UpackV037Dwing

Hunt Hypothesis

This YARA rule targets specific unpacking or obfuscation patterns associated with the “UpackV037Dwing” signature, indicating the presence of potentially hidden or transformed malicious code within memory or disk artifacts. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify low-severity, stealthy threats that may evade standard signature-based detections by analyzing process memory dumps or file scans for these unique structural anomalies.

YARA Rule

rule UpackV037Dwing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 0B 01 [14] 18 10 00 00 10 00 00 00 [8] 00 10 00 00 00 02 00 00 [12] 00 00 00 00 [32] 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 [4] 14 00 00 00 [40] 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 }
	$a1 = { 60 E8 09 00 00 00 [9] 33 C9 5E 87 0E }
	$a2 = { BE [4] AD 50 FF [2] EB }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment via Group Policy: When IT administrators deploy older, custom-built .NET applications (e.g., internal inventory management tools) to endpoints via Group Policy Software Installation, the installer or the resulting executable may contain specific byte patterns or obfuscated resources that match the UpackV037Dwing YARA signature. This is common with applications compiled using older versions of the .NET Framework or packed with legacy tools like UPX for size reduction.

  • Filter/Exclusion: Exclude files located in standard deployment paths such as C:\Program Files\InternalApps\ or C:\Program Files (x86)\CorporateTools\ where the file name matches known application binaries (e.g., InventoryManager.exe). Additionally, whitelist the specific SHA256 hash of the verified corporate binary.

• Scheduled Backup Agent Updates: Enterprise backup agents (such as Veeam, Commvault, or Veritas) often update their core service binaries or helper utilities during scheduled maintenance windows. If the update process involves unpacking or replacing a packed DLL or executable (e.g., backupagent.dll or svc_helper.exe) that uses a specific packing algorithm, the YARA rule may trigger on the temporary or final file state.

  • Filter/Exclusion: Exclude files in the vendor-specific backup directories (e.g., C:\Program Files\Veeam\Backup and Replication\ or C:\Program Files\Commvault\) and specifically target binaries with names like *agent*.exe, *svc*.dll, or *helper*.exe that are owned by the backup service account.

• Java Application Server Hot-Swapping: In environments running Java-based applications (e.g., Tomcat, WildFly, or Spring Boot apps), dynamic class loading or hot-swapping of JAR files can result in temporary unpacked classes or