Upackv033v034BetaDwing

Hunt Hypothesis

This YARA rule targets specific unpacking routines associated with the Upack v0.33 and v0.34 beta variants, indicating the presence of malware that actively unpacks its payload in memory to evade static analysis. Proactively hunting for these signatures in Azure Sentinel allows the SOC to identify low-severity, potentially stealthy threats that may be executing in user sessions or service accounts before they establish persistence or exfiltrate data.

YARA Rule

rule Upackv033v034BetaDwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via MSI/EXE Installers: Many older enterprise applications (e.g., legacy ERP modules, specialized engineering CAD software, or specific banking clients) bundle their installers using older versions of NSIS, Inno Setup, or custom packers that match the Upack signature range (v0.33/v0.34). These are often deployed via SCCM, Intune, or GPO during standard patch cycles or new hires.

  • Filter/Exclusion: Exclude files located in standard application directories (e.g., C:\Program Files\, C:\Program Files (x86)\) or exclude specific known-good hashes of the installer executables (e.g., setup.exe, install.msi extracted binaries) from the YARA scan if the parent process is a known deployment tool like msiexec.exe or ccmsetup.exe.

• Scheduled Maintenance Jobs for Third-Party Utilities: Certain IT maintenance tools, such as disk cleanup utilities, log rotation scripts, or specific backup agents (e.g., older versions of Veeam, Commvault, or custom internal tools), may use packed executables to reduce size or protect IP. These are often triggered by Task Scheduler at specific times (e.g., 2 AM daily).

  • Filter/Exclusion: Exclude processes spawned by schtasks.exe or Task Scheduler if the executable path resides in a dedicated maintenance folder (e.g., C:\ProgramData\CompanyTools\Maintenance\) and the command line arguments match known maintenance patterns (e.g., /clean, /rotate).

• Development and QA Environments (CI/CD Agents): In DevOps pipelines, build agents or QA test runners may execute compiled test binaries or temporary build artifacts that are packed to ensure consistent behavior across environments. These are common in Jenkins, Azure DevOps, or