RLPack FullEdition V120 LZMA 430 ap0x SignByfly

Hunt Hypothesis

This YARA rule targets the RLPack FullEdition V120 LZMA 430 ap0x SignByfly packer, a tool frequently used by adversaries to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this specific packer signature in Azure Sentinel allows the SOC team to identify potentially hidden executables or droppers that may be leveraging this known compression method to bypass initial detection layers.

YARA Rule

rule RLPack_FullEdition_V120_LZMA_430_ap0x_SignByfly: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses 7-Zip or WinRAR to compress a large source code repository or build artifact into a .7z or .rar file. The YARA rule likely matches the LZMA header signature and the specific “RLPack” magic bytes if the compression tool embeds metadata or if the rule is overly broad on LZMA stream headers.

  • Filter/Exclusion: Exclude files with extensions .7z, .rar, .zip, or .tar.gz from YARA scanning. Additionally, exclude paths under standard build directories (e.g., C:\builds\, D:\artifacts\) or user profile temp folders where compression tools operate.

• Scenario: An IT administrator runs Ninite or Chocolatey to install or update software packages. These tools often download and extract .7z or .zip archives containing LZMA-compressed payloads. The YARA rule may trigger on the intermediate compressed files before they are fully extracted and executed.

  • Filter/Exclusion: Exclude processes known to be package managers (e.g., ninite.exe, choco.exe, winget.exe) and their child processes. Also, exclude files located in temporary extraction directories (e.g., %TEMP%\chocolatey\, %TEMP%\ninite\) during the installation window.

• Scenario: A scheduled task or service uses LZMA SDK or a custom C++/C# application to compress log files or database backups into .lzma or .7z format for archival. The YARA rule matches the LZMA stream signature in the archive file.

  • Filter/Exclusion: Exclude files with the .lzma extension. Additionally, whitelist specific service executables (e.g., backup-agent.exe, `log-rotator.exe