RatPackerGluestub

Hunt Hypothesis

This detection identifies the presence of the RatPacker Gluestub component, a known indicator often associated with the initial staging or delivery phase of the RatPacker remote access trojan (RAT). Proactively hunting for this signature in Azure Sentinel is critical to uncover early-stage adversary footholds before they escalate into full-scale lateral movement or data exfiltration campaigns.

YARA Rule

rule RatPackerGluestub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 40 20 FF 00 00 00 00 00 00 00 ?? BE 00 60 40 00 8D BE 00 B0 FF FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the RatPackerGluestub detection rule, including suggested filters and exclusions:

• Scenario: Deployment of Java Applications via JBoss or WildFly

  • Context: Enterprise application servers (e.g., Red Hat JBoss EAP, Apache WildFly) often utilize a “glue” stub mechanism to initialize Java Virtual Machine (JVM) components during startup. The YARA rule may flag the java.exe process spawning child processes or loading specific bytecode libraries that mimic the RatPackerGluestub signature structure.
  • Filter/Exclusion: Add a whitelist for the parent process path: C:\Program Files\Red Hat\JBoss EAP-7.5\bin\jboss-cli.bat and exclude any child processes spawned by java.exe where the command line contains -Dglue.stub=true.

• Scenario: Scheduled Backup Jobs Using Veeam or Commvault

  • Context: During nightly maintenance windows, backup agents (e.g., Veeam Agent for Windows) often execute a “stub” process to establish connectivity with the backup repository before transferring data. This initialization phase frequently matches the RatPackerGluestub signature due to similar memory footprint and file hashing patterns used in their agent communication layer.
  • Filter/Exclusion: Create an exclusion based on the scheduled task name: \Microsoft\Veeam\Backup or process path C:\Program Files\Veeam\Agent\veeamagent.exe. Filter out alerts where the event source is “Task Scheduler” and the trigger time aligns with the defined backup window (e.g., 02:00 – 04:00).

• Scenario: Microsoft Endpoint Configuration Manager (SCCM) Application Updates

  • Context: When