UPXModifiedStubbFarbrauschConsumerConsulting

Hunt Hypothesis

This detection identifies consumer consulting applications that have been repacked using a modified UPX stub, potentially indicating an adversary’s attempt to obfuscate malware or legitimate tools by altering their compression signature. A proactive hunt is essential in Azure Sentinel to distinguish these modified executables from standard binaries, ensuring that subtle deviations in the UPX structure do not mask initial infection vectors or lateral movement activities.

YARA Rule

rule UPXModifiedStubbFarbrauschConsumerConsulting
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 BE [4] 8D BE [4] 57 83 CD FF FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the UPXModifiedStubbFarbrauschConsumerConsulting detection rule, including suggested filters and exclusions:

• Scenario: Deployment of Farbrausch Consumer Consulting Internal Tools

  • Context: The internal “Farbrausch Consumer Consulting” team frequently distributes custom diagnostic utilities (e.g., FCC_AuditTool.exe) to end-users. These tools are compiled with UPX compression to reduce download size and are often updated weekly via the company’s SCCM/Intune deployment pipeline.
  • Suggested Filter: Create a whitelist exclusion based on the specific file hash or path of known internal binaries.
    • Action: Exclude files located in C:\Program Files\Farbrausch Consumer Consulting\ where the publisher is verified as “Farbrausch Internal” and the digital signature matches the corporate certificate authority.

• Scenario: Automated Patching by Third-Party Security Agents

  • Context: The enterprise utilizes CrowdStrike or Microsoft Defender for Endpoint, which periodically downloads and executes UPX-packed stubs to update their own telemetry collectors or behavioral analysis modules. These agents often generate a temporary stub.exe during the update process that mimics the signature of the rule’s target.
  • Suggested Filter: Implement a process-based exclusion targeting known security vendors.
    • Action: Exclude alerts where the parent process is C:\Program Files\CrowdStrike\csagent.exe or C:\Windows\System32\DefenderSvc.exe, specifically when the child process name contains “UpdateStub” or matches the Farbrausch naming convention.

• Scenario: Scheduled Maintenance Jobs for Legacy ERP Modules

  • Context: A nightly scheduled task (Task Scheduler) runs a legacy reporting module named FCC_ReportingStub which relies on an older UPX-compressed