SLVc0deProtector060SLVICU

Hunt Hypothesis

This rule detects the presence of the CodeProtector malware variant, which is often used to obfuscate malicious payloads and evade static analysis during initial access or lateral movement. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary can establish persistence or execute further post-exploitation actions.

YARA Rule

rule SLVc0deProtector060SLVICU
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a commercial obfuscation tool (e.g., Dotfuscator for .NET or Protege for Java) to protect proprietary source code before deployment to a staging environment. The YARA rule matches the specific byte patterns or string markers introduced by the obfuscator, flagging the compiled binary or JAR file as malicious.
  • Filter/Exclusion: Exclude files located in specific build artifact directories (e.g., C:\Builds\artifacts\, /opt/ci/builds/) or filter by file extension (.dll, .jar) when the parent process is a known build tool (e.g., msbuild.exe, gradle, mvn).
• Scenario: An IT administrator performs a routine maintenance task using VMware Workstation or Hyper-V to snapshot a virtual machine that contains a custom application protected by a legacy code protector. The snapshot file (.vmdk or .vhdx) is scanned by the EDR agent, and the YARA rule triggers on the embedded protected code segments within the disk image.
  • Filter/Exclusion: Exclude file types associated with virtual machine disk images (.vmdk, .vhdx, .vhd, .qcow2) or exclude paths under standard VM storage locations (e.g., C:\Users\Public\VMs\, /var/lib/libvirt/images/).
• Scenario: A QA engineer runs a regression test suite using Selenium or Cypress against a web application that utilizes client-side JavaScript obfuscation (e.g., via Terser or UglifyJS) to reduce bundle size. The browser’s cache or temporary download folder stores the obfuscated JS files, which match the YARA signature for protected code structures.

  ---