Upackv021BetaDwing

Hunt Hypothesis

This YARA rule targets the Upack v0.21 Beta Dwing packer, a tool frequently used by threat actors to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify potentially compromised hosts or staging environments where attackers are preparing or executing packed binaries before they trigger more advanced behavioral detections.

YARA Rule

rule Upackv021BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE 88 01 [2] AD 8B F8 [4] 33 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy Java application (e.g., an internal ERP or CRM module) uses the Upack library for obfuscating configuration files or small utility classes during the build process. The resulting JAR or WAR file is deployed to application servers and scanned by the EDR agent, triggering the YARA rule on the binary artifact.

  • Filter/Exclusion: Exclude files with extensions .jar, .war, or .class located in standard application directories (e.g., C:\Program Files\InternalApp\lib\ or /opt/app/lib/) from this specific YARA rule, or add a path-based exclusion for known application install directories.

• Scenario: A developer or DevOps engineer uses a custom Python or Java packaging script that incorporates the Upack algorithm to compress and protect proprietary plugin modules. These plugins are copied to a shared network drive or a build artifact repository (e.g., Artifactory, Nexus, or a SMB share) for distribution to other teams.

  • Filter/Exclusion: Exclude files located in designated build artifact repositories or shared development drives (e.g., \\fileserver\builds\, /var/lib/artifactory/) and exclude files with extensions like .zip, .tar.gz, or .plugin when they are being written to or read from these specific network paths.

• Scenario: A scheduled maintenance job runs a custom utility script that unpacks and re-packs a set of configuration templates using the Upack library. The temporary working directory (e.g., C:\Temp\upack_work\ or /tmp/upack_cache/) contains intermediate binary files that match the YARA signature before they are finalized and moved to their permanent location.

  • Filter/Exclusion: Exclude files in common temporary directories (C:\Temp\, `C:\Users<user>\AppData