RLPackFullEdition117DLLLZMAAp0x

Hunt Hypothesis

This rule identifies the presence of a specific packed executable using the RLPack Full Edition 1.17 packer with LZMA compression, a technique adversaries often employ to compress malicious payloads and evade static analysis. Proactively hunting for this signature allows the SOC to uncover stealthy, compressed threats that may be hiding in memory or on disk before they execute their intended malicious logic.

YARA Rule

rule RLPackFullEdition117DLLLZMAAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 80 7C 24 08 01 0F 85 [4] 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 [4] 6A 40 68 [4] 68 [4] 6A 00 FF 95 EB 09 00 00 89 85 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer uses the RLPack command-line utility to compress a large C++ or C# application project into a single executable for distribution or testing. The resulting packed binary contains the specific LZMA compression signatures and header structures defined in the rule, triggering the alert during a file integrity scan or on-host detection.

  • Filter/Exclusion: Exclude files located in standard build output directories (e.g., C:\Projects\*\bin\Release\, D:\Builds\*\dist\) or files with the .rlpack extension if the rule is designed to catch packed executables. Alternatively, whitelist the specific RLPack tool executable if it is a known signed binary used by the development team.

• Scenario: An IT administrator deploys a custom internal tool or a third-party utility that utilizes the RL Packager for full edition compression to reduce deployment size. The tool is installed in a standard program files directory (e.g., C:\Program Files\InternalTools\RLTool\) and is executed by a scheduled task for nightly data processing, causing the YARA rule to match the DLL or EXE file.

  • Filter/Exclusion: Create a whitelist for the specific internal tool’s executable path (e.g., C:\Program Files\InternalTools\RLTool\RLTool.exe). If the rule targets DLLs, ensure the exclusion covers the specific DLL name (e.g., RLPackCore.dll) within that directory.

• Scenario: A legacy application or a specific version of a commercial software suite (e.g., certain versions of Adobe Creative Cloud plugins or older Java-based enterprise apps) uses RL Packager for its installer or runtime components. When the software is updated or reinstalled, the new files are scanned and flagged because they retain the LZMA-packed structure.

  • Filter/Exclusion: Add an