PseudoSigner01VideoLanClientAnorganix

Hunt Hypothesis

This rule identifies the presence of the “PseudoSigner01VideoLanClientAnorganix” YARA signature, which likely indicates a specific malware variant or trojan associated with video LAN client functionality that may be used for lateral movement or data exfiltration. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to detect low-severity threats that might evade standard behavioral detections, ensuring early identification of potentially compromised endpoints before they establish persistent access.

YARA Rule

rule PseudoSigner01VideoLanClientAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: An IT administrator deploys a custom, internally developed video conferencing client (e.g., VideoLanClient.exe) via Group Policy or SCCM to user workstations. The binary is signed with an internal corporate certificate that the YARA rule’s PseudoSigner01 heuristic misidentifies as a known pseudo-signer due to overlapping certificate properties or hash collisions.

  • Filter/Exclusion: Exclude the specific file path C:\Program Files\VideoLan\Client\VideoLanClient.exe or filter by the internal certificate issuer name (e.g., CN=Corp-Internal-CodeSign) if the YARA rule allows metadata-based filtering.

• Scenario: A scheduled maintenance job runs a legacy video streaming service updater (AnorganixUpdater.exe) from a shared network drive (\\fileserver\apps\anorganix\) to patch the client. The process is launched by Task Scheduler (svchost.exe or taskschd.exe) and resides in a non-standard directory, triggering the “Anorganix” string match and the “VideoLanClient” context.

  • Filter/Exclusion: Exclude processes where the parent process is taskschd.exe and the file path contains \apps\anorganix\, or whitelist the specific hash of the updater binary if it remains stable across versions.

• Scenario: A developer tests a new build of the VideoLanClient application locally on their workstation. The executable is copied to the C:\Users\<devuser>\Desktop\ folder and executed directly. The YARA rule triggers because the binary contains the strings “VideoLanClient” and “Anorganix” (likely from embedded metadata or debug symbols) and is located in a user-writable directory, which often correlates with pseudo-signing behavior in heuristic rules. *