EXECryptorV22Xsoftcompletecom

Hunt Hypothesis

This rule identifies the presence of the EXECryptorV22Xsoftcompletecom binary, a known cryptor often used to encrypt files for ransom or obfuscation, indicating potential data exfiltration or ransomware preparation. Proactively hunting for this artifact allows the SOC to detect early-stage infection or staging activities before the encryption process completes, minimizing the impact on Azure-hosted workloads.

YARA Rule

rule EXECryptorV22Xsoftcompletecom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legitimate software updates for XsoftComplete products (e.g., XsoftComplete Backup, XsoftComplete Antivirus) where the installer or updater executable is digitally signed by “XsoftComplete” but may be packed or obfuscated in a way that matches the EXECryptor heuristic, especially if the YARA rule relies on string matching for “XsoftComplete” combined with generic encryption markers.

  • Filter/Exclusion: Exclude processes where the image path contains \XsoftComplete\ or \Xsoft\ and the file is signed by XsoftComplete, Inc. or XsoftComplete. Additionally, exclude if the parent process is a known update service like wuaexep.exe or msiexec.exe with a specific XsoftComplete product code.

• Scenario: Scheduled maintenance jobs for XsoftComplete tools that run from a shared network drive or a specific admin folder (e.g., C:\Admin\XsoftComplete\Tools\), where the executable is a small utility or script runner that gets temporarily packed or renamed, triggering the “EXECryptor” pattern due to its size or entropy, while containing the string “XsoftComplete” in its metadata or command line.

  • Filter/Exclusion: Exclude if the process command line contains XsoftComplete and the process is launched by Task Scheduler (svchost.exe with Tasksched.dll or directly by taskschd.msc context) or by a known service account (e.g., DOMAIN\svc-xsoft-maint). Also, exclude if the image path is under a designated maintenance folder like C:\ProgramData\XsoftComplete\.

• Scenario: Development or QA environments where engineers use XsoftComplete SDKs or test harnesses that bundle executables with custom packers or obfuscation for testing purposes, leading