PseudoSigner01LCCWin321xAnorganix

Hunt Hypothesis

This YARA rule targets the PseudoSigner01LCCWin321xAnorganix malware family, which leverages a pseudo-signature to masquerade as legitimate software and evade basic security controls on Windows endpoints. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify compromised hosts that may be using this low-severity, signature-based evasion technique to establish persistence or execute malicious payloads before they progress to more impactful stages of the attack lifecycle.

YARA Rule

rule PseudoSigner01LCCWin321xAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 [4] 68 9A 10 40 90 50 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of legacy or niche Win32 applications (e.g., old versions of Adobe Acrobat Reader, specific CAD tools, or industrial control software) that utilize older, non-standard PE header structures or custom signing mechanisms that inadvertently match the “Anorganix” pattern.
  • Filter/Exclusion: Exclude known application paths (e.g., C:\Program Files\Adobe\, C:\Program Files (x86)\Autodesk\) or specific executable names (e.g., AcroRd32.exe, acad.exe) from the YARA scan scope, or add an exclusion for files with specific version numbers known to be stable.
• Scenario: Automated backup or snapshot jobs (e.g., Veeam, Commvault, or Windows Server Backup) creating temporary shadow copies or intermediate files in the C:\Windows\Temp\ or C:\Users\Public\ directories that retain the original binary’s PE structure before being compressed or encrypted.
  • Filter/Exclusion: Exclude files located in standard temporary or backup staging directories (e.g., *\Temp\, *\Backup\, *\Veeam\) or filter out files with extensions like .vbk, .tmp, or .swp if the rule is triggered on file system scans rather than process memory.
• Scenario: Development or testing environments where developers compile custom Win32 DLLs or executables using specific compiler flags (e.g., MSVC /O2 optimization or specific linker settings) that result in a PE header layout matching the “PseudoSigner” signature, particularly when these binaries are copied to shared network drives or build artifact repositories.
  • Filter/Exclusion: Exclude paths associated with development environments (e.g., C:\Users\*\AppData\Local\Temp\, `\buildserver\artifacts\