This YARA rule targets specific memory patterns associated with the RLPack full edition, indicating the presence of a packed DLL that adversaries may use to obscure malicious code execution or hide the true intent of a binary. Proactively hunting for this signature allows the SOC team to identify potentially obfuscated payloads early in the kill chain, reducing the risk of undetected lateral movement or privilege escalation within the Azure environment.
rule RLPackFullEdition117DLLAp0x
{
meta:
author="malware-lu"
strings:
$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF E8 }
condition:
$a0 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
Legacy Application Deployment via Group Policy:
RLPackFullEdition117.dll file as part of its standard installation package. This DLL is often bundled with older .NET Framework dependencies or specific runtime libraries that have not been updated in years.C:\Program Files\LegacyApp\bin\, C:\Program Files (x86)\VendorApp\) where the parent folder name matches known legacy application names. Alternatively, exclude if the file’s digital signature is valid and issued by a known vendor (e.g., “Vendor Inc.”) and the file version matches the expected release.Scheduled Maintenance Job for Database Backups:
DailyDBBackup) runs a custom backup script that loads RLPackFullEdition117.dll to compress or encrypt backup files before transferring them to the NAS. The DLL is loaded by a helper executable (BackupHelper.exe) that is whitelisted but resides in a non-standard system directory like C:\Scripts\.BackupHelper.exe and the parent process is schtasks.exe or Task Scheduler (PID 1001 or similar). Additionally, exclude if the file path contains C:\Scripts\ or C:\AdminTools\ and the file creation date is older than 6 months.Third-Party Antivirus/EDR Component Update: