← Back to SOC feed Coverage →

RLPackV112V114aPlib043ap0x

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-09-16T11:00:01Z · Confidence: medium

Hunt Hypothesis

This YARA rule targets specific binary patterns associated with the RLPack family, indicating the presence of a packed executable that may be used to obscure malicious code or facilitate initial access. Proactively hunting for this signature in Azure Sentinel helps identify low-severity, potentially stealthy implants that adversaries might deploy to evade static analysis and establish a foothold within the environment.

YARA Rule

rule RLPackV112V114aPlib043ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF EB 0F FF [3] FF [3] D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar