UPXModifiedstub

Hunt Hypothesis

This rule identifies executables that have been packed or modified using the UPX packer with a non-standard or altered stub, a common technique adversaries employ to compress malware and evade static signature-based detection. Proactively hunting for these artifacts allows the SOC to uncover stealthy payloads that may be hiding in memory or on disk, ensuring that compressed binaries are properly unpacked and analyzed to reveal their true malicious behavior.

YARA Rule

rule UPXModifiedstub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 [3] FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a custom build pipeline that applies UPX compression to a specific C++ application binary before deployment, but the build script modifies the UPX stub slightly to embed version metadata or adjust stack alignment for a specific OS kernel version.
  • Filter/Exclusion: Exclude binaries located in specific build artifact directories (e.g., C:\Builds\Release\, /opt/app/bin/) or filter by file extension (.exe, .dll) combined with a known hash list of approved compressed binaries.
• Scenario: An IT administrator manually compresses a legacy utility (e.g., Sysinternals tools or a custom internal script) using a patched version of UPX to reduce file size for distribution over a slow network link, resulting in a modified stub that differs from standard UPX signatures.
  • Filter/Exclusion: Exclude files owned by specific service accounts (e.g., svc_deploy, admin_build) or filter by directory paths associated with shared network drives used for tool distribution (e.g., \\fileserver\tools\, C:\Program Files\InternalTools\).
• Scenario: A security team or application developer uses a custom linker or packer tool (such as a modified version of UPX or a similar packer like ASPack) that mimics UPX structure but alters the stub to include custom entry point logic or anti-debugging checks.
  • Filter/Exclusion: Filter by process parent (e.g., if the binary is loaded by a known development IDE like devenv.exe or code.exe) or exclude binaries with specific PE section names that indicate custom packing (e.g., sections named .custom_stub or .meta).
• Scenario: A scheduled maintenance job runs a script that compresses temporary diagnostic logs or small configuration binaries using UPX with non-default flags