EXECryptor V22X softcompletecom additional

Hunt Hypothesis

This hypothesis targets the presence of EXECryptor V22X malware variants, specifically those associated with the “softcompletecom” string, which indicates a potential ransomware or crypter deployment on endpoints. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify compromised hosts early, preventing lateral movement or data encryption before the adversary achieves full operational capability.

YARA Rule

rule EXECryptor_V22X_softcompletecom_additional: PEiD
{
    strings:
        $a = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT admin uses a legitimate commercial software bundler or installer creation tool (e.g., Inno Setup, NSIS, or Advanced Installer) that internally utilizes a proprietary compression or encryption algorithm similar to EXECryptor to package application installers. The resulting .exe file may match the YARA signature due to shared code structures or specific byte patterns in the PE header.

  • Filter/Exclusion: Exclude files located in standard build output directories (e.g., C:\Builds\, D:\Installers\) or exclude processes originating from known installer compilers (e.g., ISCC.exe, makensis.exe). Additionally, consider excluding files with specific version strings or digital signatures from known vendor certificates.

• Scenario: An enterprise application uses a custom-compiled C/C++ or Rust binary that incorporates a third-party compression library (such as LZMA, Zlib, or Brotli) with specific optimization flags, causing the binary’s import table or code sections to resemble the EXECryptor V22X structure. This is common in high-performance data processing tools or custom internal microservices.

  • Filter/Exclusion: Exclude binaries that have a valid Authenticode signature from the organization’s internal code-signing certificate. Alternatively, exclude files where the TimeDateStamp in the PE header falls within a known range of recent internal builds, or exclude paths under C:\Program Files\InternalApps\ or C:\Services\.

• Scenario: A scheduled maintenance job runs a utility like 7-Zip (7z.exe) or WinRAR (WinRAR.exe) to compress or extract archives containing executables. If the YARA rule is scanning memory or disk for specific byte sequences associated with EXECryptor’s compression routine, it may falsely match the compression algorithm’s implementation within these well-known