PseudoSigner02UPX06Anorganix

Hunt Hypothesis

This rule identifies executable files that exhibit characteristics of the PseudoSigner02 tool, specifically when packed with UPX and associated with the Anorganix family, indicating the use of a known malware builder to create trojans or stealers. Proactively hunting for these signatures allows the SOC to detect low-severity, commodity-level threats that may be used for initial access or credential theft before they establish persistence or lateral movement within the Azure environment.

YARA Rule

rule PseudoSigner02UPX06Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer manually compiles a small utility or script wrapper using a custom build pipeline that includes UPX compression to reduce binary size for deployment to edge devices or containers. The resulting binary retains the specific UPX signature patterns matched by the rule but is signed by an internal corporate certificate or executed from a trusted development path.

  • Filter/Exclusion: Exclude binaries located in specific development directories (e.g., C:\Dev\Builds\, /opt/dev/builds/) or where the parent process is a known build tool (e.g., msbuild.exe, dotnet.exe, make.exe). Additionally, exclude if the file has a valid Authenticode signature from an internal CA.

• Scenario: An IT administrator installs a legacy third-party utility or older version of a software package (e.g., old versions of WinRAR, 7-Zip, or specific hardware drivers) that was packaged with UPX compression by the vendor. These binaries are often placed in C:\Program Files\ or C:\Program Files (x86)\ and are executed by standard service accounts or user sessions.

  • Filter/Exclusion: Exclude files located in standard program installation directories (C:\Program Files\, C:\Program Files (x86)\, C:\ProgramData\) if the file hash matches a known baseline of approved software or if the file has a valid digital signature from a known vendor (e.g., WinRAR, 7-Zip, Intel, NVIDIA).

• Scenario: A scheduled task or service runs a small, UPX-compressed helper binary used for log rotation, disk cleanup, or telemetry collection. These binaries are often placed in C:\Windows\Temp\, C:\Users\<user>\AppData\Local\Temp\, or C:\ProgramData\<vendor>\