NsPacKV34V35LiuXingPing

Hunt Hypothesis

This YARA rule targets specific memory patterns associated with the LiuXingPing malware family, indicating the presence of a low-severity threat often used for initial access or persistence. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify compromised endpoints before the adversary can escalate privileges or deploy additional payloads.

YARA Rule

rule NsPacKV34V35LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 [4] 80 38 01 0F 84 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Java Application Deployment (JRE/JDK Binaries)

  • Scenario: Enterprise Java applications (e.g., Tomcat, WildFly, or custom Spring Boot apps) are deployed to application servers. The YARA rule likely matches specific byte sequences in java.exe, jre libraries, or native JNI wrappers that contain similar structural patterns to the target malware. This is common when deploying large monolithic JARs or native libraries that share common header structures or string literals.
  • Filter/Exclusion: Exclude files located in standard Java runtime directories (e.g., C:\Program Files\Java\, C:\Program Files (x86)\Java\, C:\app\jre\) and files with extensions .jar, .class, or .so/.dll if they are part of a known Java deployment package.

• Version Control System (Git/SVN) Binary Object Storage

  • Scenario: Developers or CI/CD pipelines store binary artifacts (executables, libraries, or large data files) in Git LFS or SVN repositories. When these binaries are checked out or synced to build agents or developer workstations, the YARA rule may match the raw binary content of the stored objects, especially if the malware sample was previously committed or if the binary shares common code patterns (e.g., standard C runtime libraries).
  • Filter/Exclusion: Exclude files within .git/objects/, .svn/, or node_modules/ directories. Additionally, exclude processes or file paths associated with known VCS clients like git.exe, svn.exe, or tortoisegit.exe.

• CI/CD Pipeline Build Artifacts (Docker/Container Layers)

  • Scenario: In containerized environments (Docker, Kubernetes), base images or custom application images are pulled and