UnnamedScrambler13Bp0ke

Hunt Hypothesis

This YARA rule targets the execution or presence of the UnnamedScrambler13Bp0ke malware, a low-severity threat often associated with initial access or fileless execution techniques. Proactively hunting for this signature allows the SOC team to identify compromised endpoints early, potentially preventing lateral movement or data exfiltration before the adversary establishes a more persistent foothold in the Azure environment.

YARA Rule

rule UnnamedScrambler13Bp0ke
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC B9 08 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 98 56 00 10 E8 48 EB FF FF 33 C0 55 68 AC 5D 00 10 64 FF 30 64 89 20 6A 00 68 BC 5D 00 10 68 C4 5D 00 10 6A 00 E8 23 EC FF FF E8 C6 CE FF FF 6A 00 68 BC 5D 00 10 68 [4] 6A 00 E8 0B EC FF FF E8 F2 F4 FF FF B8 08 BC 00 10 33 C9 BA 04 01 00 00 E8 C1 D2 FF FF 6A 00 68 BC 5D 00 10 68 E4 5D 00 10 6A 00 E8 E2 EB FF FF 68 04 01 00 00 68 08 BC 00 10 6A 00 FF 15 68 77 00 10 6A 00 68 BC 5D 00 10 68 FC 5D 00 10 6A 00 E8 BD EB FF FF BA 10 5E 00 10 B8 70 77 00 10 E8 CA F3 FF FF 85 C0 0F 84 F7 05 00 00 BA 74 77 00 10 8B 0D 70 77 00 10 E8 FE CD FF FF 6A 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a legitimate code obfuscation tool (e.g., obfuscator.io, Proguard, or custom Python/JS minifiers) to prepare release binaries or frontend assets. The resulting file contains high-entropy strings or specific byte patterns that match the UnnamedScrambler13Bp0ke heuristic.

  • Filter/Exclusion: Exclude files located in standard build output directories (e.g., C:\Projects\*\dist\, C:\Projects\*\build\, node_modules\) or files with extensions commonly associated with compiled/minified code (.min.js, .class, .jar) when the parent process is a known build tool (e.g., npm.exe, mvn.cmd, dotnet.exe).

• Scenario: An enterprise backup or snapshot utility (e.g., Veeam, Commvault, or Windows Server Backup) creates temporary shadow copies or deduplicated data blocks on the staging volume. These blocks may contain fragmented or compressed data that triggers the YARA rule due to unusual string density or specific header bytes.

  • Filter/Exclusion: Exclude files with names matching backup patterns (e.g., *.vbk, *.vib, *.tmp in backup staging folders) or files owned by known backup service accounts (e.g., VeeamBackupSvc, CommvaultAgent) when the file path resides in designated backup repositories (e.g., \\backupserver\recovery\, C:\BackupStaging\).

• Scenario: A security team performs a controlled penetration test or red team exercise, deploying a custom payload or C2 beacon that intentionally uses obfuscation techniques to evade basic detection. The YARA rule matches the test artifact, creating a false positive in the SOC queue.

  • Filter/Exclusion: Exclude