PseudoSigner01Armadillo300Anorganix

Hunt Hypothesis

This hypothesis targets the execution of files matching the YARA signature for PseudoSigner01Armadillo300Anorganix, which may indicate the presence of a specific low-severity malware variant or suspicious binary in the environment. Proactively hunting for this signature in Azure Sentinel allows the SOC team to identify and isolate potentially compromised hosts before the adversary can establish persistence or escalate privileges.

YARA Rule

rule PseudoSigner01Armadillo300Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a custom Python or Node.js script that dynamically generates or modifies a binary file (e.g., a plugin or shared library) using a library like pyinstaller or esbuild, where the resulting artifact contains specific string patterns or structural anomalies that match the PseudoSigner01Armadillo300Anorganix signature.

  • Filter/Exclusion: Exclude files located in standard build directories (e.g., C:\Projects\*\build\, C:\tmp\, /var/tmp/) or exclude processes originating from known build tools (msbuild.exe, npm.exe, python.exe) when the file extension is .dll, .so, or .pyd.

• Scenario: An enterprise application (such as a Java-based middleware like WebLogic or Tomcat) uses a custom classloader or dynamic code generation feature (e.g., CGLIB or ASM) to create temporary .class files or native wrappers in the system temp directory, which may exhibit pseudo-signature characteristics due to their generated nature.

  • Filter/Exclusion: Exclude files with paths containing \temp\ or \tmp\ that are created by Java Virtual Machine processes (java.exe, jre8\bin\java.exe) and have a size less than 5MB, as these are typically transient generated artifacts.

• Scenario: A security tool or EDR agent (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) creates a “shadow” or “quarantined” copy of a suspicious file in a dedicated isolation folder for analysis, which may retain original metadata or structural traits that trigger the YARA rule.

  • Filter/Exclusion: Exclude files located in known EDR quarantine or sandbox directories (e.g., `C:\ProgramData\CrowdStrike\