FreeJoiner151GlOFF

Hunt Hypothesis

This YARA rule targets the FreeJoiner151GlOFF component, a known artifact associated with the FreeJoiner malware family that often serves as a loader or dropper for subsequent payloads. Proactively hunting for this signature in Azure Sentinel allows the SOC to identify early-stage infections or dormant persistence mechanisms before they escalate to more impactful post-exploitation activities.

YARA Rule

rule FreeJoiner151GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 87 FF 90 90 B9 2B 00 00 00 BA 07 10 40 00 83 C2 03 90 87 FF 90 90 B9 04 00 00 00 90 87 FF 90 33 C9 C7 05 09 30 40 00 00 00 00 00 68 00 01 00 00 68 21 30 40 00 6A 00 E8 B7 02 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 21 30 40 00 E8 8F 02 00 00 A3 19 30 40 00 90 87 FF 90 8B 15 09 30 40 00 81 C2 04 01 00 00 F7 DA 6A 02 6A 00 52 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses a version control tool like Git or Mercurial to perform a git pull or hg pull operation on a local repository. The YARA rule may match binary artifacts or temporary files created during the merge or checkout process, especially if the rule targets specific string patterns in executable files or shared libraries that are temporarily loaded.

  • Filter/Exclusion: Exclude processes where the parent process is git.exe, hg.exe, or svn.exe. Additionally, exclude file paths containing .git, .hg, or .svn directories.

• Scenario: An IT administrator runs a scheduled task using Windows Task Scheduler to execute a maintenance script (e.g., diskcleanup.ps1 or logrotate.sh) that involves creating or modifying temporary files in %TEMP% or /tmp. If the YARA rule scans for specific byte patterns in recently modified files, it may flag these transient artifacts as they are written to disk.

  • Filter/Exclusion: Exclude files located in standard temporary directories such as C:\Users\<user>\AppData\Local\Temp, C:\Windows\Temp, or /tmp. Also, exclude processes initiated by schtasks.exe or Task Scheduler service (svchost.exe with LocalService or NetworkService).

• Scenario: A database administrator performs a backup or restore operation using SQL Server Management Studio (SSMS) or pgAdmin. These tools often create large binary dump files (.bak, .dmp, .sql) that may contain embedded strings or binary patterns matching the YARA rule’s signature, particularly if the rule is designed to detect obfuscated payloads or specific code segments.

  • Filter/Exclusion: Exclude file extensions commonly associated with database backups: .bak, .dmp, `.sql