PrivateEXEProtector18SetiSoft

Hunt Hypothesis

This rule detects the presence of executables packed or protected by the PrivateEXEProtector18SetiSoft tool, a technique often used by adversaries to obfuscate malicious binaries and evade static analysis. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potentially hidden payloads on endpoints that may be leveraging this specific packer to bypass traditional signature-based detections.

YARA Rule

rule PrivateEXEProtector18SetiSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer is compiling a custom internal utility using the SetiSoft PrivateEXEProtector 18 to obfuscate the binary before deployment to production servers.

  • Filter/Exclusion: Exclude files located in specific build directories (e.g., C:\Builds\, C:\Temp\Compiles\) or exclude processes initiated by known compiler/IDE executables (e.g., msbuild.exe, dotnet.exe, cl.exe) that are writing the protected EXE.

• Scenario: An IT administrator is manually packaging a legacy line-of-business application using the SetiSoft Protection Wizard GUI to apply license keys or protect the executable prior to mass distribution via SCCM.

  • Filter/Exclusion: Exclude the specific wizard executable (e.g., PepWizard.exe or SetiSoftWizard.exe) and its child processes, or exclude files in the user’s Desktop or Downloads folder if the protection is being performed interactively rather than via script.

• Scenario: A scheduled maintenance job runs a PowerShell script that uses the SetiSoft Command-Line Interface (PepCmd.exe or similar) to re-protect a critical service executable after a patch update, triggered by a Windows Task Scheduler entry.

  • Filter/Exclusion: Exclude the specific CLI executable name (e.g., PepCmd.exe) and correlate with the parent process being svchost.exe (Task Scheduler) or powershell.exe with a known script path (e.g., C:\Scripts\Maintenance\ProtectApp.ps1).

• Scenario: A QA engineer is testing a new version of an internal tool by running the SetiSoft Protector in “test mode” to verify that the protected binary launches correctly without crashing, often from a temporary