PseudoSigner01Morphine12Anorganix

Hunt Hypothesis

This YARA rule targets specific binary artifacts associated with the PseudoSigner01Morphine12Anorganix signature, indicating the presence of potentially obfuscated or malicious code that may be used for initial access or persistence. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised workloads or containers before they can establish a foothold and execute further post-exploitation actions.

YARA Rule

rule PseudoSigner01Morphine12Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A development team uses a custom, internally built code signing utility (e.g., InternalSigner.exe) that embeds a proprietary header or metadata block matching the PseudoSigner01 signature pattern to track build lineage, rather than using standard Microsoft Authenticode.

  • Filter/Exclusion: Exclude files located in specific development build directories (e.g., C:\Dev\Builds\) or exclude processes with the name InternalSigner.exe from the YARA scan scope.

• Scenario: An automated deployment pipeline runs a scheduled task (Deploy_Apps) that executes a legitimate third-party installer (e.g., AdobeUpdater.exe or ChromeInstaller.exe) which has been repackaged or patched by an internal IT tool (IT_Patcher.vbs), inadvertently introducing a byte sequence that matches the Morphine12 pattern due to a specific compression algorithm or padding.

  • Filter/Exclusion: Exclude files with extensions .msi or .exe that are signed by known internal IT certificates or located in the C:\Program Files\ITTools\ directory.

• Scenario: A security testing team runs a fuzzing or mutation testing tool (e.g., AFL++ or Radamsa) against a legacy application binary (LegacyApp.dll) to test robustness, causing the binary to be temporarily modified in memory or on disk with random byte sequences that coincidentally match the Anorganix signature component.

  • Filter/Exclusion: Exclude files in the temporary working directory of the fuzzing tool (e.g., C:\Temp\Fuzzing\) or exclude files modified within the last 5 minutes during active security testing windows.

• Scenario: A Java or .NET application uses a custom serialization library that appends a specific magic number or checksum trailer to