SoftProtectwwwsoftprotectbyru

Hunt Hypothesis

This hypothesis targets the presence of SoftProtect, a known Russian banking trojan, by identifying its specific YARA signature within Azure Sentinel to detect compromised endpoints. Proactively hunting for this low-severity threat allows the SOC to identify early-stage infections and lateral movement attempts before the adversary establishes persistence or exfiltrates sensitive data.

YARA Rule

rule SoftProtectwwwsoftprotectbyru
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 8D [5] C7 00 00 00 00 00 E8 [4] E8 [4] 8D [5] 50 E8 [4] 83 [5] 01 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator manually installs or updates the SoftProtect endpoint protection agent on a workstation using the official installer from www.softprotect.by.
  • Filter/Exclusion: Exclude processes where the parent process is msiexec.exe or setup.exe and the file path contains SoftProtect or softprotect.by.
• Scenario: A scheduled task or Group Policy Object (GPO) pushes the SoftProtect agent update to multiple endpoints, triggering the YARA rule against the service binary or installer script.
  • Filter/Exclusion: Exclude events where the process name is svchost.exe (for service updates) or the command line contains softprotect and the user context is SYSTEM or a known admin account.
• Scenario: A backup or snapshot tool (e.g., Veeam, Commvault) reads the SoftProtect agent files during a disk image backup, causing the YARA rule to match the file content in the backup stream or temporary cache.
  • Filter/Exclusion: Exclude processes associated with backup software (e.g., veeam.exe, commvault.exe) or file paths located in temporary backup directories (e.g., C:\ProgramData\Veeam\).
• Scenario: A security scanner (e.g., ClamAV, Malwarebytes) performs a full disk scan and loads the SoftProtect agent binary into memory for analysis, triggering the YARA rule during the scan process.
  • Filter/Exclusion: Exclude processes where the parent process is a known antivirus or scanner executable (e.g., clamscan.exe, mbam.exe) and the file path matches the SoftProtect installation directory.
• Scenario: A developer or QA engineer runs the SoftProtect agent in a virtual machine or test environment to validate configuration changes, using a local copy of the