PseudoSigner01LocklessIntroPackAnorganix

Hunt Hypothesis

This rule identifies the execution of the PseudoSigner01LocklessIntroPackAnorganix payload, a known component of the PseudoSigner malware family that often serves as an initial access or persistence mechanism. Proactively hunting for this signature allows the SOC to detect low-severity, potentially stealthy infections that may be leveraging unsigned or weakly signed binaries to establish a foothold before deploying more advanced post-exploitation tools.

YARA Rule

rule PseudoSigner01LocklessIntroPackAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer is testing a new internal build of a proprietary application that uses the “LocklessIntroPack” obfuscation technique for its installer or update agent. The binary is signed with a pseudo-signature (e.g., a self-signed certificate or a specific “Anorganix” test key) to bypass strict code integrity checks during the QA phase, triggering the YARA rule on the file system or in memory.

  • Filter/Exclusion: Exclude files located in specific development or QA directories (e.g., C:\Dev\QA\Builds\ or C:\Temp\InternalTest\) and exclude processes running from these paths if the parent process is a known IDE (e.g., devenv.exe, code.exe) or a build tool (e.g., msbuild.exe, dotnet.exe).

• Scenario: An IT administrator is deploying a custom PowerShell script or a small utility wrapper that has been packed using the “Anorganix” packer to reduce size or protect intellectual property. The script is executed via powershell.exe or pwsh.exe from a shared administrative folder, and the YARA rule detects the packed header in the loaded script or the associated helper binary.

  • Filter/Exclusion: Exclude executions where the parent process is powershell.exe or pwsh.exe and the file path contains administrative keywords (e.g., Admin, Scripts, Tools) or is located in the standard system32 or program files directories for known internal tools. Additionally, exclude if the command line arguments contain common administrative flags like -ExecutionPolicy Bypass or -File pointing to a known internal path.

• Scenario: A scheduled maintenance job runs a third-party backup or log rotation utility that has been repacked or modified by a vendor to include the “LocklessIntroPack”