RJcrushv100

Hunt Hypothesis

This YARA rule targets the specific memory footprint or binary characteristics of the RJcrushv100 tool, which is often associated with low-severity reconnaissance or utility activities in the threat landscape. Proactively hunting for this signature allows the SOC to identify potentially benign or overlooked instances of this tool in use, ensuring that its presence is contextualized against known baselines to distinguish between legitimate operations and stealthy adversary staging.

YARA Rule

rule RJcrushv100
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 06 FC 8C C8 BA [2] 03 D0 52 BA [2] 52 BA [2] 03 C2 8B D8 05 [2] 8E DB 8E C0 33 F6 33 FF B9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy Java application server (e.g., Tomcat or WildFly) is performing a standard System.gc() call or loading a specific native library during its daily maintenance window, where the binary signature or memory pattern matches the RJcrushv100 heuristic due to shared code structures or specific string constants.

  • Filter/Exclusion: Exclude processes where the parent executable is java.exe or jvm.dll and the process name matches known Java runtime binaries (e.g., java.exe, javaw.exe). Additionally, exclude if the process path resides in standard JRE/JDK installation directories (e.g., C:\Program Files\Java\, C:\Program Files (x86)\Java\).

• Scenario: An enterprise endpoint protection agent (e.g., CrowdStrike Falcon, Carbon Black, or SentinelOne) is scanning a newly downloaded installer package or performing a real-time scan on a large archive file, causing the YARA rule to match the in-memory representation of the file’s header or specific embedded strings that resemble the RJcrushv100 pattern.

  • Filter/Exclusion: Exclude events where the process name corresponds to known EDR agents (e.g., FalconSensor.exe, CB.exe, SentinelOneAgent.exe) and the operation type is “Read” or “Scan”. Alternatively, exclude if the file path contains common archive extensions (.zip, .rar, .7z) and the parent process is a file explorer or download manager (e.g., explorer.exe, chrome.exe).

• Scenario: A scheduled PowerShell script used for log rotation or cleanup (e.g., CleanUpLogs.ps1) is executed by the Task Scheduler and invokes a native utility (like robocopy or del) that temporarily loads a DLL or executes a command with