yodas Protector V102 Ashkbiz Danehkar Sign by fly

Hunt Hypothesis

This rule identifies the presence of Yodas Protector, a lightweight packer frequently used by threat actors to obfuscate malicious payloads and evade static analysis. Proactively hunting for this signature in Azure Sentinel allows the SOC to detect potentially compromised endpoints or staged malware before it executes, reducing the risk of stealthy persistence or lateral movement within the environment.

YARA Rule

rule yodas_Protector_V102_Ashkbiz_Danehkar_Sign_by_fly: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Application Deployment: A widely used internal line-of-business (LOB) application written in C# is compiled with an older version of the Yodas Protector (V102) to protect intellectual property. When IT operations pushes this application to a fleet of workstations via SCCM or Intune, the binary signature matches the rule.

  • Filter/Exclusion: Exclude files located in specific application installation directories (e.g., C:\Program Files\InternalLOBApp\) or exclude based on the specific SHA-256 hash of the known good binary if the version is stable.

• Third-Party Plugin or Add-on: A popular third-party plugin for a development IDE (e.g., a Visual Studio extension or a JetBrains plugin) or a browser extension is distributed as a signed executable or DLL that uses Yodas Protector for code obfuscation. When developers install or update these plugins, the detection triggers.

  • Filter/Exclusion: Exclude files residing in standard plugin directories (e.g., %LOCALAPPDATA%\Programs\Microsoft\VisualStudio\... or %APPDATA%\Code\...) or create an allowlist for the specific vendor’s signature path if the plugin is widely adopted.

• Scheduled Backup or Sync Agent: A niche backup or file synchronization agent (e.g., a custom-built internal tool or a specialized third-party agent like a specific version of Veeam or a custom Python-based sync script compiled with PyInstaller and protected) runs on a schedule. The agent’s executable or its helper DLLs are protected with Yodas Protector, causing detections during routine service starts or updates.

  • Filter/Exclusion: Exclude the specific service name or process name (e.g., InternalSyncAgent.exe) or exclude the path where the agent is installed (e.g., `C:\Program Files\InternalTools\SyncAgent