WWPACKv305c4UnextrPasswcheckVirshield

Hunt Hypothesis

This YARA rule targets the VirShield packer, a tool frequently used by threat actors to compress and protect malicious payloads, often with password-based encryption, to evade static analysis and signature-based detection. Proactively hunting for this specific packer in Azure Sentinel allows the SOC team to identify potentially obfuscated malware artifacts early in the kill chain, reducing the time to detect and isolate compromised endpoints before the payload is fully executed.

YARA Rule

rule WWPACKv305c4UnextrPasswcheckVirshield
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 C0 1B B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Automated Deployment of Password-Protected Archives via SCCM/Intune

  • Context: IT operations teams frequently use System Center Configuration Manager (SCCM) or Microsoft Intune to distribute application installers or configuration packages wrapped in password-protected .zip or .7z files (often using WinRAR or 7-Zip) to prevent users from inspecting the contents before authentication. The YARA rule detects the WWPACK signature within the compressed container, flagging it as a potential virus shield or packed executable.
  • Filter/Exclusion: Exclude files located in standard deployment share paths (e.g., \\<SCCM_Server>\SoftwareDistribution\, C:\Windows\IntuneManagementExtension\) or exclude processes originating from ccmexec.exe or IntuneManagementAgent.exe when the file extension is .zip, .7z, or .rar and the password attribute is set.

• Scenario: Legitimate Use of WinRAR/7-Zip for Backup Rotation

  • Context: Backup administrators use scheduled tasks (e.g., via Windows Task Scheduler or cron-like jobs) to create encrypted archives of log files or database dumps using WinRAR or 7-Zip. The WWPACK string is a known signature for WinRAR’s compression algorithm. When these archives are scanned by the EDR/AV agent during real-time protection, the rule triggers because the file is a compressed, password-protected container.
  • Filter/Exclusion: Exclude files with extensions .rar, .zip, or .7z that are owned by service accounts (e.g., BackupServiceAccount) and located in designated backup directories (e.g., D:\Backups\, \\<NAS_Share>\Backups\). Alternatively, exclude if the parent process is WinRAR.exe or `7z.exe