This YARA rule targets specific binary patterns associated with the RLPack family, indicating the presence of a packed executable that may be used to obscure malicious code or facilitate initial access. Proactively hunting for this signature in Azure Sentinel helps identify low-severity, potentially stealthy implants that adversaries might deploy to evade static analysis and establish a foothold within the environment.
rule RLPackV112V114aPlib043ap0x
{
meta:
author="malware-lu"
strings:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 [4] 8D 9D [4] 33 FF EB 0F FF [3] FF [3] D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }
condition:
$a0
}
This YARA rule can be deployed in the following contexts:
This rule contains 1 string patterns in its detection logic.
plib043ap0x signature, the YARA rule may match the binary or archive.
C:\Program Files\Java\, C:\opt\java\app\) or specific known application paths (e.g., C:\SAP\GUI\) where the hash or path matches known good deployments.plib043ap0x pattern as part of their standard build artifacts.
C:\Program Files (x86)\Microsoft Visual Studio\, C:\msys64\, C:\Intel\oneAPI\) or files with extensions like .lib, .a, or .so in these specific paths.plib043ap0x as part of the file header or embedded metadata, triggering a match on the archive file itself.
.zip, .tar, .gz, `.7z