This rule identifies the presence of Thinstall, a software installer that utilizes Just-In-Time (JIT) compilation to unpack and execute payloads, a technique often leveraged by adversaries to hide malicious code within legitimate application installers. Proactively hunting for this signature allows the SOC team to detect potentially compromised or obfuscated software deployments that may serve as a foothold for further lateral movement or privilege escalation within the environment.
rule ThinstallV2403Jitit
{
meta:
author="malware-lu"
strings:
$a0 = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
$a1 = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 57 BF 00 00 80 00 39 79 14 77 36 53 56 8B B1 29 04 00 00 8B 41 0C 8B 59 10 03 DB 8A 14 30 83 E2 01 0B D3 C1 E2 07 40 89 51 10 89 41 0C 0F B6 04 30 C1 61 14 08 D1 E8 09 41 10 39 }
condition:
$a0 at pe.entry_point or $a1 at pe.entry_point
}This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Scenario: A legacy line-of-business application (e.g., a specific version of SAP GUI or Oracle Forms) is packaged with Thinstall to reduce deployment size and improve startup performance. The executable is signed by a trusted vendor certificate but retains the Thinstall PE structure.
PE.NumberOfSections is less than 10 (Thinstall typically creates many sections) AND the PE.Imports contains standard Windows DLLs like kernel32.dll, user32.dll, and gdi32.dll without any suspicious imports like VirtualAlloc or CreateThread in the first section. Alternatively, whitelist by specific PE.File.Name (e.g., sapgui.exe, forms.exe) if the path is consistent.Scenario: An internal IT team uses Thinstall to package a custom PowerShell script or .NET application for mass deployment via Group Policy Preferences or SCCM. The resulting executable is placed in a standard system directory like C:\Windows\System32\ or C:\Program Files\InternalTools\.
C:\Windows\System32\ or C:\Program Files\ AND the file is owned by SYSTEM or NT AUTHORITY\NETWORK SERVICE. Additionally, check if the parent process is a known deployment tool like ccmexec.exe (SCCM) or gpupdate.exe.Scenario: A developer or QA engineer runs a Thinstall-packed test binary from a temporary directory (e.g., C:\Users\<user>\AppData\Local\Temp\) during a manual regression test. The binary is not signed and is executed directly from the user profile.