← Back to SOC feed Coverage →

SimpleUPXCryptorv3042005OnelayerencryptionMANtiCORE

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-08-24T11:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies potential file encryption activities associated with the SimpleUPX cryptor, which adversaries often leverage to obfuscate malware payloads and evade static analysis. Proactively hunting for this behavior in Azure Sentinel is essential to uncover early-stage intrusion attempts where attackers utilize single-layer encryption to conceal malicious executables before they execute their primary attack logic.

YARA Rule

rule SimpleUPXCryptorv3042005OnelayerencryptionMANtiCORE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 B8 [3] 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 [3] 00 C3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the SimpleUPXCryptorv3042005OnelayerencryptionMANtiCORE rule, including suggested filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar