AdysGlue110

Hunt Hypothesis

This rule detects the presence of the AdysGlue110 malware family, a known component of the AdysGlue trojan often used for initial access and payload delivery. Proactively hunting for this signature allows the SOC to identify compromised endpoints early, preventing potential lateral movement or privilege escalation within the Azure environment.

YARA Rule

rule AdysGlue110
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E [4] 0E 1F BF [2] 33 DB 33 C0 AC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: The AdysGlue110 YARA rule often targets specific byte patterns associated with older versions of Adobe Reader or specific glue code used in legacy PDF processing libraries. In many enterprises, this code remains embedded in the AcroRd32.exe binary or related DLLs on endpoints where Adobe Reader is installed via Group Policy Object (GPO) for document viewing.

  • Filter/Exclusion: Exclude files located in standard Adobe installation paths (e.g., C:\Program Files (x86)\Adobe\Acrobat Reader DC\ or C:\Program Files\Adobe\) and specifically whitelist the AcroRd32.exe and AdobeReader.dll binaries if their version matches the known legacy build.

• Scheduled Backup Agent Initialization: Some enterprise backup solutions (such as older versions of Symantec Backup Exec or Veritas NetBackup agents) utilize custom glue libraries to interface with the Windows Volume Shadow Copy Service (VSS). These agents may be scheduled to run via Task Scheduler or Service Control Manager during off-hours, loading the specific glue code that matches the YARA signature.

  • Filter/Exclusion: Correlate the detection with the parent process. If the parent process is a known backup service executable (e.g., bexsvc.exe, nbsvc.exe, or vssadmin.exe) and the file path resides in the vendor’s service directory (e.g., C:\Program Files\Symantec\Backup Exec\), suppress the alert.

• Java Runtime Environment (JRE) Native Libraries: The YARA rule may match native glue code within the Java Native Interface (JNI) libraries used by enterprise applications relying on Java (e.g., JBoss, Tomcat, or custom internal web apps). These libraries are frequently loaded by application servers running as services,