Armadillo3X5XSiliconRealmsToolworks

Hunt Hypothesis

This rule detects the presence of the Armadillo malware family, a known threat actor toolchain that often leverages custom tooling for initial access and lateral movement within Azure environments. Proactively hunting for this signature allows the SOC to identify dormant or active infections early, mitigating the risk of persistent footholds before they escalate to data exfiltration or privilege escalation.

YARA Rule

rule Armadillo3X5XSiliconRealmsToolworks
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 60 33 C9 75 02 EB 15 EB 33 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer is running a local build pipeline using a custom Go-based utility named armadillo3x5 (or similar internal naming convention) that compiles C++ extensions for a “Silicon Realms” physics engine. The binary contains specific string markers or section headers that match the YARA rule’s heuristic for tooling artifacts.
  • Filter/Exclusion: Exclude processes where the parent process is go.exe or msbuild.exe and the executable path resides under C:\Projects\PhysicsEngine\build\ or C:\Users\<dev>\go\bin\.
• Scenario: An IT admin is deploying a legacy patching tool called Toolworks_SiliconRealms_v2 via Group Policy or SCCM. The tool is a signed PE executable that includes a version string or comment section containing “Armadillo” and “3x5” as part of its internal build metadata, triggering the string-based match.
  • Filter/Exclusion: Exclude processes where the executable name is Toolworks_SiliconRealms*.exe and the digital signature is valid from the internal corporate CA, or where the process is launched by gpupdate.exe or ccmexec.exe.
• Scenario: A data scientist is running a Python script that uses a custom C-extension module named _armadillo3x5_silicon_realms_toolworks.so (or .pyd) for high-performance matrix operations. The YARA rule matches the file header or embedded strings in the shared library during loading.
  • Filter/Exclusion: Exclude file loads where the parent process is python.exe or jupyter-notebook.exe and the file path ends in site-packages\ or venv\lib\.
• Scenario: A security team is performing a red