PseudoSigner01UPX06Anorganix

Hunt Hypothesis

This rule detects executable files that have been packed with UPX and exhibit characteristics associated with the PseudoSigner01 and Anorganix malware families, indicating potential use of obfuscated or unsigned payloads to evade static analysis. Proactively hunting for these indicators in Azure Sentinel allows the SOC team to identify compromised endpoints or suspicious artifacts before they can establish persistence or execute further malicious actions within the environment.

YARA Rule

rule PseudoSigner01UPX06Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A development team uses UPX (Ultimate Packer for eXecutables) to compress custom-built C++ CLI tools or microservices to reduce deployment size and startup time. The resulting binary retains the UPX header, triggering the “UPX06” component of the rule, while the custom signing process (or lack thereof) may mimic the “PseudoSigner” pattern if the certificate chain is incomplete or self-signed.

  • Filter/Exclusion: Exclude binaries located in specific development build directories (e.g., C:\dev\builds\, D:\artifacts\) or filter by file extension .exe where the parent process is a known build tool like MSBuild.exe, dotnet.exe, or cmake.exe.

• Scenario: An IT administrator deploys a lightweight, open-source utility (e.g., 7-Zip, WinRAR, or a custom PowerShell wrapper) that has been packed with UPX to fit within a USB drive or shared drive quota. The tool is signed with a valid code-signing certificate, but the YARA rule might be overly sensitive to the specific UPX version (0.6) or misinterpret the signature metadata as “pseudo” due to a mismatch in the timestamp or certificate chain depth.

  • Filter/Exclusion: Whitelist known vendor executables by hash (SHA-256) or exclude files where the Signer field in the PE header matches a trusted internal CA or a well-known public CA (e.g., DigiCert, Sectigo) and the Timestamp is within the last 90 days.

• Scenario: A scheduled maintenance job runs a Python-based script compiled to an executable using PyInstaller or Nuitka, which internally uses UPX compression for the bundled Python interpreter. The resulting .exe file is