Automated background processes from enterprise endpoint protection suites (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint, or Symantec Endpoint Protection) frequently download and unpack large definition signature packages. These updates often utilize proprietary packers that match the “BigBoote” heuristic, triggering alerts during nightly maintenance windows.
  • Filter/Exclusion: Create a file path exclusion for known update directories (e.g., C:\ProgramData\CrowdStrike\*\* or C:\Windows\System32\catroot2\) and add an exception based on the process image name of the specific AV service executable (e.g., csfalcon.exe, MsMpEng.exe).

• Enterprise Software Deployment via Microsoft Endpoint Configuration Manager (MECM/SCCM)

  • Scenario: During application deployment cycles, SCCM agents execute installation packages that are often compressed and packed using tools like 7-Zip or proprietary installers. When the agent unpacks these payloads to a temporary staging folder before execution, the “NakedPacker” signature is triggered by the extraction utility itself rather than a malicious payload.
  • Filter/Exclusion: Exclude processes running under the ccmexec.exe (Configuration Manager Client) user context and filter out events originating from the standard SCCM temporary cache directory (C:\Windows\CCMCache\).

• IT Admin Scripting with PowerShell or Python Packaging Tools

  • Scenario: System administrators frequently run custom automation scripts using PowerShell or Python to distribute configuration files. These scripts often utilize libraries like pyinstaller or `7z