JExeCompressor10byArashVeyskarami

Hunt Hypothesis

This rule identifies the execution of JExeCompressor, a Java executable compressor often used by attackers to obfuscate malicious payloads and evade static analysis. Proactively hunting for this indicator helps the SOC team detect stealthy Java-based threats that may be leveraging legitimate compression tools to hide their presence within Azure Sentinel environments.

YARA Rule

rule JExeCompressor10byArashVeyskarami
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8D 2D D3 4A E5 14 0F BB F7 0F BA E5 73 0F AF D5 8D 0D 0C 9F E6 11 C0 F8 EF F6 DE 80 DC 5B F6 DA 0F A5 C1 0F C1 F1 1C F3 4A 81 E1 8C 1F 66 91 0F BE C6 11 EE 0F C0 E7 33 D9 64 F2 C0 DC 73 0F C0 D5 55 8B EC BA C0 1F 41 00 8B C2 B9 97 00 00 00 80 32 79 50 B8 02 00 00 00 50 03 14 24 58 58 51 2B C9 B9 01 00 00 00 83 EA 01 E2 FB 59 E2 E1 FF E0 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Java Application Packaging with ProGuard or R8:

  • Scenario: Developers or CI/CD pipelines use tools like ProGuard or R8 (Android build tools) or custom Java packers to obfuscate and compress JAR files for production deployment. These tools often rewrite bytecode in ways that match the structural patterns of the JExeCompressor10 signature, particularly when handling specific class loading mechanisms or resource compression.
  • Filter/Exclusion: Exclude files located in standard build artifact directories (e.g., */target/, */build/, */dist/) or exclude processes initiated by known build tools (e.g., mvn, gradle, proguard) from the YARA scan scope.

• Legacy Enterprise Java Applications (EJB/Servlet Containers):

  • Scenario: Older enterprise applications running on legacy Java EE containers (like WebLogic, WebSphere, or older Tomcat versions) may use proprietary class loaders or compressed classpath entries that mimic the compression algorithm or header structures targeted by this rule. This is common in long-standing financial or ERP systems that have not been modernized.
  • Filter/Exclusion: Create a whitelist for known legacy application JARs or WARs by SHA256 hash or specific file paths (e.g., */webapps/legacy-app/WEB-INF/lib/*.jar) after verifying they are stable and unchanged.

• Java Agent Attachments for APM Tools:

  • Scenario: Application Performance Monitoring (APM) agents such as New Relic, Dynatrace, or AppDynamics are attached to the JVM via -javaagent. These agents often inject bytecode or use internal compression/obfuscation for their own internal libraries to reduce memory footprint, which can trigger false positives if the agent’s JAR is scanned directly rather than the application code.