AVPACKv120

Hunt Hypothesis

This rule detects the presence of the AVPACKv120 YARA signature, which typically identifies specific malware families or packed executables that may be used for initial access or persistence. Proactively hunting for this pattern allows the SOC team to identify dormant or low-noise threats that might evade standard behavioral detections, ensuring early containment before the adversary establishes a foothold in the Azure environment.

YARA Rule

rule AVPACKv120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 [2] FC F3 A5 06 BB [2] 53 CB }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the VMware Tools installer or update script (vmware-tools.exe or vmware-toolbox-cmd.exe) during a scheduled patch Tuesday maintenance window. The binary often contains packing stubs that match the AVPACKv120 signature.
  • Filter/Exclusion: Exclude processes where the parent process is vmsvc.exe or the image path matches C:\Program Files\VMware\VMware Tools\.
• Scenario: Deployment of Java Runtime Environment (JRE) or Java Development Kit (JDK) updates via SCCM (System Center Configuration Manager) or WSUS. The java.exe or jre.exe binaries in newer versions may use packers that trigger this YARA rule, especially when executed by the CcmExec.exe or WUAHandler.exe parent process.
  • Filter/Exclusion: Exclude if the parent process is CcmExec.exe, WUAHandler.exe, or TrustedInstaller.exe and the image path contains \jre\ or \jdk\.
• Scenario: Execution of 7-Zip or WinRAR archive extraction utilities (e.g., 7zG.exe, WinRAR.exe) when invoked by a user or a scheduled task to unpack application dependencies. These tools are frequently packed to reduce size, and their specific versioning may align with the AVPACKv120 detection.
  • Filter/Exclusion: Exclude if the image name is 7zG.exe, 7zFM.exe, WinRAR.exe, or WinRAR.exe and the parent process is explorer.exe or a known service account process.
• Scenario: Running Git for Windows (git.exe) or GitHub Desktop background sync processes.